joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bf400
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
push r14
push r13
mov r13, rcx
mov ecx, 1
push r12
push rbx
mov rbx, rdx
mov edx, 0x368
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400bf595
mov qword [rax + 0x60], 1
mov edx, 1
mov ecx, 1
mov qword [rax + 0x80], 1
call sub.msvcrt.dll_calloc
mov dword [r12 + 0x34], 6
mov qword [r12 + 0x70], rax
call fcn.140104670
mov ecx, 2
xor r8d, r8d
mov qword [r12 + 0x278], rbx
mov qword [r12 + 0x38], rax
mov edx, 2
mov dword [r12 + 0x260], 0x2019
call qword [sym.imp.WS2_32.dll_socket]
mov qword [r12], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400bf618
lea r9, [rsp + 0x30]
mov r8d, 0x1002
mov edx, 0xffff
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x20], 4
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
call rbx
mov rcx, qword [r12]
lea r8, [rsp + 0x34]
mov edx, 0x8004667e
mov dword [rsp + 0x34], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x38], 1
mov rcx, qword [r12]
mov r8d, 4
call rbx
test eax, eax
js 0x1400bf5e0
mov eax, 2
mov ecx, 0x7f000001
mov qword [rsp + 0x40], 0
lea r14, [rsp + 0x40]
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], ax
call qword [sym.imp.WS2_32.dll_htonl]
mov rcx, qword [r12]
mov r8d, 0x10
mov rdx, r14
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x1400bf5a8
mov dword [rsp + 0x3c], 0x64
mov rcx, qword [r12]
lea r8, [rsp + 0x3c]
mov rdx, r14
call qword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [rsp + 0x42]
mov word [r12 + 0x1c], ax
test r13, r13
je 0x1400bf595
mov rdx, r12
mov rcx, r13
call fcn.1400beb00
lea rsp, [rbp - 0x20]
mov rax, r12
pop rbx
pop r12
pop r13
pop r14
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, [0x1402be0e3]
lea r8, str.dap_context
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400bf585
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 5
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Cant_set_up_REUSEADDR_flag_to_the_socket__err:__d
lea r8, str.dap_context
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400bf519
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Error_creating_socket_for_TYPE_EVENT:__d
lea r8, str.dap_context
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov rcx, r12
xor r12d, r12d
call sub.msvcrt.dll_free
jmp 0x1400bf595
Function at 0x1400c4030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400c4060
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400c4050
shr eax, 4
add rsp, 0x28
and eax, 1
ret
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
ret
Function at 0x1400c7380
Capabilities:
Encode data using base64

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
cmp r9d, 1
je 0x1400c7588
cmp r9d, 2
jne 0x1400c75a7
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_UUUUUU
test r8, r8
je 0x1400c7598
test rdx, rdx
je 0x1400c7598
movzx r9d, byte [rcx]
lea rax, [rcx + 1]
xor r12d, r12d
mov byte [rsp + 0x2d], r9b
mov r9d, 1
cmp rdx, 1
je 0x1400c74c0
add rcx, rdx
xor esi, esi
mov edx, 1
xor r12d, r12d
jmp 0x1400c73f4
cmp rcx, rax
je 0x1400c74a0
mov edx, r9d
movzx r11d, byte [rax]
movzx r10d, dl
add rax, 1
lea r9d, [rdx + 1]
mov byte [rsp + r10 + 0x2d], r11b
cmp dl, 2
jne 0x1400c73e8
movzx r9d, byte [rsp + 0x2d]
movzx edx, byte [rsp + 0x2e]
movzx r10d, byte [rsp + 0x2f]
mov r11d, r9d
shl r9d, 4
shr r11b, 2
and r9d, 0x30
movzx r11d, r11b
movzx r11d, byte [rbx + r11]
mov byte [r8 + r12], r11b
mov r11d, edx
shl edx, 2
shr r11b, 4
and edx, 0x3c
add r9d, r11d
mov r11d, r10d
and r10d, 0x3f
movzx r9d, r9b
shr r11b, 6
movzx r9d, byte [rbx + r9]
add edx, r11d
movzx edx, dl
mov byte [r8 + r12 + 1], r9b
movzx edx, byte [rbx + rdx]
lea r9, [r12 + 3]
mov byte [r8 + r12 + 2], dl
movzx edx, byte [rbx + r10]
add r12, 4
mov byte [r8 + r9], dl
cmp rcx, rax
je 0x1400c74aa
mov esi, 1
xor r9d, r9d
jmp 0x1400c73f1
test sil, sil
je 0x1400c74c0
test r9b, r9b
jne 0x1400c74c0
add rsp, 0x30
mov rax, r12
pop rbx
pop rsi
pop r12
ret
movzx r10d, r9b
movzx eax, r9b
mov edx, 3
lea r11, [rsp + r10 + 0x2d]
