joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008af80
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor ebp, ebp
mov qword [r9], rbp
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x14008b11e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14008b0fe
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14008afee
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008afe0
inc rbx
jmp 0x14008aff0
xor ebx, ebx
mov eax, dword [rdi + 4]
cmp eax, 2
jne 0x14008affe
lea r14d, [rax + 0xe]
jmp 0x14008b00b
cmp eax, 0x17
jne 0x14008b0a4
lea r14d, [rax + 5]
cmp qword [rdi + 0x20], 0
je 0x14008b0a4
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14008b0a4
cmp rax, r14
jb 0x14008b0a4
lea rcx, [rbx + 0x30]
add rcx, r14
call qword [fcn.1400c9be0]
mov rsi, rax
test rax, rax
je 0x14008b0b3
mov ecx, dword [rdi]
mov r8, r14
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], r14d
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rcx
mov rdx, qword [rdi + 0x20]
call fcn.1400b4460
test rbx, rbx
je 0x14008b091
mov rcx, qword [rsi + 0x20]
mov r8, rbx
add rcx, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call fcn.1400b4460
test rbp, rbp
cmove rbp, rsi
test r15, r15
je 0x14008b0a1
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x14008afd0
jmp 0x14008b0b9
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x14008b0d3
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x14008b0f9
test rbp, rbp
je 0x14008b0f5
nop dword [rax]
mov rbx, qword [rbp + 0x28]
mov rcx, rbp
call qword [fcn.1400c9020]
mov rbp, rbx
test rbx, rbx
jne 0x14008b0e0
xor ebp, ebp
jmp 0x14008b10d
test rbp, rbp
jne 0x14008b10d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rbp
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x140097710
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x140245040]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140097774
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.140099540
test al, al
je 0x140097768
mov dword [0x140245040], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x140245040], 1
jmp 0x140097779
cmp eax, 2
je 0x1400977cb
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400977aa
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1400977cb
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1400983c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rsi, r9
mov rbp, r8
mov rcx, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x140098461
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140098425
mov dword [rsi], 0x51
jmp 0x14009845a
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14006d580
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140066f20
mov rax, qword [rdi + 8]
mov dword [rax + 0xd7c], ebx
mov dword [rsi], gethostname
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x28], edx
mov rdx, qword [rdi]
mov dword [rsp + 0x20], ebx
call fcn.1400670b0
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400b1c90
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400984a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x2e8]
test dword [rcx + 0x84], 0x800
jne 0x1400985e1
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140098571
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.14006d580
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140066f20
mov eax, 2
jmp 0x1400985e3
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.140068250
test al, al
jne 0x1400985e1
mov qword [rsp + 0x1e0], rdi
call fcn.1400c8df0
mov ebx, dword [rax]
call fcn.1400c8df0
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.14006d580
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140066f20
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x1400985e3
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400b1c90
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14009a6a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.140051690
mov r13, rax
test rax, rax
jne 0x14009a71e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d6b0
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140066f20
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [fcn.1400c9020]
jmp 0x14009a8d8
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14009a791
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d6b0
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140066f20
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x14009a8c2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14009a7da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d6b0
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140066f20
mov ebx, 0x4d
jmp 0x14009a8b6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x14009a80f
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.140066f20
mov ebx, 0x4d
jmp 0x14009a8ae
lea rcx, [rdi + 1]
call qword [fcn.1400c9be0]
mov rbp, rax
test rax, rax
jne 0x14009a829
lea ebx, [rax + 0x1b]
jmp 0x14009a8ae
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x14009a888
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009a8fa
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14009a87f
mov edi, esi
jmp 0x14009a881
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x14009a840
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.14009a400
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.1400c9020]
mov rcx, r13
call fcn.1400c9020
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400b1c90
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d6b0
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140066f20
mov ebx, 0x4d
jmp 0x14009a8a6
Function at 0x1400a7260
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400c9be0]
mov rdi, rax
test rax, rax
jne 0x1400a72a2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a72e9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a7342
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a7300
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a7383
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1401ef9ba]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1401ef9bb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a7350
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c0dc4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400c0c57
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c0c57
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c0c57
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c0c57
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c0c57
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c0c57
cmp dword [rcx + 0xf8], 0
je 0x1400c0c57
mov ecx, ebx
call fcn.1400c0cf8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400c0ae8
cmp dword [rbp + 0x20], 0
je 0x1400c0ca4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400c0cac
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400c0bf0
Function at 0x1400e80e4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400e8104
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c8d7c
or eax, 0xffffffff
jmp 0x1400e8106
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400ecf50
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
lea r8, [rsp + 0x60]
xor ecx, ecx
mov edx, 1
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor r12d, r12d
mov dword [rsp + 0x78], 1
xor r8d, r8d
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x88], r12
lea rcx, [rsp + 0x70]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
lea ecx, [r12 + 1]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, edi
mov edx, ebx
mov rcx, rbp
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r14
mov r15, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, ebx
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov rcx, r14
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], r12
xor edx, edx
mov rcx, r15
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x68], r12d
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x50], r12d
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400ed102
mov ecx, eax
call fcn.1400c9be0
mov rbx, rax
test rax, rax
je 0x1400ed102
mov edx, dword [rsp + 0x50]
mov r8, rax
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r10d, dword [rsp + 0x68]
mov r8d, r12d
test r10d, r10d
je 0x1400ed0fa
lea r11, str.image_png
nop word [rax + rax]
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rbx + 0x40]
mov rax, r12
nop
movzx ecx, word [rdx + rax*2]
cmp cx, word [r11 + rax*2]
jne 0x1400ed18c
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r11 + rax*2 + 2]
jne 0x1400ed18c
add rax, 2
cmp rax, 0xa
jne 0x1400ed0c0
imul rax, r9, 0x68
movups xmm0, xmmword [rax + rbx]
movups xmmword [rsp + 0x90], xmm0
mov rcx, rbx
call fcn.1400c9020
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x1400ed10f
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x90]
xor r9d, r9d
call qword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov rcx, rsi
call fcn.1400124c0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b1c90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
inc r8d
cmp r8d, r10d
jb 0x1400ed0b0
jmp 0x1400ed0fa
Function at 0x14010bc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
push rbp
push r12
push r13
sub rsp, 0x50
mov rbp, rdx
xor r8d, r8d
mov rdx, qword [rdx + 0x18]
mov r12, rcx
mov qword [rsp + 0x78], rdx
mov r13d, r8d
cmp r8w, word [rbp + 0x60]
jae 0x14010be68
mov qword [rax + 8], rbx
mov ebx, r8d
mov qword [rax - 0x38], r15
mov r15d, r8d
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r14
mov qword [rsp + 0x20], rbx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp + 8]
movsx rcx, word [rax + r15*2]
cmp ecx, 0xfffffffe
jne 0x14010bd02
mov rax, qword [rbp + 0x50]
test byte [r9 + 0x3c], 0x58
setne r14b
mov rdi, qword [rax + rbx + 8]
jmp 0x14010bd5a
test ecx, ecx
js 0x14010be33
mov rax, qword [rdx + 8]
lea rcx, [rcx + rcx*2]
test byte [rax + rcx*8 + 0x12], 0x20
je 0x14010be33
movzx eax, word [rax + rcx*8 + 0x10]
test ax, ax
jne 0x14010bd2c
mov rdi, r8
jmp 0x14010bd57
cmp byte [rdx + 0x3f], 0
je 0x14010bd37
mov rdi, r8
jmp 0x14010bd57
mov rdi, qword [rdx + 0x50]
test rdi, rdi
jne 0x14010bd45
mov rdi, r8
jmp 0x14010bd57
cmp dword [rdi], eax
jge 0x14010bd4e
mov rdi, r8
jmp 0x14010bd57
shl rax, 5
mov rdi, qword [rax + rdi - 0x18]
mov r14d, r8d
mov rcx, rdi
call fcn.140179920
test eax, eax
jne 0x14010be23
mov rcx, qword [r12]
test rcx, rcx
je 0x14010bd7d
lea edx, [rax + 0x20]
call fcn.1401ccf60
jmp 0x14010bd87
mov ecx, 0x20
call fcn.1401cd740
mov rbx, rax
test rax, rax
je 0x14010be4f
mov rax, qword [r12 + 0x60]
mov qword [rbx + 0x18], rax
test rdi, rdi
je 0x14010bdb5
mov rcx, qword [r12]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.14017b170
jmp 0x14010bdb7
xor eax, eax
mov qword [rbx], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r13d
mov byte [rbx + 0x14], r14b
cmp qword [rbp + 0x20], 0
jne 0x14010bdf2
mov rcx, qword [r12]
mov rdx, rbp
call fcn.14014e3c0
test rax, rax
je 0x14010bdfe
mov rax, qword [rbp + 0x20]
movzx ecx, byte [rax + r15]
mov byte [rbx + 0x15], cl
mov qword [r12 + 0x60], rbx
cmp qword [rbx + 0x18], 0
jne 0x14010be1e
lea r8, [r12 + 0x60]
mov rcx, r12
lea rdx, [0x14010f980]
call fcn.14013f340
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x78]
xor r8d, r8d
mov r9, qword [rsp + 0x88]
movzx eax, word [rbp + 0x60]
add rbx, 0x20
inc r13d
mov qword [rsp + 0x20], rbx
inc r15
cmp r13d, eax
jl 0x14010bce0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop r13
pop r12
pop rbp
ret
Function at 0x14010f7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x30
movzx eax, byte [r8]
mov rsi, r9
mov r15, qword [rsp + 0x88]
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
cmp al, 0x2c
jne 0x14010f81a
mov eax, dword [rsp + 0x80]
mov r8, qword [r8 + 0x18]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call fcn.14010f7d0
mov rax, qword [rbx + 0x10]
mov rbx, rax
movzx eax, byte [rax]
sub al, 0x2d
test al, 0xf7
jne 0x14010f966
mov qword [rsp + 0x70], r14
mov r14, qword [rbx + 0x10]
cmp byte [r14], 0xa7
jne 0x14010f961
mov qword [rsp + 0x60], r12
mov r12, qword [rbx + 0x18]
mov rcx, r12
call fcn.140179920
test eax, eax
je 0x14010f95c
mov rdx, rbx
mov rcx, rdi
call fcn.14017d3f0
test rax, rax
je 0x14010f871
lea rcx, [0x1400fb900]
cmp qword [rax + 0x18], rcx
jne 0x14010f95c
movsx rdx, word [r14 + 0x30]
test dx, dx
js 0x14010f95c
mov rax, qword [rbp + 0x18]
lea rcx, [rdx + rdx*2]
mov qword [rsp + 0x68], r13
mov rax, qword [rax + 8]
movzx r13d, byte [rax + rcx*8 + 0xc]
cmp r13b, 0x42
jb 0x14010f957
test r15, r15
je 0x14010f948
mov rsi, qword [rdi]
test rsi, rsi
je 0x14010f8c0
mov edx, 0x20
mov rcx, rsi
call fcn.1401ccf60
jmp 0x14010f8ca
mov ecx, 0x20
call fcn.1401cd740
mov rbx, rax
test rax, rax
je 0x14010f957
movzx ebp, byte [r15 + 0x3c]
and bpl, 0x48
test r12, r12
je 0x14010f8f7
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call fcn.14017b170
jmp 0x14010f8f9
xor eax, eax
mov qword [rbx], rax
lea r8, [rdi + 0x68]
mov eax, dword [r15 + 0x44]
test bpl, bpl
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0xc], eax
movsx eax, word [r14 + 0x30]
mov dword [rbx + 0x10], eax
setne al
mov byte [rbx + 0x14], al
mov rax, qword [r8]
mov qword [rbx + 0x18], rax
mov byte [rbx + 0x15], r13b
mov qword [r8], rbx
cmp qword [rbx + 0x18], 0
jne 0x14010f957
lea rdx, [0x14010f980]
mov rcx, rdi
call fcn.14013f340
jmp 0x14010f957
cmp edx, 0x3f
jge 0x14010f957
mov rax, qword [rsi]
btr rax, rdx
mov qword [rsi], rax
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14014d690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0xa8]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x14014d888
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x14014d6f2
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x14014d702
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xe8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14014d72f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, gethostname
mov rcx, rdi
call fcn.14019acc0
jmp 0x14014d75d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], gethostname
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], WSAStartup
mov r9, qword [r9 + 0x68]
call fcn.14014e4c0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14014d79c
mov rcx, rdi
call fcn.14019ad30
test eax, eax
jne 0x14014d874
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x14014d868
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14014d868
mov dword [rbx + rax*4 + 0xe8], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14014d6d0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret