joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58ce80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x358
lea r13, [rsp + 0x140]
mov rbx, rcx
mov rcx, r13
call fcn.0058c3c0
xor r8d, r8d
test eax, eax
je 0x58cffa
mov rax, qword [0x00670c10]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r13
mov rax, qword [rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 2
call qword [rax + 0x28]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x58d063
test rbx, rbx
je 0x58cfe3
lea rax, [rsp + 0x60]
mov rdx, rbx
xor ecx, ecx
mov r8d, 0xffffffff
mov r9, rax
mov qword [rsp + 0x48], rax
call fcn.00519bf0
mov rdx, rax
mov eax, dword [rsp + 0x68]
test eax, eax
jle 0x58cfc3
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, 1
lea rbx, [rdx + 1]
lea rsi, [rdx + rax + 2]
lea rbp, [rsp + 0x5c]
mov qword [rsp + 0x40], r12
jmp 0x58cf4c
add rbx, 1
cmp rbx, rsi
je 0x58cf9d
cmp byte [rbx - 1], 0xa
mov r15, rbx
jne 0x58cf43
lea r8, [rbx - 1]
sub r8, rdx
test r8d, r8d
jne 0x58d011
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, 2
lea rdx, [0x00665430]
mov rcx, rdi
call r14
test eax, eax
je 0x58d02e
mov rdx, rbx
add rbx, 1
cmp rbx, rsi
jne 0x58cf4c
sub r15, rdx
test r15d, r15d
mov r8, r15
je 0x58cfc3
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x58d02e
mov rcx, qword [rsp + 0x48]
call fcn.00575950
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x58d02e
mov ecx, 0x10
call fcn.004df170
mov dword [rax], 3
mov qword [rax + 8], rdi
mov r8, rax
mov rax, r8
add rsp, 0x358
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
mov r9, rbp
mov rcx, rdi
call r12
test eax, eax
mov r14, r12
jne 0x58cf6a
mov rcx, qword [rsp + 0x48]
call fcn.00575950
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00585b40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x00670c10]
mov rcx, r13
mov rax, qword [rax]
call qword [rax + 0x38]
xor r8d, r8d
jmp 0x58cffa
test rbx, rbx
je 0x58d038
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
jmp 0x58d02e

Function at 0x58d0b0
Capabilities:
Create pipe

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
mov ebx, eax
jne 0x58d0f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00585b40
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rbx, qword [rsp + 0x20]
mov ecx, 0x10
call fcn.004df170
mov ecx, 0x10
mov dword [rax], 3
mov qword [rax + 8], rbx
mov rbx, qword [rsp + 0x28]
mov qword [rdi], rax
call fcn.004df170
mov qword [rax + 8], rbx
mov ebx, 1
mov dword [rax], 3
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x58d5d0
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rdi, rcx
mov ecx, 0xb0
mov rsi, rdx
mov r12, r8
mov ebp, r9d
call fcn.004df170
mov rbx, rax
call fcn.0058cae0
mov rax, qword [rsp + 0xc0]
mov dword [rbx + 0x14], 0
mov dword [rbx + 0x18], 0
mov dword [rbx + 0xa8], 0
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], r12
mov dword [rbx + 0x38], ebp
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x98], 0
mov dword [rbx + 0xa0], 0
mov dword [rbx + 0x90], 0
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0
call fcn.00590d10
test rdi, rdi
mov qword [rbx + 0x48], rax
je 0x58d7f0
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
mov r8d, 1
mov edx, 1
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x68], rax
call rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov qword [rbx + 0x80], rax
call rdi
mov qword [rbx + 0x88], rax
lea rax, [rsp + 0x3c]
mov r9, rbx
lea r8, [0x0058c900]
mov edx, 0x100
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 2
mov qword [rbx + 0x58], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
or dword [rbx + 0x10], 2
test rsi, rsi
je 0x58d779
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
mov r8d, 1
mov edx, 1
xor ecx, ecx
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x60], rax
call rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov qword [rbx + 0x70], rax
call rsi
mov qword [rbx + 0x78], rax
lea rax, [rsp + 0x3c]