sub edx, eax
je 0x1400c74e6
xor eax, eax
mov ecx, eax
add eax, 1
mov byte [r11 + rcx], 0
cmp eax, edx
jb 0x1400c74d8
movzx eax, byte [rsp + 0x2d]
movzx ecx, byte [rsp + 0x2e]
movzx r11d, byte [rsp + 0x2f]
mov esi, eax
shl eax, 4
lea edx, [rcx*4]
shr sil, 2
and eax, 0x30
shr cl, 4
and edx, 0x3c
movzx esi, sil
add eax, ecx
shr r11b, 6
movzx esi, byte [rbx + rsi]
movzx eax, al
add edx, r11d
lea r11, [r12 + 1]
mov byte [r8 + r12], sil
movzx eax, byte [rbx + rax]
mov byte [r8 + r12 + 1], al
cmp r9b, 2
jne 0x1400c7547
movzx edx, dl
movzx eax, byte [rbx + rdx]
mov byte [r8 + r12 + 2], al
mov r12d, 3
add r11, r10
sub r12d, r9d
add r8, r11
movzx r12d, r12b
mov ecx, r12d
test r12d, r12d
je 0x1400c7572
xor eax, eax
mov edx, eax
add eax, 1
mov byte [r8 + rdx], 0x3d
cmp eax, ecx
jb 0x1400c7564
add rsp, 0x30
add r12, r11
mov rax, r12
pop rbx
pop rsi
pop r12
ret
lea rbx, [0x1402c6e20]
test r8, r8
jne 0x1400c73ac
add rsp, 0x30
xor r12d, r12d
mov rax, r12
pop rbx
pop rsi
pop r12
ret
lea rcx, str.Unknown_base64_standard
call sub.msvcrt.dll_perror
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
cmp rcx, 0x10
jbe 0x1400c75d0
lea rax, [rcx - 8]
ret
sub rsp, 0x38
lea rax, str.blowfish_cbc_decryption_size_in_ct_with_iv_must_be_more_than_28_bytes
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.dap_enc_blowfish
call fcn.14005a150
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400c9b20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rax, r8
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x160
and eax, 0xf
mov qword [rbp + 0x28], r9
mov qword [rsp + 0x48], rax
jne 0x1400c9c54
mov r12, r8
cmp r8, qword [rbp + 0x30]
ja 0x1400c9c30
mov rdi, rdx
mov rdx, qword [rcx + 8]
lea r13, [rsp + 0x50]
mov rax, qword [rcx + 0x98]
lea r15, [rsp + 0x70]
mov rcx, r13
movdqu xmm0, xmmword [rdx]
mov rsi, qword [rax]
mov r14, qword [rax + 8]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm1, xmmword [rdx + 0x10]
mov edx, 8
movaps xmmword [rsp + 0x60], xmm1
call fcn.140207de0
mov rcx, r13
mov rdx, r15
mov r13, r12
call fcn.14004e310
shr r13, 4
je 0x1400c9bfa
mov rbx, qword [rbp + 0x28]
shl r13, 4
add r13, rbx
nop word [rax + rax]
mov rdx, rbx
mov rcx, rdi
mov r8, r15
add rdi, 0x10
call fcn.140044b40
mov rax, r14
xor dword [rbx], esi
shr rsi, 0x20
xor dword [rbx + 8], r14d
shr rax, 0x20
xor dword [rbx + 4], esi
xor dword [rbx + 0xc], eax
add rbx, 0x10
mov rsi, qword [rdi - 0x10]
mov r14, qword [rdi - 8]
cmp r13, rbx
jne 0x1400c9bc0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax + r12 - 1]
cmp r12, rax
jb 0x1400c9c81
sub r12, rax
mov qword [rsp + 0x48], r12
mov rax, qword [rsp + 0x48]
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, str.buf_out_size___a_in_size
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_enc_aes
call fcn.14005a150
jmp 0x1400c9c11
lea rax, str.Bad_in_size
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_enc_aes
call fcn.14005a150
mov qword [rsp + 0x48], 0
jmp 0x1400c9c11
mov qword [rsp + 0x28], rax
lea rax, str.Padding_size_is__zu_while_whole_message_is_just__zu
mov r9d, 8
lea r8, str.dap_enc_aes
mov qword [rsp + 0x30], r12
mov edx, 0x85
lea rcx, str.dap_enc_iaes256_cbc_decrypt_fast
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400c9c11
Function at 0x1400cf260
Capabilities:
Get system information on windows
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
mov ecx, 0x202
and rsp, 0xfffffffffffffff0
sub rsp, 0x200
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400cf3a0
mov rax, qword [0x1403e4430]
mov rcx, qword [rax]
xor eax, eax
test rcx, rcx
je 0x1400cf2b7
xor r9d, r9d
lea r8, str.debug_reactor
lea rdx, [0x1402be24b]
call fcn.1400be3d0
lea rsi, [rsp + 0x30]
mov byte [0x1403ef5a0], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x50]
cmp ebx, edx
cmova rbx, rdx
test ebx, ebx
je 0x1400cf370
mov dword [0x14024e5b0], ebx
lea rdx, [rbx*8]
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [0x1403ef5a8], rax
test rax, rax
je 0x1400cf4d3
call fcn.1400bfb40
test eax, eax
jne 0x1400cf3e1
mov rcx, r12
call fcn.140104e20
call fcn.1400cfb30
mov r12d, eax
test eax, eax
jne 0x1400cf4a4
mov eax, dword [0x14024e5b0]
mov r9d, 2
xor edx, edx
xor ecx, ecx
lea r8, str.dap_events
mov dword [rsp + 0x28], eax
lea rax, str.Initialized_event_socket_reactor_for__u_threads
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov eax, r12d
mov dword [0x1403ef5b0], 1
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [0x14024e5b0], edx
shl rdx, 3
jne 0x1400cf2eb
mov qword [0x1403ef5a8], 0
mov r12d, 0xffffffff
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [rsp + 0x28], eax
mov r9d, 8
mov edx, 0xe4
lea rax, str.Couldnt_init_Winsock_DLL__error:__d
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
lea rcx, str.dap_events_init
mov r12d, 2
call fcn.14005a150
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
lea rax, str.Cant_init_client_submodule_dap_context___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xf5
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a150
lea rax, str.Deinit_events_subsystem
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
call fcn.14005a150
call fcn.1400f8cc0
call fcn.1400cf6f0
call fcn.140104c50
mov eax, dword [0x14024e5b0]
test eax, eax
je 0x1400cf478
xor ebx, ebx
nop dword [rax + rax]
mov rax, qword [0x1403ef5a8]
mov edx, ebx
add ebx, 1
mov rax, qword [rax + rdx*8]
mov rdx, rsi
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x38]
call fcn.1400337d0
cmp ebx, dword [0x14024e5b0]
jb 0x1400cf450
mov rcx, qword [0x1403ef5a8]
test rcx, rcx
je 0x1400cf489
call sub.msvcrt.dll_free
mov dword [0x1403ef5b0], 0
mov r12d, 0xffffffff
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400cf391
lea rax, str.Cant_init_client_submodule_dap_events_socket_init___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xfb
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a150
jmp 0x1400cf40b
or r12d, 0xffffffff
jmp 0x1400cf391
Function at 0x1400cf520
Capabilities:
Set socket configuration

Disassembly:
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
sub rsp, 0x50
cmp ecx, 1
je 0x1400cf580
test ecx, 0xfffffff7
je 0x1400cf620
lea rax, str.Cant_create_socket_type__d
mov dword [rsp + 0x28], ecx
xor r12d, r12d
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, str.dap_events_socket
mov edx, 0x1d3
lea rcx, str.dap_events_socket_create
call fcn.14005a150
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 2
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
lea r8, [rsp + 0x4c]
mov edx, 0x8004667e
mov dword [rsp + 0x4c], 1
mov rsi, rax
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1400cf630
mov rdx, r12
mov rcx, rsi
call fcn.1400d07c0
mov r12, rax
test rax, rax
je 0x1400cf668
mov dword [rax + 0x34], ebx
mov rax, qword [0x1403e4460]
lea r8, str.dap_events_socket
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x30], ebx
cmove r8, rax
lea rax, str.Created_socket__llu_type__d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14005a150
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 1
jmp 0x1400cf585
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Error_ioctl__d
lea r8, str.dap_events_socket
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400cf5b5
lea rax, str.Cant_allocate_memory_for_the_new_esocket
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x1e9
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_create
call fcn.14005a150
jmp 0x1400cf56f

Function at 0x1400cfaa0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov edx, 2
mov rbp, rsp
push r12
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
movzx eax, word [rcx + 0x1c]
mov r12, qword [rcx]
mov ecx, 0x7f000001
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], dx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov r8d, 1
lea rdx, [0x1402be8d8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1400cfb20
mov r12, qword [rbp - 8]
xor eax, eax
leave
ret
mov r12, qword [rbp - 8]
leave
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
Function at 0x1400cff70
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov rax, qword [0x1403e4460]
mov qword [rbp + 0x18], rdx
cmp byte [rax], 0
je 0x1400cffcf
mov eax, 0xffffffff
test rcx, rcx
je 0x1400cff9e
mov eax, dword [rcx]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x18]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f0]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d0010
xor eax, eax
lea rsp, [rbp - 0x10]
pop rbx
pop r12
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r12, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], dx
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rbp + 0x18]
mov rcx, r12
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400cfffc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400cfffe
Function at 0x1400d0220
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
push rsi
mov rsi, rdx
mov edx, 8
push rbx
mov rbx, rcx
mov ecx, 1
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400d0389
mov qword [rax], rsi
mov r12, rax
mov rbx, qword [rbx + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1403e4460]
cmp byte [rax], 0
je 0x1400d02a4
mov eax, 0xffffffff
test rbx, rbx
je 0x1400d0277
mov eax, dword [rbx]
mov dword [rsp + 0x38], eax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f0]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d02e0
lea rsp, [rbp - 0x20]
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r13, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov word [rsp + 0x50], dx
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov rcx, r13
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400d02d2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1400d02d2
lea rax, str.Cant_send__llu_uuid_in_queue
mov qword [rsp + 0x28], rsi
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.dap_events_socket
call fcn.14005a150
lea rsp, [rbp - 0x20]
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
pop rbp
jmp sub.msvcrt.dll_free
lea rax, [0x1402be88e]
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x6b1
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_remove_and_delete_mt
call fcn.14005a150
jmp 0x1400d02d2

Function at 0x1400d1720
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x1400d1780
push r12
mov r12, rdx
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d1770
mov qword [rdx], 0
mov rbx, r8
test r8, r8
je 0x1400d174a
mov qword [r8], 0
lea rdx, [0x1403e1895]
call sub.msvcrt.dll_fopen
mov rcx, rax
test rax, rax
je 0x1400d1770
add rsp, 0x28
mov r8, rbx
mov rdx, r12
pop rbx
pop r12
jmp fcn.140121220
add rsp, 0x28
xor eax, eax
pop rbx
pop r12
ret
xor eax, eax
ret

Function at 0x1400d1790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d17b0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
xor eax, eax
ret

Function at 0x1400d17c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d17f0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d17e0
shr al, 7
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
ret
Function at 0x1400d1b80
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
xor r14d, r14d
push r13
push r12
mov r12, rcx
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x160
call sub.msvcrt.dll_strlen
lea rdi, [rsp + 0x4c]
lea rcx, [rax + 2]
mov rbx, rax
call sub.msvcrt.dll_malloc
mov r8, rbx
mov rdx, r12
mov r13, rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [r13 + rbx], 0x2a
mov rcx, r13
mov byte [r13 + rbx + 1], 0
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov r12, rax
nop
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
je 0x1400d1c44
cmp dword [rsp + 0x20], 0x10
jne 0x1400d1bf0
cmp word [rdi], 0x2e2e
je 0x1400d1c70
cmp word [rdi], 0x2e
je 0x1400d1bf0
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov rcx, rdi
mov r15, rax
call fcn.1400fc420
mov qword [r15 + 8], 0
mov qword [r15], rax
test r14, r14
jne 0x1400d1c80
mov r14, r15
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
jne 0x1400d1bfc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r13
call sub.msvcrt.dll_free
lea rsp, [rbp - 0x38]
mov rax, r14
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp byte [rdi + 2], 0
je 0x1400d1bf0
jmp 0x1400d1c0a
mov rax, r14
nop dword [rax + rax]
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400d1c88
mov qword [rdx + 8], r15
jmp 0x1400d1bf0
Function at 0x1400d83c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x58
test r8, r8
je 0x1400d8589
lea rax, str.Checking_url_path__s
mov r12, r8
xor r9d, r9d
mov r15, rcx
mov qword [rsp + 0x28], r8
xor ecx, ecx
mov r14, rdx
lea r8, str.dap_http_folder
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14005a150
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d8510
test al, 0x10
je 0x1400d8510
lea rax, str.File_service_for__s____s
mov qword [rsp + 0x30], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.dap_http_folder
mov qword [rsp + 0x28], r14
call fcn.14005a150
mov edx, 0x1008
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400d85cf
mov r8d, 0xfff
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov ecx, 0x492
call fcn.1400019f8
mov qword [r13 + 0x1000], rax
mov rcx, rax
test rax, rax
je 0x1400d8592
lea rdx, str.data.mag
call fcn.140001b7e
mov r12d, eax
test eax, eax
jne 0x1400d8540
lea rax, [0x1400d8620]
xor r9d, r9d
mov r8, r13
mov rdx, r14
mov qword [rsp + 0x40], rax
lea rax, [0x1400d8610]
mov rcx, r15
mov qword [rsp + 0x38], rax
lea rax, [0x1400d8770]
mov qword [rsp + 0x30], rax
lea rax, [0x1400d8710]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.1400d5ce0
add rsp, 0x58
mov eax, r12d
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.Directory_Not_Found_
mov qword [rsp + 0x20], rax
mov r9d, 7
xor edx, edx
xor ecx, ecx
lea r8, str.dap_http_folder
mov r12d, 0xfffffff5
call fcn.14005a150
jmp 0x1400d84fb
lea rax, str.Cant_load_MIME_magic_detection_database
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x8c
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xfffffffe
call fcn.14005a150
mov rcx, qword [r13 + 0x1000]
call fcn.140001b59
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400d84fb
lea rax, str.Directory_Path_parameter_is_empty_
jmp 0x1400d8517
lea rax, str.Cant_init_MIME_detection_library
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x81
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xffffffff
call fcn.14005a150
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400d84fb
lea rax, [0x1402bb2b8]
mov r9d, 8
or r12d, 0xffffffff
mov edx, 0x79
mov qword [rsp + 0x20], rax
lea r8, str.dap_http_folder
lea rcx, str.dap_http_folder_add
call fcn.14005a150
jmp 0x1400d84fb
Function at 0x1400f4290
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400f43f5
cmp byte [rcx], 0
mov r12, rcx
je 0x1400f43f5
call sub.msvcrt.dll_strlen
mov rbx, rax
lea r8, [rax + 1]
lea rax, [rax + 0x10]
shr rax, 4
shl rax, 4
call fcn.140035990
xor edx, edx
sub rsp, rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rdx, r12
mov rcx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
movzx eax, byte [rsp + 0x20]
mov rdx, rsi
mov ecx, eax
and ecx, 0xffffffdf
sub ecx, 0x41
cmp cl, 0x19
jbe 0x1400f43b1
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
xor ebx, ebx
test al, al
je 0x1400f4330
cmp al, 0x5c
je 0x1400f4390
cmp al, 0x2f
je 0x1400f4390
movzx eax, byte [rdx + 1]
xor ebx, ebx
add rdx, 1
test al, al
jne 0x1400f4316
nop dword [rax]
mov rcx, rsi
call rdi
cmp eax, 0xffffffff
je 0x1400f433e
test al, 0x10
jne 0x1400f4352
mov rcx, rsi
call sub.msvcrt.dll__mkdir
mov r12d, eax
cmp eax, 0xffffffff
je 0x1400f43db
test rbx, rbx
je 0x1400f43a0
movzx eax, byte [rbx + 1]
mov byte [rbx], 0x5c
lea rdx, [rbx + 1]
xor ebx, ebx
test al, al
jne 0x1400f437c
jmp 0x1400f4330
movzx eax, byte [rdx + 1]
add rdx, 1
test al, al
je 0x1400f4310
cmp al, 0x5c
je 0x1400f4370
cmp al, 0x2f
je 0x1400f4370
jmp 0x1400f4310
mov byte [rdx], 0
mov rbx, rdx
jmp 0x1400f4330
xor r12d, r12d
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
cmp byte [rsp + 0x21], 0x3a
jne 0x1400f4308
movzx ecx, byte [rsi + 2]
cmp cl, 0x5c
je 0x1400f43ce
cmp cl, 0x2f
jne 0x1400f4308
movzx eax, byte [rsi + 3]
lea rdx, [rsi + 3]
jmp 0x1400f4308
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400f43a3