joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a030
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14006a072
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14006a0b9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14006a112
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14006a0d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14006a153
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14007c0fa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14007c0fb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14006a120
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14006b150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006b19a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006b19a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006b19a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006b19a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006b19a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006b19c
xor al, al
add rsp, 0x28
ret
Function at 0x2abce15c0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x2abce15e1
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp fcn.2abd05f20

Function at 0x2abce8710
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x158
movaps xmmword [rsp + 0x140], xmm6
cmp qword [0x2abd8cd60], 0
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x178], rdx
mov byte [rsp + 0x2f], 1
je 0x2abce8807
mov rax, qword [0x2abd8ce40]
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [0x2abd8ce40], rax
call sub.msvcrt.dll__setjmp
cdqe
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x2abce8830
xor r12d, r12d
cmp qword [rsp + 0x170], 0
je 0x2abce87dc
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_strlen
mov edx, 7
lea rcx, [0x2abd07020]
cmp rax, rdx
movq xmm6, rax
mov rbx, rax
cmovge rdx, rax
movq xmm0, rdx
add rdx, 0x11
punpcklqdq xmm6, xmm0
call fcn.2abcfefe0
mov rdx, qword [rsp + 0x170]
lea r8, [rbx + 1]
movups xmmword [rax], xmm6
lea rcx, [rax + 0x10]
mov r12, rax
call sub.msvcrt.dll_memcpy
mov rcx, r12
call qword [0x2abd8cd60]
cmp qword [rsp + 0x38], 0
mov byte [rsp + 0x2f], 0
mov rax, qword [0x2abd8ce40]
mov rax, qword [rax]
mov qword [0x2abd8ce40], rax
jne 0x2abce8899
movzx eax, byte [rsp + 0x2f]
test al, al
jne 0x2abce88a8
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x158
pop rbx
pop r12
ret
mov rax, qword [0x2abd8ce40]
mov rax, qword [rax]
mov qword [rsp + 0x38], 0
mov qword [0x2abd8ce40], rax
mov rax, qword [0x2abd9a9e8]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x2abce886b
add qword [rbx - 0x10], 8
mov rax, qword [0x2abd9a9e8]
test rax, rax
je 0x2abce8886
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
sub rdx, 8
mov qword [rax - 0x10], rdx
cmp rdx, 7
ja 0x2abce8886
call fcn.2abcfe740
cmp qword [rsp + 0x38], 0
mov qword [0x2abd9a9e8], rbx
je 0x2abce8807
call fcn.2abce91a0
jmp 0x2abce8807
mov ecx, 2
call qword [fcn.2abd06850]
mov rcx, qword [rsp + 0x170]
mov edx, 1
mov r8, qword [rsp + 0x178]
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2abd05f20
jmp 0x2abce8814
Function at 0x2abcea440
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2abd06850]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2abd05f20
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rax, qword [0x2abd9a9e0]
cmp rax, 0xdab
jg 0x2abcea4be
lea rdx, [0x2abd93c80]
mov qword [rdx + rax*8], rcx
add rax, 1
mov qword [0x2abd9a9e0], rax
add rsp, 0x28
ret
call fcn.2abcea440
nop
nop word cs:[rax + rax]
nop
push r12
sub rsp, 0x30
mov rax, qword [0x2abd9a9e0]
cmp rax, 0xdab
jg 0x2abcea56f
lea rdx, [0x2abd93c80]
lea rcx, [0x2abce43e0]
mov qword [rdx + rax*8], rcx
add rax, 1
lea r12, [0x2abce9250]
mov qword [0x2abd9a9e0], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.2abce17e0
call fcn.2abce2bf0
mov rdx, r12
mov ecx, 2
call fcn.2abd05ed8
mov rdx, r12
mov ecx, 0xb
call fcn.2abd05ed8
mov rdx, r12
mov ecx, 0x16
call fcn.2abd05ed8
mov rdx, r12
mov ecx, 8
call fcn.2abd05ed8
mov rdx, r12
mov ecx, 4
call fcn.2abd05ed8
nop
add rsp, 0x30
pop r12
ret
call fcn.2abcea440
nop
nop word cs:[rax + rax]

Function at 0x2abcea6e0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2abd06850]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2abd05f20
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rax, qword [0x2abd93c60]
cmp rax, 0xdab
jg 0x2abcea75e
lea rdx, [0x2abd8cf00]
mov qword [rdx + rax*8], rcx
add rax, 1
mov qword [0x2abd93c60], rax
add rsp, 0x28
ret
call fcn.2abcea6e0
nop
nop word cs:[rax + rax]
nop
Function at 0x2abcebf70
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea rcx, [0x2abd084f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x2abd9d8b8], rax
mov r12, rax
test rax, rax
je 0x2abcec060
lea r13, str.GetCurrentThread
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, r13
call rbx
test rax, rax
je 0x2abcec070
mov r12, qword [0x2abd9d8b8]
lea r13, [0x2abd08313]
mov qword [0x2abd8c430], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2abcec080
mov r12, qword [0x2abd9d8b8]
lea r13, str.HeapCreate
mov qword [0x2abd8c428], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2abcec090