mov r9, rbx
lea r8, [0x0058c7d0]
mov edx, 0x100
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x58]
mov qword [rbx + 0x50], rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
or dword [rbx + 0x10], 4
lea rsi, [rsp + 0x40]
lea rdx, str.file_Ix
mov r8, rbx
mov rcx, rsi
call sub.msvcrt.dll_sprintf
mov r9d, dword [rbx + 0x10]
lea rcx, str.pipe
mov r8, rbx
mov rdx, rsi
call fcn.00534060
lea r9, [0x00665464]
lea r8, [0x00665469]
xor ecx, ecx
mov qword [rbx + 8], rax
mov rdx, rax
call fcn.00539ef0
mov rdx, qword [rbx + 8]
lea r9, [0x00665476]
lea r8, [0x0066547b]
xor ecx, ecx
call fcn.00539ef0
mov rax, qword [rbx + 8]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rbx + 0x58], 0
jmp 0x58d6f0
Function at 0x58fa60
Capabilities:
Resolve dns

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, 2
mov rsi, rdx
mov qword [rcx], 0
mov rbx, rcx
mov qword [rcx + 8], 0
mov word [rcx], ax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_htons]
test rsi, rsi
mov word [rbx + 2], ax
je 0x58fac0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [rsp + 0x20], eax
je 0x58fac4
mov dword [rbx + 4], eax
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
xor eax, eax
jmp 0x58faa8
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x58faee
mov rdx, qword [rax + 0x18]
movsx r8, word [rax + 0x12]
lea rcx, [rsp + 0x20]
mov rdx, qword [rdx]
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x20]
jmp 0x58faa8
mov ecx, 0x94
call fcn.00540d10
xor eax, eax
jmp 0x58fab0
Function at 0x58fb00
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
lea rcx, [0x006a10c8]
mov edi, edx
mov rsi, r8
mov r12d, r9d
mov dword [rsp + 0x2c], 1
call fcn.0056c120
mov rbp, rax
call fcn.0058f260
test eax, eax
je 0x58fce6
call fcn.0058f260
test eax, eax
je 0x58fcf5
lea r13, [rsp + 0x30]
mov r8d, edi
mov rdx, rsi
mov rcx, r13
call fcn.0058fa60
test eax, eax
je 0x58fcff
cmp qword [rsp + 0xb0], 0
mov edx, dword [rsp + 0xb8]
setne dil
test edx, edx
setne r8b
or dil, r8b
je 0x58fbb1
call fcn.0058f260
test eax, eax
je 0x58fcf5
mov r8d, dword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.0058fa60
test eax, eax
je 0x58fcff
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x58fcff
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, 0x1000
mov rcx, rsi
call fcn.0053fae0
test r12d, r12d
jne 0x58fc90
test dil, dil
jne 0x58fd62
mov eax, dword [rsp + 0xc0]
test eax, eax
je 0x58fc28
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x58fcab
mov r8d, 0x10
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x58fd84
mov rcx, rsi
call fcn.0058ed50
mov rbx, rax
mov dword [rax + 0x1c], 0x23
lea r8, [rsp + 0x2c]
mov rcx, rsi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbp]
mov r9, rbx
mov r8d, 1
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageA]
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0x10
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x58fd30
mov rdi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rdi
mov ecx, eax
call fcn.00585b90
test rbx, rbx
je 0x58fcdd
mov rcx, rbx
call fcn.00540d30
lea rdx, str.couldnt_open_socket:
mov r8, rax
xor r9d, r9d
mov rcx, rbx
call fcn.00561a50
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, 0xe
call fcn.00540d10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00585b90
test rbx, rbx
je 0x58fce6
mov rcx, rbx
call fcn.00540d30
lea rdx, str.couldnt_open_socket:
mov r8, rax
xor r9d, r9d
mov rcx, rbx
call fcn.00561a50
jmp 0x58fce6
mov edx, 0x7fffffff
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x58fcab
mov rcx, rsi
call fcn.0058ed50
mov rbx, rax
mov dword [rax + 0x1c], 8
or dword [rax + 0x14], 8
jmp 0x58fc55
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x58fc01
jmp 0x58fcab
mov rdi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rdi
mov ecx, eax
call fcn.00585b90
call fcn.00540cf0
cmp eax, 0xb
jne 0x58fcb2
mov rcx, rsi
call fcn.0058ed50
mov rbx, rax
or dword [rax + 0x10], 4
mov dword [rax + 0x1c], 0x33
jmp 0x58fc55
Function at 0x58fe80
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1e8
lea rcx, [0x006a10c8]
call fcn.0056c120
mov rbx, rax
mov eax, dword [0x006a10d8]
test eax, eax
je 0x58feb5
test rbx, rbx
je 0x58ffc0
add rsp, 0x1e8
pop rbx
pop rsi
ret
lea rcx, [0x005901e0]
xor edx, edx
mov dword [0x006a10d8], 1
call fcn.0051b510
mov dword [0x006a1080], 0
mov dword [0x006a1090], 0
mov dword [0x006a1094], 0
call fcn.00581440
mov qword [0x006a1098], rax
lea rax, str.TclSocket
mov qword [0x006a10b0], 0
mov qword [0x006a10b8], 0
mov qword [0x006a10a0], 0
lea rcx, [0x006a1080]
mov qword [0x006a10c0], rax
lea rax, [0x0058f2a0]
mov qword [0x006a10a8], 0
mov qword [0x006a1088], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x58ff80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00585b40
call fcn.0058fdc0
mov dword [0x006a10d8], 0xffffffff
add rsp, 0x1e8
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x40]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5900a0
movzx eax, word [rsp + 0x40]
rol ax, 8
cmp ax, 0x100
ja 0x58fea2
mov ecx, 0x276c
call fcn.00585b90
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x58ff5e
lea rcx, [0x006a10c8]
mov edx, 0x30
call fcn.0056c0c0
mov rbx, rax
mov qword [rax + 0x28], 0
mov qword [rax], 0
call fcn.00590d10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x10], rax
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rsi
test rax, rax
mov qword [rbx + 0x18], rax
je 0x58ff5e
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 1
call rsi
test rax, rax
mov qword [rbx + 0x20], rax
je 0x58ff5e
lea rax, [rsp + 0x3c]
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x0058f910]
mov edx, 0x100
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 8], rax
je 0x58ff5e
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x18]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rbx], 0
je 0x58ff5e
lea rdx, [0x0058edc0]
lea rcx, [0x0058ee80]
xor r8d, r8d
call fcn.0054f760
jmp 0x58feab
mov ecx, eax
call fcn.00585b90
jmp 0x58ff5e

Function at 0x590ae0
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, dword [rsp + 0x70]
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov rbp, r9
call fcn.0058f260
test eax, eax
je 0x590b30
mov rax, qword [sym.imp.WS2_32.dll_setsockopt]
mov r9, rbp
mov r8d, edi
mov edx, esi
mov rcx, rbx
mov dword [rsp + 0x70], r12d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x5912f0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x006a1104]
test eax, eax
je 0x591320
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x591350
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov ecx, eax
mov dword [0x006a1100], eax
mov dword [0x006a1104], 1
jne 0x591305
lea rcx, str.could_not_allocate_thread_local_storage
call fcn.00552d60
jmp 0x5912ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x591313
lea rcx, str.TlsGetValue_failed_from_TclpGetAllocCache
call fcn.00552d60
jmp 0x591313

Function at 0x591370
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov rdx, rcx
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x591390
add rsp, 0x28
ret
lea rcx, str.TlsSetValue_failed_from_TclpSetAllocCache
add rsp, 0x28
jmp fcn.00552d60

Function at 0x5913a0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rbx, [0x006a0750]
lea rsi, [0x006a0840]
mov rcx, qword [rbx]
add rbx, 0x18
call fcn.005912c0
mov qword [rbx - 0x18], 0
cmp rbx, rsi
jne 0x56cf44
mov rcx, qword [0x006a0720]
call fcn.005912c0
mov rcx, qword [0x006a0728]
mov qword [0x006a0720], 0
call fcn.005912c0
xor ecx, ecx
mov qword [0x006a0728], 0
add rsp, 0x28
pop rbx
pop rsi
jmp 0x5913a0
sub rsp, 0x28
test rcx, rcx
je 0x5913d5
call fcn.0056c620
xor edx, edx
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x5913c5
add rsp, 0x28
ret
lea rcx, str.TlsSetValue_failed_from_TclpFreeAllocCache
add rsp, 0x28
jmp fcn.00552d60
mov eax, dword [0x006a1104]
test eax, eax
je 0x5913c0
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
je 0x591400
mov dword [0x006a1104], 0
add rsp, 0x28
ret
lea rcx, str.TlsFree_failed_from_TclpFreeAllocCache
call fcn.00552d60
jmp 0x5913ef
Function at 0x596d40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movsx ebp, byte [rcx]
lea rdi, [rsp + 0x20]
mov rsi, rdx
mov rbx, rcx
mov rdx, rdi
call fcn.00596cf0
lea rdx, str._s.___c
mov r8, rax
mov r9d, ebp
mov rcx, rsi
call sub.msvcrt.dll_fprintf
movzx eax, byte [rbx + 1]
test al, 1
jne 0x596f73
test al, 2
jne 0x596f50
test al, 4
jne 0x596f23
test al, 8
jne 0x596f00
test al, 0x10
jne 0x596ed4
test al, 0x40
je 0x596eb5
mov r8d, dword [rbx + 4]
test r8d, r8d
jne 0x596ea1
cmp dword [rbx + 8], 0x10001
je 0x596dfa
movsx r8d, word [rbx + 8]
lea rdx, str.__d_
mov rcx, rsi
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0xa]
cmp r8w, 0x100
je 0x596ded
lea rdx, [0x00665f34]
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov rdx, rsi
mov ecx, 0x7d
call sub.msvcrt.dll_fputc
mov rdx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
mov rcx, rsi
mov r9d, dword [rdx]
mov r8d, dword [rax]
lea rdx, str.__ld__ld
call sub.msvcrt.dll_fprintf
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x596e3a
mov rdx, rdi
call fcn.00596cf0
lea rdx, str._L:_s
mov r8, rax
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x596e5d
mov rdx, rdi
call fcn.00596cf0
lea rdx, str._R:_s
mov r8, rax
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x30]
test eax, eax
jne 0x596fa0
mov ecx, 0xa
mov rdx, rsi
call sub.msvcrt.dll_fputc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x596e86
mov rdx, rsi
call fcn.00596d40
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x596e98
mov rdx, rsi
call fcn.00596d40
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.___d_
mov rcx, rsi
call sub.msvcrt.dll_fprintf
jmp 0x596db4
lea rcx, str._UNUSED
mov r9, rsi
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x596da7
lea rcx, str._hasbackref
mov r9, rsi
mov r8d, 0xb
mov edx, 1
call sub.msvcrt.dll_fwrite
movzx eax, byte [rbx + 1]
jmp 0x596d9f
lea rcx, str._hascapture
mov r9, rsi
mov r8d, 0xb
mov edx, 1
call sub.msvcrt.dll_fwrite
movzx eax, byte [rbx + 1]
jmp 0x596d97
lea rcx, str._hasmixed
mov r9, rsi
mov r8d, 9
mov edx, 1
call sub.msvcrt.dll_fwrite
movzx eax, byte [rbx + 1]
jmp 0x596d8f
lea rcx, str._shortest
mov r9, rsi
mov r8d, 9
mov edx, 1
call sub.msvcrt.dll_fwrite
movzx eax, byte [rbx + 1]
jmp 0x596d87
lea rcx, str._longest
mov r9, rsi
mov r8d, 8
mov edx, 1
call sub.msvcrt.dll_fwrite
movzx eax, byte [rbx + 1]
jmp 0x596d7f
mov rdx, rsi
mov ecx, 0xa
call sub.msvcrt.dll_fputc
jmp 0x596e68

Function at 0x596fc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rdx
je 0x596fe0
call fcn.00596d40
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fflush
lea rcx, str.null_tree_n
mov r9, rdx
mov r8d, 0xa
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fflush
Function at 0x59a6e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov edx, dword [rdx + 4]
mov rsi, r8
test edx, edx
jle 0x59a740
mov rax, qword [rbx + 0x18]
test byte [rax + 0xc], 1
je 0x59a740
mov rcx, rax
add rcx, 0x20
xor r10d, r10d
nop word [rax + rax]
add r10d, 1
mov qword [rcx], 0
add rcx, 0x38
cmp r10d, edx
jl 0x59a710
mov qword [rax + 0x20], rsi
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, rbx
mov r9, rsi
mov r8, rsi
call fcn.0059a2f0
mov edx, dword [rbx + 0x10]
mov r10, qword [rax]
test edx, edx
jle 0x59a773
mov r11, r10
xor ecx, ecx
nop dword [rax]
mov dword [r11], 0
add ecx, 1
add r11, 4
cmp dword [rbx + 0x10], ecx
jg 0x59a760
mov rdx, qword [rbx + 0x40]
mov r8d, 1
movsxd rdx, dword [rdx + 0xc]
mov rcx, rdx
shr rdx, 5
shl r8d, cl
or dword [r10 + rdx*4], r8d
mov edx, dword [rbx + 0x10]
cmp edx, 1
je 0x59a7e0
test edx, edx
jle 0x59a7e5
sub edx, 1
mov rcx, r10
lea r8, [rdx*4 + 4]
xor edx, edx
add r8, r10
nop
xor edx, dword [rcx]
add rcx, 4
cmp rcx, r8
jne 0x59a7b0
mov dword [rax + 8], edx
mov edx, dword [rbx + 4]
mov dword [rax + 0xc], 0xd
test edx, edx
jle 0x59a724
mov rcx, qword [rbx + 0x18]
jmp 0x59a700
mov edx, dword [r10]
jmp 0x59a7bb
xor edx, edx
jmp 0x59a7bb
Function at 0x5bba1e
Capabilities:
Read file via mapping

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x5bba74
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call rax
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x18], 0
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 0x20]
mov dword [rax + 0x20], 0
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x5bbbfa
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
add rax, 0x38
mov rax, qword [rax]
mov rcx, qword [rbp - 0x20]
call rax
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x44], 0
cmp dword [rbp - 0x48], 0x4000000
jle 0x5bbabb
mov eax, dword [rbp - 0x48]
sub eax, 0x4000000
mov ax, 0
mov dword [rbp - 0x44], eax
cmp dword [rbp - 0x48], 0
jle 0x5bbbfa
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__fileno]
call rax
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__get_osfhandle]
call rax
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call rax
mov ebx, dword [rbp - 0x48]
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__fileno]
call rax
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__get_osfhandle]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
mov r9d, 0
mov r8d, 2
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call rax
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
je 0x5bbbfa
mov eax, dword [rbp - 0x48]
sub eax, dword [rbp - 0x44]
mov ecx, eax
mov edx, dword [rbp - 0x44]
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, edx
mov r8d, 0
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rax
mov rdx, rax
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x5bbbe9
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
cdqe
add rdx, rax
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x10]
mov edx, dword [rbp - 0x44]
neg rdx
add rdx, rax
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, dword [rbp - 0x48]
sub edx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax + 0x20], edx
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x5e77e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movsxd rbp, dword [0x006a1f84]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x5e79c0
mov rax, qword [0x006a1f88]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x5e7830
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x5e7971
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x5e7814
mov rcx, rbx
call fcn.005e84d0
test rax, rax
mov r12, rax
je 0x5e79e4
lea rbp, [rbp + rbp*2]
lea r14, [rsp + 0x30]
shl rbp, 3
mov r13, rbp
add r13, qword [0x006a1f88]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.005e85f0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r14
mov qword [r13 + 8], rax
mov rax, qword [0x006a1f88]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + rbp + 8]
call r13
test rax, rax
je 0x5e79c7
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x5e78c0
cmp eax, 0x40
jne 0x5e7982
add dword [0x006a1f84], 1
mov r8d, 0x30
mov rdx, r14
mov rcx, rbx
call r13
test rax, rax
je 0x5e79f3
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x5e78ed
cmp eax, 0x40
jne 0x5e7910
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x5e7962
cmp eax, 4
je 0x5e7962
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbp
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r14, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x5e78c7
mov r9, rbp
add r9, qword [0x006a1f88]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5e78c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005e7770
nop
xor ebp, ebp
jmp 0x5e783d
mov rax, qword [0x006a1f88]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.005e7770
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.005e7770
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.005e7770
nop
nop dword [rax + rax]