joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402720
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402730
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402740
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402781
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402778
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402783
add rax, 0x28
cmp rax, r9
jne 0x402764
xor eax, eax
ret

Function at 0x402820
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404380]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40288d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40288d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40288d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402884
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40288f
add rax, 0x28
cmp rax, r9
jne 0x402870
xor eax, eax
add rsp, 0x28
ret

Function at 0x402990
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404380]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x4029b0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4029a8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402a0d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402a04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402a14
add rax, 0x28
cmp rax, r9
jne 0x4029f0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402a30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00404380]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402a9e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402a9e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402a9e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402a9e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402a95
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402aa5
add rcx, 0x28
cmp rcx, rax
jne 0x402a80
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402ab8
jmp 0x402a9e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402ac6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402a9e
test r9d, r9d
jg 0x402ab0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x140001510
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x140001584
mov rdx, qword [rcx + 0x18]
cmp rdx, 7
jbe 0x14000157b
mov rcx, qword [rcx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140001576
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000168f
mov rcx, r8
call fcn.1400021e0
xor ebp, ebp
xor eax, eax
jmp 0x14000165c
xor ebp, ebp
mov qword [rsp + 0x298], rsi
xor edx, edx
mov qword [rsp + 0x2a0], r15
mov r14d, ebp
mov esi, ebp
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000160e
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x1400015de
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400015fc
mov eax, dword [rsp + 0x3c]
cmp eax, esi
jbe 0x1400015fc
mov r14d, dword [rsp + 0x28]
mov esi, eax
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400015d1
mov rdx, qword [rbx + 0x18]
mov r15, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x298]
cmp rdx, 7
jbe 0x140001659
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140001654
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000168f
mov rcx, r8
call fcn.1400021e0
mov eax, r14d
mov word [rbx], bp
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400021c0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140001950
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
mov qword [0x1400583d0], r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x1400583d8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x1400583e0], rax
movzx eax, byte [rsp + 0x50]
mov byte [0x1400583f9], al
mov rax, qword [rsp + 0x58]
mov qword [0x140058400], rax
mov rax, qword [rsp + 0x60]
mov qword [0x140058408], rax
lea rax, [0x1400583d0]
mov qword [0x1400583f0], rbx
mov byte [0x1400583f8], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400044a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [r11 + 0x18], rbx
mov rdi, rcx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], r14
mov r14, rdx
lea rdx, [rsp + 0x60]
mov qword [r11 - 0x28], r15
call qword [sym.imp.USER32.dll_BeginPaint]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.USER32.dll_GetClientRect]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, str.TOOLBAR
mov rcx, rdi
movdqa xmmword [rsp + 0x50], xmm0
call fcn.14000e240
mov rcx, rdi
mov r15d, eax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
mov esi, eax
cmp r15d, 1
jne 0x1400045b0
test eax, eax
jne 0x14000452f
lea r9d, [rax + 4]
jmp 0x140004581
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
jne 0x14000454f
lea r9d, [rax + 2]
jmp 0x140004581
mov rcx, rdi
call fcn.1400031b0
cmp eax, 1
jne 0x14000457b
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r9d, ax
mov ecx, 0x100
and r9d, ecx
bts r9d, 9
shr r9d, 8
jmp 0x140004581
mov r9d, 1
lea rax, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x30], rax
mov rdx, rbp
lea rax, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call fcn.14000e040
jmp 0x14000462f
mov ebx, reloc.WS2_32.dll_recv
test esi, esi
jne 0x1400045c0
mov ebx, 0x110
jmp 0x14000460a
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
jne 0x1400045e1
mov ebx, 0x210
jmp 0x14000460a
mov rcx, rdi
call fcn.1400031b0
cmp eax, 1
jne 0x14000460a
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 8
mov ebx, 0x210
mov eax, 0x1010
cmovb eax, ebx
mov ebx, eax
lea rax, [rsp + 0x50]
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14000df50
test r14, r14
je 0x1400046b0
mov rcx, r14
call fcn.1400123d0
mov rcx, r14
mov ebx, eax
call fcn.140012250
mov ecx, eax
xor edx, edx
xorps xmm2, xmm2
test esi, esi
xorps xmm0, xmm0
xorps xmm1, xmm1
sete dl
xorps xmm3, xmm3
cvtsi2ss xmm2, rcx
mov ecx, dword [rsp + 0x4c]
mov r8d, 0xffffffff
sub ecx, dword [rsp + 0x44]
sub ecx, eax
mov dword [rsp + 0x38], edx
shr ecx, 1
mov rdx, rbp
mov eax, ecx
mov rcx, r14
cvtsi2ss xmm1, rbx
cvtsi2ss xmm0, rax
mov eax, dword [rsp + 0x48]
sub eax, dword [rsp + 0x40]
sub eax, ebx
shr eax, 1
movss dword [rsp + 0x30], xmm2
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x20], xmm0
cvtsi2ss xmm3, rax
call fcn.14000ed50
mov r14, qword [rsp + 0xc8]
cmp r15d, 1
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
jne 0x1400046e3
call fcn.14000df20
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400244f0
add rsp, 0xe0
pop rdi
ret
Function at 0x14000e6d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x450
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r14, rdx
mov rbp, rcx
mov rcx, qword [rcx + 8]
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
lea edi, [rax + 1]
lea esi, [rdi + rdi]
cmp edi, 0x200
jae 0x14000e72f
lea rbx, [rsp + 0x40]
jmp 0x14000e748
xor r8d, r8d
lea rdx, str.OSControlGetTextBuf
mov ecx, esi
call fcn.140015eb0
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rbp + 8]
mov r9, rbx
mov r8d, edi
mov edx, recv
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x140057004]
xor r8d, r8d
mov rcx, rbx
call fcn.14001b0e0
xor r8d, r8d
mov dword [r14], eax
lea rdx, [0x14003dec8]
mov ecx, eax
call fcn.140015eb0
mov r9d, dword [r14]
mov rdx, rax
mov r8d, dword [0x140057004]
mov rcx, rbx
mov dword [rsp + 0x20], r9d
mov rdi, rax
xor r9d, r9d
call fcn.14001aff0
cmp qword [rsp + 0x30], 0
je 0x14000e7bd
lea r8, str.OSControlGetTextBuf
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140015dc0
mov rax, rdi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400244f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14000f7a0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x50
cmp qword [rsp + 0x80], 0
mov edi, edx
mov rsi, rcx
je 0x14000f8b7
cmp r8, 0x10
jne 0x14000f7f6
sar r9, 0x10
lea edx, [r8 - 0xd]
movzx ecx, r9b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov eax, eax
cmp rax, 0xa0
jne 0x14000f7e5
lea ecx, [rax - 0x3f]
jmp 0x14000f818
cmp rax, 0xa1
jne 0x14000f8b7
lea ecx, [rax - 0x3f]
jmp 0x14000f818
cmp r8, 0x11
jne 0x14000f86d
bt r9, 0x18
mov ecx, 0
setb cl
add ecx, 0x63
cmp ecx, 0x7fffffff
je 0x14000f8b7
lea rax, str.void
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x80]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov r8, rsi
lea rax, str.EvKey
mov edx, edi
mov qword [rsp + 0x30], rax
lea rax, str.OSControl
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.1400159f0
mov al, 1
mov rsi, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
cmp r8, 0x12
jne 0x14000f885
bt r9, 0x18
mov ecx, 0
setb cl
add ecx, 0x65
jmp 0x14000f80c
mov r9d, dword [section..data]
xor ecx, ecx
test r9d, r9d
je 0x14000f8b7
lea rdx, [0x14003dc60]
nop word [rax + rax]
movzx eax, word [rdx]
cmp rax, r8
je 0x14000f80c
inc ecx
add rdx, 2
cmp ecx, r9d
jb 0x14000f8a0
mov rsi, qword [rsp + 0x60]
xor al, al
add rsp, 0x50
pop rdi
ret
Function at 0x1400194b0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0x20a
lea rdx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
call fcn.14001aff0
cmp eax, 0x20a
jae 0x14001951a
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140019510
test rbx, rbx
je 0x14001950c
mov dword [rbx], reloc.SHLWAPI.dll_SHCreateMemStream
mov al, 1
jmp 0x140019527
mov rcx, rbx
call fcn.1400199f0
jmp 0x140019525
test rbx, rbx
je 0x140019525
mov dword [rbx], 4
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400244f0
add rsp, 0x250
pop rbx
ret

Function at 0x140019540
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov edi, edx
mov qword [rsp + 0x20], rax
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14001959e
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea r8d, [rax + 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14001aff0
jmp 0x1400195a6
mov byte [rbx], 0
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400244f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x140019900
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, r9
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140019973
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140019950
test rbx, rbx
je 0x140019938
mov dword [rbx], eax
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140019948
mov dword [rax], reloc.SHLWAPI.dll_SHCreateMemStream
mov al, 1
add rsp, 0x40
pop rbx
ret
test rbx, rbx
je 0x14001995b
mov dword [rbx], 0
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14001997d
mov dword [rax], reloc.SHLWAPI.dll_SHCreateMemStream
xor al, al
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x70]
call fcn.1400199f0
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x140019990
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov rbx, r9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400199d6
test rbx, rbx
je 0x1400199be
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400199ce
mov dword [rax], reloc.SHLWAPI.dll_SHCreateMemStream
mov al, 1
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x70]
call fcn.1400199f0
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x140019ab0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.14001a7b0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001aa40
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400244f0
add rsp, 0x1d8
ret

Function at 0x14001aad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, r9
xor edi, edi
xor r9d, r9d
mov ebx, edi
mov esi, r8d
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14001ab2a
mov ecx, eax
add rbx, rcx
cmp ebx, esi
je 0x14001ab2c
add rbp, rcx
mov r8d, esi
sub r8d, ebx
mov rdx, rbp
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x14001ab05
jne 0x14001ab33
mov edi, 6
jmp 0x14001ab51
cmp eax, 0xffffffff
jne 0x14001ab4c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
setne dil
add edi, 3
jmp 0x14001ab51
mov edi, 4
test r15, r15
je 0x14001ab59
mov dword [r15], ebx
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14001ab65
mov dword [rax], edi
mov rbx, qword [rsp + 0x40]
cmp edi, 6
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sete al
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14001ab90
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rdi, rdx
mov qword [rsp + 0x28], r14
mov r14, rcx
movsxd rbp, r8d
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov r15, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
movsxd r10, eax
test eax, eax
jle 0x14001abfa
add rbx, r10
cmp rbx, rbp
je 0x14001abff
add rdi, r10
mov r8d, ebp
sub r8d, ebx
mov rdx, rdi
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd r10, eax
test eax, eax
jg 0x14001abd3
test r10, r10
jne 0x14001ac03
mov al, 1
jmp 0x14001ac05
xor al, al
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
test r15, r15
je 0x14001ac21
mov dword [r15], ebx
mov rdx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
test rdx, rdx
je 0x14001ac41
movzx ecx, al
lea ecx, [rcx*2 + 4]
mov dword [rdx], ecx
add rsp, 0x38
ret
Function at 0x14001b430
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xc50
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0xc40], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea rbx, [rsp + 0xc98]
mov r15, rax
call fcn.14001b400
mov r9, qword [rsp + 0xc90]
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rdi, rax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
or rcx, 2
call fcn.14002ffc0
test eax, eax
mov r13d, 0xffffffff
cmovs eax, r13d
lea ebx, [rax + 1]
cmp eax, 0x400
jge 0x14001b4c7
lea r14, [rsp + 0x40]
jmp 0x14001b4d9
mov edx, 8
mov ecx, ebx
call fcn.14001b980
mov rbp, rax
mov r14, rax
mov r9, qword [rsp + 0xc90]
lea rax, [rsp + 0xc98]
mov rcx, qword [rdi]
mov rdx, r14
mov qword [rsp + 0x28], rax
movsxd r8, ebx
mov qword [rsp + 0x20], 0
call fcn.14002ffc8
test eax, eax
mov qword [rsp + 0x20], 0
mov esi, eax
lea r9, [rsp + 0x30]
cmovs esi, r13d
mov rdx, r14
mov r8d, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x400
jge 0x14001b563
mov r9d, 1
mov dword [rsp + 0x20], 0x800
xor r8d, r8d
lea rdx, [rsp + 0x440]
mov rcx, r14
call fcn.14001aff0
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14001b5a2
lea ebx, [rsi*2 + 2]
mov edx, 8
mov ecx, ebx
call fcn.14001b980
mov r9d, 1
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov rdx, rax
mov rcx, r14
mov rdi, rax
call fcn.14001aff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.14001b9a0
test rbp, rbp
je 0x14001b5af
mov rcx, rbp
call fcn.14001b9a0
mov eax, esi
mov rcx, qword [rsp + 0xc40]
xor rcx, rsp
call fcn.1400244f0
add rsp, 0xc50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001b5e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rsi, r8
mov ecx, 0xfffffff4
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x14001b62a
mov ecx, dword [rsp + 0x50]
mov dword [rsi], ecx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b640
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xc50
mov rax, qword [0x1400574c0]
xor rax, rsp
mov qword [rsp + 0xc40], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea rbx, [rsp + 0xc98]
mov r15, rax
call fcn.14001b400
mov r9, qword [rsp + 0xc90]
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rdi, rax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
or rcx, 2
call fcn.14002ffc0
test eax, eax
mov r13d, 0xffffffff
cmovs eax, r13d
lea ebx, [rax + 1]
cmp eax, 0x400
jge 0x14001b6d7
lea r14, [rsp + 0x40]
jmp 0x14001b6e9
mov edx, 8
mov ecx, ebx
call fcn.14001b980
mov rbp, rax
mov r14, rax
mov r9, qword [rsp + 0xc90]
lea rax, [rsp + 0xc98]
mov rcx, qword [rdi]
mov rdx, r14
mov qword [rsp + 0x28], rax
movsxd r8, ebx
mov qword [rsp + 0x20], 0
call fcn.14002ffc8
test eax, eax
mov qword [rsp + 0x20], 0
mov esi, eax
lea r9, [rsp + 0x30]
cmovs esi, r13d
mov rdx, r14
mov r8d, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x400
jge 0x14001b773
mov r9d, 1
mov dword [rsp + 0x20], 0x800
xor r8d, r8d
lea rdx, [rsp + 0x440]
mov rcx, r14
call fcn.14001aff0
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14001b7b2
lea ebx, [rsi*2 + 2]
mov edx, 8
mov ecx, ebx
call fcn.14001b980
mov r9d, 1
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov rdx, rax
mov rcx, r14
mov rdi, rax
call fcn.14001aff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.14001b9a0
test rbp, rbp
je 0x14001b7bf
mov rcx, rbp
call fcn.14001b9a0
mov eax, esi
mov rcx, qword [rsp + 0xc40]
xor rcx, rsp
call fcn.1400244f0
add rsp, 0xc50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001b7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rsi, r8
mov ecx, 0xfffffff6
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rsi, rsi
je 0x14001b83a
mov ecx, dword [rsp + 0x50]
mov dword [rsi], ecx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001b920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov ecx, 0xfffffff5
mov esi, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
test rdi, rdi
je 0x14001b968
mov dword [rdi], esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140024cd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024d22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024d22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024d22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024d22
cmp dword [rcx + 0x84], 0xe
jbe 0x140024d22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024d24
xor al, al
add rsp, 0x28
ret

Function at 0x140030e90
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140030cbc