mov r12, qword [0x2abd9d8b8]
lea r13, str.HeapAlloc
mov qword [0x2abd8c420], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2abcec0a0
mov r12, qword [0x2abd9d8b8]
lea r13, [0x2abd08339]
mov qword [0x2abd8c418], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x2abcec0b0
mov qword [0x2abd8c410], rax
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rcx, [0x2abd084c0]
call fcn.2abce9360
nop dword [rax]
mov rdx, r13
mov rcx, r12
call fcn.2abcea580
jmp 0x2abcebfb8
mov rdx, r13
mov rcx, r12
call fcn.2abcea580
jmp 0x2abcebfde
mov rdx, r13
mov rcx, r12
call fcn.2abcea580
jmp 0x2abcec004
mov rdx, r13
mov rcx, r12
call fcn.2abcea580
jmp 0x2abcec026
mov rdx, r13
mov rcx, r12
call fcn.2abcea580
jmp 0x2abcec048
Function at 0x2abcf2930
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbx
sub rsp, 0x48
mov r12, rcx
test edx, edx
je 0x2abcf2908
mov edx, 0x7610ca06
lea rcx, [0x2abd09340]
lea rbx, [rsp + 0x30]
call fcn.2abcf0a00
mov edx, 0x4fb7f1e2
mov rcx, rax
call fcn.2abcf1b90
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x2abd9dfe0]
lea r9, [rsp + 0x28]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [0x2abd9dfd8]
mov edx, 0x626e0762
lea rcx, [0x2abd09300]
mov r12d, eax
call fcn.2abcf0a00
mov edx, 0x6091c6c6
mov rcx, rax
call fcn.2abcf1b90
xor eax, eax
test r12d, r12d
cmove rax, qword [rsp + 0x28]
add rsp, 0x48
pop rbx
pop r12
ret
mov edx, 0x4b7be9a2
lea rcx, [0x2abd092c0]
call fcn.2abcf0a00
mov edx, 0x2a1bc586
mov rcx, rax
call fcn.2abcf1b90
xor eax, eax
add rsp, 0x48
pop rbx
pop r12
ret
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbx, [0x2abd83460]
mov r13, rcx
mov r12d, edx
lea rcx, [0x2abd834a0]
mov edx, 0x1adf2dc6
call fcn.2abcf0a00
mov edx, 0x3c510522
mov rcx, rax
call fcn.2abcf1b90
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop dword [rax]
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x2abcf29b0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2abcf2a30
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2abcf2990
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x2abcf29e0
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2abcf2a50
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2abcf29c0
mov rdx, r8
mov rcx, r13
call fcn.2abcf1460
mov edx, 0x6091c6c6
mov rcx, rbx
mov rbp, rax
call fcn.2abcf0a00
mov edx, 0x7af03022
mov rcx, rax
call fcn.2abcf1b90
test rbp, rbp
je 0x2abcf2a66
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x2abcf2980
mov edx, r12d
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x2abcf2860
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2abcf2990
jmp 0x2abcf29b0
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2abcf29c0
jmp 0x2abcf29e0
mov rax, qword [rdi + 0x20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x2abcf2a80
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0x1adf2dc6
lea rbx, [0x2abd83460]
mov r12, rcx
lea rcx, [0x2abd834a0]
call fcn.2abcf0a00
mov edx, 0x3c510522
mov rcx, rax
call fcn.2abcf1b90
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [r12]
mov rdx, r12
test ax, ax
je 0x2abcf2b00
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2abcf2b80
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2abcf2ae0
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x2abcf2b30
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2abcf2ba0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2abcf2b10
mov rdx, r8
mov rcx, r12
call fcn.2abcf1460
mov edx, 0x6091c6c6
mov rcx, rbx
mov rbp, rax
call fcn.2abcf0a00
mov edx, 0x7af03022
mov rcx, rax
call fcn.2abcf1b90
test rbp, rbp
je 0x2abcf2bb6
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x2abcf2ad0
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x2abcf2860
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2abcf2ae0
jmp 0x2abcf2b00
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2abcf2b10
jmp 0x2abcf2b30
mov rax, qword [rdi + 0x20]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x2abcff760
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.2abd06850
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.2abd06850
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x2abd000d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2abda1308]
test eax, eax
je 0x2abd0016a
lea rax, [0x2abda12e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2abda1310]
mov qword [rbp - 8], rax
jmp 0x2abd0014e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2abd00142
cmp qword [rbp - 0x10], 0
je 0x2abd00142
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2abd00108
lea rax, [0x2abda12e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2abd0016b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2abd00270
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2abd00298
mov eax, 0
jmp 0x2abd002e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2abd002c1
mov eax, 0
jmp 0x2abd002e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2abd002e1
mov eax, 0
jmp 0x2abd002e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2abd002ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2abd0036a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2abd00361
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2abd00361
mov rax, qword [rbp - 8]
jmp 0x2abd0037f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2abd00334
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140095600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xaaf], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1400956cb
cmp qword [rcx + 0x260], 0
je 0x14009567e
mov qword [rsp + 0x40], rbx
call fcn.1400845e0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.140084950
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.140084950
mov rbx, qword [rsp + 0x40]
jmp 0x1400956cb
mov ecx, esi
test edx, edx
je 0x14009568e
sub ecx, 1
je 0x14009568e
cmp ecx, 1
jne 0x1400956cb
mov r9, qword [rdi + 0x1d0]
lea rax, [0x14029ec10]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140097a50
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x140097db0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x140378098]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140097e16
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140097df9
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140097df3
shr ax, 8
cmp al, 2
je 0x140097e16
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14011d660
add rsp, 0x1e8
ret
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140097e49
mov qword [0x14037ad58], rsi
jmp 0x140097fd2
mov qword [rsp + 0x1f0], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x14029ef78]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbspbrk]
test rax, rax
je 0x140097eae
mov rcx, rbx
test rbp, rbp
je 0x140097ea0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x140097f9a
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x140097f9a
test rbp, rbp
je 0x140097edd
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097edd
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x140097f9a
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x140097f92
lea ecx, [rax + 1]
add rcx, 0xc
call qword [fcn.14011eeb0]
mov rdi, rax
test rax, rax
je 0x140097f89
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140097f89
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x140097f30
mov word [rax + rdi], 0x5c
inc rcx
cmp byte [rdi + rcx], sil
jne 0x140097f41
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140097f60
mov rcx, rdi
test rbp, rbp
je 0x140097f80
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x140097f86
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.14011eeb6]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x14037ad58], rsi
test rsi, rsi
je 0x140097fd2
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097fd2
mov qword [0x14037ad50], rax
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1400cdd20
test al, al
lea rcx, [0x14037d7b8]
setne byte [0x14037d7b0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14011d660
add rsp, 0x1e8
ret
Function at 0x14009e010
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x14009e025
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.14009daa0
Function at 0x1400a8d30
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.14008aa60
mov rcx, rbx
movups xmm6, xmmword [rax]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400a8de0
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.14008aa60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.14008aaf0
cmp rax, 0x3e8
ja 0x1400a8e13
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400a8d90
test rsi, rsi
je 0x1400a8dee
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400a8dfc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1400a8e21
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400a8e2f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x1400a8dfe
Function at 0x1400a92c0
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1400a945e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1400a943e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x1400a932e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a9320
inc rbx
jmp 0x1400a9330
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1400a933d
lea ebp, [rax + 0xe]
jmp 0x1400a9349
cmp eax, 0x17
jne 0x1400a93e1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], 0
je 0x1400a93e1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400a93e1
cmp rax, rbp
jb 0x1400a93e1
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [fcn.14011eeb0]
mov r14, rax
test rax, rax
je 0x1400a93f0
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x1400a93ce
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x1400a93de
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1400a9310
jmp 0x1400a93f6
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x1400a9410
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1400a9439
test rdi, rdi
je 0x1400a9435
nop word [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.14011eeb6]
mov rdi, rbx
test rbx, rbx
jne 0x1400a9420
xor edi, edi
jmp 0x1400a944d
test rdi, rdi
jne 0x1400a944d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret

Function at 0x1400a98c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
je 0x1400a98f7
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret