joyce8/EMBER2024-capa huggingface dataset:
Function at 0x575b30
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov edx, 0x104
lea rsi, [rsp + 0x20]
mov rdi, rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x575be0
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdx, [rax + rbx + 2]
cmp rdx, 0x103
ja 0x575be0
mov rcx, rsi
mov r9d, dword [rcx]
add rcx, 4
lea edx, [r9 - 0x1010101]
not r9d
and edx, r9d
and edx, 0x80808080
je 0x575b73
mov r8d, edx
shr r8d, 0x10
test edx, 0x8080
cmove edx, r8d
lea r8, [rcx + 2]
mov ebx, edx
cmove rcx, r8
add bl, dl
lea r8, [rax + 1]
sbb rcx, 3
mov rdx, rdi
sub rcx, rsi
mov byte [rsi + rcx], 0x5c
lea rcx, [rsi + rcx + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
Function at 0x5764f0
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rdx, qword [rcx + 0x198]
mov rbx, rcx
test rdx, rdx
je 0x56ff9c
xor ecx, ecx
call fcn.00573250
mov eax, dword [rbx + 0xc8]
test eax, eax
jle 0x570000
sub eax, 1
test eax, eax
mov dword [rbx + 0xc8], eax
je 0x56ffd0
mov rdx, qword [rbx + 0x198]
test rdx, rdx
je 0x56fff3
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.00573270
mov eax, dword [rbx + 0xf0]
test eax, eax
je 0x56ffb3
mov esi, dword [rbx + 0x190]
call fcn.005731f0
cmp esi, eax
je 0x56ffb3
mov rcx, rbx
call fcn.0056ad20
jmp 0x56ffb3
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str.event_base_del_virtual_
lea r8, str.event.c
lea rdx, [0x006c7688]
mov r9d, 0xedb
mov ecx, 0xdeaddead
mov qword [rsp + 0x28], rax
lea rax, str.base__virtual_event_count___0
mov qword [rsp + 0x20], rax
call fcn.005771e0
nop
nop word [rax + rax]
sub rsp, 0x28
call fcn.005788e0
nop
add rsp, 0x28
jmp 0x5764f0
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.00576ba0
mov eax, dword [0x0067e2c8]
mov rcx, qword [0x0067e2c0]
test eax, eax
je 0x5765bb
cmp qword [rcx], 0
jne 0x5766ba
lea rsi, [rcx + 8]
sub eax, 1
lea rdx, [rsi + rax*8]
jmp 0x576542
lea rax, [rsi + 8]
cmp qword [rax - 8], 0
jne 0x5765c2
mov rsi, rax
cmp rsi, rdx
jne 0x576530
call fcn.0056f680
mov rcx, qword [0x00730560]
movabs rax, 0xffffffff00000000
mov qword [0x0067e2c0], 0
mov qword [0x0067e2c8], 0
mov qword [0x0067e2d0], rax
test rcx, rcx
je 0x576591
xor edx, edx
call fcn.00573230
mov qword [0x00730560], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [r12 + 0x10]
call rdi
mov rcx, r12
call fcn.0056f680
test rbx, rbx
jne 0x5765e0
mov rcx, qword [0x0067e2c0]
test rcx, rcx
je 0x57654c
jmp 0x576547
test rsi, rsi
je 0x576547
mov rdi, qword [sym.imp.KERNEL32.dll_LocalFree]
lea rbp, [0x0067e2c0]
nop dword [rax]
mov r12, qword [rsi]
mov rdx, qword [r12]
mov ecx, dword [r12 + 8]
mov qword [rsi], rdx
sub dword [0x0067e2cc], 1
cmp qword [rsi], 0
je 0x576610
mov rcx, qword [r12 + 0x10]
call rdi
mov rcx, r12
call fcn.0056f680
jmp 0x5765e0
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov ecx, dword [0x0067e2c8]
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
xor edx, edx
div ecx
lea eax, [rdx + 1]
cmp ecx, eax
jbe 0x5766a2
mov r8, qword [rbp]
lea rsi, [r8 + rax*8]
cmp qword [rsi], 0
jne 0x5765fc
lea eax, [rdx + 2]
sub ecx, 2
sub ecx, edx
add rcx, rax
lea rbx, [r8 + rax*8]
lea rdx, [r8 + rcx*8]
jmp 0x576679
cmp qword [rbx], 0
mov rsi, rbx
lea rax, [rbx + 8]
jne 0x5765a0
mov rbx, rax
cmp rdx, rbx
jne 0x576665
mov rcx, qword [r12 + 0x10]
call rdi
mov rcx, r12
call fcn.0056f680
mov rcx, qword [0x0067e2c0]
test rcx, rcx
je 0x57654c
jmp 0x576547
mov rcx, qword [r12 + 0x10]
call rdi
mov rcx, r12
call fcn.0056f680
mov rcx, qword [rbp]
jmp 0x5765bb
mov rsi, rcx
jmp 0x5765cb
Function at 0x5766d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov ecx, dword [0x007306a4]
test ecx, ecx
jne 0x576712
lea rdx, [0x007305a2]
xor eax, eax
nop word [rax + rax]
mov byte [rdx + rax], al
add rax, 1
cmp rax, 0x100
jne 0x5766f0
xor edx, edx
mov dword [0x007306a4], 1
mov word [0x007305a0], dx
mov eax, dword [0x00730588]
test eax, eax
jne 0x57674e
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
lea rcx, [0x00730580]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x576857
mov dword [0x00730588], 1
lea rsi, [rsp + 0x30]
mov edx, 0x20
mov rcx, qword [0x00730580]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x576868
movzx r11d, byte [0x007305a0]
movzx ecx, byte [0x007305a1]
lea rbx, [0x007305a0]
xor eax, eax
lea edi, [r11 - 1]
mov byte [0x007305a0], dil
lea edx, [r11 + rax]
mov r8d, eax
add eax, 1
and r8d, 0x1f
movzx edx, dl
movzx r10d, byte [rsp + r8 + 0x30]
movzx r9d, byte [rbx + rdx + 2]
add r10d, r9d
mov r8d, r10d
add ecx, r8d
cmp eax, 0x100
movzx r8d, cl
movzx r10d, byte [rbx + r8 + 2]
mov byte [rbx + rdx + 2], r10b
mov byte [rbx + r8 + 2], r9b
jne 0x576793
mov edx, 0x20
mov rcx, rsi
mov byte [0x007305a1], dil
call fcn.00575aa0
mov dword [0x0073058c], 1
movzx r11d, byte [0x007305a0]
movzx ecx, byte [0x007305a1]
mov edx, 0xbff
nop word cs:[rax + rax]
mov eax, r11d
sub eax, edx
sub edx, 1
movzx eax, al
movzx r9d, byte [rbx + rax + 2]
add ecx, r9d
cmp edx, 0xffffffff
movzx r8d, cl
movzx r10d, byte [rbx + r8 + 2]
mov byte [rbx + rax + 2], r10b
mov byte [rbx + r8 + 2], r9b
jne 0x576810
mov byte [0x007305a1], cl
mov dword [0x00730590], 0x186a00
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x576744
mov edx, dword [0x0073058c]
mov eax, 0xffffffff
test edx, edx
je 0x57684f
lea rbx, [0x007305a0]
jmp 0x5767f2
Function at 0x577cb0
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, dword [0x007306f8]
mov esi, ecx
test eax, eax
je 0x577e14
mov edx, 0x50
mov ecx, 1
call fcn.0056d1f0
test rax, rax
mov rbx, rax
je 0x577dd2
test esi, esi
jle 0x577e00
lea eax, [rsi + rsi]
movsx rcx, ax
mov word [rbx + 0x30], ax
mov edx, 8
call fcn.0056d1f0
test rax, rax
mov qword [rbx + 0x38], rax
je 0x577ee0
xor r8d, r8d
xor edx, edx
mov r9d, esi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
mov qword [rbx], rax
mov dword [rbx + 0x34], 0xffffffff
je 0x577dab
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
test rax, rax
mov qword [rbx + 0x48], rax
je 0x577d9d
cmp word [rbx + 0x30], 0
jle 0x577de0
xor edi, edi
xor esi, esi
mov r12, qword [sym.imp.msvcrt.dll__beginthread]
lea rbp, [0x00577aa0]
jmp 0x577d8c
mov rdx, qword [rbx + 0x38]
add esi, 1
mov qword [rdx + rdi], rax
movsx eax, word [rbx + 0x30]
add rdi, 8
add word [rbx + 0x40], 1
cmp eax, esi
jle 0x577de0
xor edx, edx
mov r8, rbx
mov rcx, rbp
call r12
cmp rax, 0xffffffffffffffff
jne 0x577d70
mov rcx, qword [rbx]
test rcx, rcx
je 0x577dab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x577db9
call fcn.0056f680
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x577dc8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
xor ebx, ebx
call fcn.0056f680
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rbx + 8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 4
mov eax, 4
mov esi, 2
jmp 0x577cf4
movabs rdi, 0x4660ddf325a207b9
movabs rax, 0x11cfcbacb5367df1
xor r8d, r8d
mov qword [rsp + 0x30], rdi
movabs rdi, 0x3e06748ce576e98e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
movabs rax, 0x92a1485f8000ca95
movabs rdi, 0x11cfcbacb5367df2
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rdi
mov edx, 1
mov qword [rsp + 0x48], rax
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x577cca
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.00577bd0
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [0x007306e0], rax
call fcn.00577bd0
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [0x007306e8], rax
call fcn.00577bd0
mov rcx, rbx
mov qword [0x007306f0], rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x007306f8], 1
jmp 0x577cca
mov rcx, qword [rbx]
test rcx, rcx
jne 0x577da5
jmp 0x577db9
Function at 0x578a80
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov edi, edx
mov dword [rsp + 0x3c], 1
test rsi, rsi
mov ecx, 2
je 0x578aa1
mov ecx, dword [rsi + 4]
xor r8d, r8d
mov edx, 0x84000001
call fcn.005763a0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x578b40
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 8
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x578b1c
test edi, edi
jne 0x578b10
test rsi, rsi
je 0x578aff
mov rdx, qword [rsi + 0x20]
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x578b1c
mov rax, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call fcn.00573920
test eax, eax
jns 0x578ae4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
mov esi, eax
mov rbx, 0xffffffffffffffff
call sub.WS2_32.dll_closesocket
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x578aff
lea rdx, [0x006c9a60]
mov rcx, rax
call fcn.00577190
jmp 0x578aff

Function at 0x5793f0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
lea rsi, [rsp + 0x60]
lea rbx, [rsp + 0x40]
mov rbp, r8
mov rdi, r9
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbx
mov r9d, 0x401
mov r8, rsi
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x579456
mov rcx, rsi
call fcn.0056d4b0
mov rcx, rbx
mov qword [rbp], rax
call fcn.0056d4b0
mov qword [rdi], rax
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, eax
call fcn.00583080
lea rdx, str.getnameinfo_failed:__s
mov r8, rax
mov ecx, 1
call fcn.005771e0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x580820
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
call fcn.00577ca0
movzx ecx, byte [rbx + 0x91]
xor r8d, r8d
mov rdi, rax
mov dword [rsp + 0x4c], 0
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
mov rax, qword [rbx + 0x88]
test byte [rax + 0x34], 1
je 0x580926
cmp rsi, 0xffffffffffffffff
je 0x580931
mov dword [rsp + 0x20], 8
lea r9, [rax + 0x38]
mov r8d, 0x700b
mov edx, 0xffff
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rbx + 0x88]
test byte [rax + 0x28], 1
je 0x580961
mov rcx, qword [rax + 0x48]
mov r8d, 1
mov rdx, rsi
call fcn.00577c70
test eax, eax
js 0x580975
movzx eax, byte [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
lea rbp, [rbx + 0x28]
mov qword [rbx + 0x50], rsi
xor r9d, r9d
lea r8, [rbx + 0x95]
mov rcx, qword [rdx + 0x38]
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x38], rbp
shr al, 1
movzx eax, al
mov qword [rsp + 0x30], rdx
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [rdi]
test eax, eax
jne 0x580940
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x580926
mov dword [rbx + 0x58], eax
mov rax, qword [rbx + 0x88]
lea rdx, [rbx + 0x60]
mov rcx, qword [rax + 0x40]
call fcn.0056d080
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x58090f
mov r9d, 1
xor r8d, r8d
mov edx, 1
mov rcx, rbp
call fcn.00580730
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rsi
call fcn.005738d0
mov rax, qword [rbx + 0x88]
jmp 0x58089f
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x580928
Function at 0x582890
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
test rcx, rcx
mov rbx, rcx
mov r12, rdx
mov r13, r8
je 0x582910
test byte [rcx + 0x38], 0x10
mov rdx, qword [rcx + 0x30]
mov ebp, 0
cmovne rbp, rcx
test rdx, rdx
je 0x5828cb
xor ecx, ecx
call fcn.00573250
movzx eax, byte [rbp + 0x90]
test al, 1
jne 0x582a70
or al, byte [rbx + 0x38]
mov esi, 0xffffffff
test al, 2
je 0x582920
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x5828f6
xor ecx, ecx
call fcn.00573270
mov eax, esi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x5828f6
mov rax, qword [rbx + 0x18]
xor esi, esi
test rax, rax
je 0x5828e6
test r12, r12
js 0x582a60
cmp rax, r12
jb 0x582a60
lea r14, [rbp + 0xa8]
lea rdi, [rbp + 0xb0]
mov rcx, rbx
mov edx, 1
call fcn.00566950
and rdi, 0xfffffffffffffff8
mov rcx, r14
xor eax, eax
sub rcx, rdi
mov qword [rbp + 0x98], 0
mov dword [rbp + 0xa0], 0
add ecx, 0x100
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x1a0], 0
shr ecx, 3
rep stosq qword [rdi], rax
mov rsi, qword [rbx]
test rsi, rsi
mov qword [rbp + 0x98], rsi
je 0x582af5
mov rdi, r14
xor r15d, r15d
jmp 0x5829db
movsxd r15, edx
mov dword [rdi], eax
add rdi, 0x10
sub r12, qword [rsi + 0x18]
cmp r15d, 0xf
mov rsi, qword [rsi]
jg 0x582a0e
test rsi, rsi
je 0x582a0e
mov rax, qword [rsi + 0x10]
add rax, qword [rsi + 0x28]
mov edx, 0x20
mov rcx, rsi
mov qword [rdi + 8], rax
call fcn.0055f490
mov rax, qword [rsi + 0x18]
lea edx, [r15 + 1]
cmp rax, r12
jb 0x5829c0
add r15, 0xa
shl r15, 4
mov dword [rbp + r15 + 8], r12d
mov esi, edx
mov dword [rbp + 0xa0], edx
mov rcx, rbx
call fcn.0055f5b0
mov rcx, qword [rbp + 0x88]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
mov r8d, esi
mov rdx, r14
call qword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x582ab0
or byte [rbp + 0x90], 2
xor esi, esi
jmp 0x5828e6
mov r12, rax
jmp 0x58293d
lea rax, str.evbuffer_launch_write_
lea r8, str.buffer_iocp.c
lea rdx, str._s:_d:_Assertion__s_failed_in__s
mov r9d, 0xba
mov ecx, 0xdeaddead
mov qword [rsp + 0x28], rax
lea rax, str._buf_o__read_in_progress
mov qword [rsp + 0x20], rax
call fcn.005771e0
nop word cs:[rax + rax]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x582a50
mov rcx, qword [rbp + 0x98]
lea rdx, [rbp + 0xa0]
mov r8d, 0x20
mov esi, 0xffffffff
call fcn.00582560
mov edx, 1
mov rcx, rbx
call fcn.005669a0
mov rcx, rbx
call fcn.00561380
jmp 0x5828e6
xor esi, esi
xor edx, edx
jmp 0x582a10
Function at 0x582b00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
mov rbp, r8
je 0x582da3
test byte [rcx + 0x38], 0x10
je 0x582da3
mov rdx, qword [rcx + 0x30]
mov dword [rsp + 0x44], 0
test rdx, rdx
je 0x582b43
xor ecx, ecx
call fcn.00573250
movzx eax, byte [rbx + 0x90]
test al, 2
jne 0x582cf0
test byte [rbx + 0x38], 4
je 0x582b80
mov esi, 0xffffffff
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x582b6d
xor ecx, ecx
call fcn.00573270
mov eax, esi
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test al, 1
jne 0x582b58
lea r12, [rbx + 0xa8]
lea rdi, [rbx + 0xb0]
xor eax, eax
mov qword [rbx + 0x98], 0
mov dword [rbx + 0xa0], 0
mov r8d, 0x10
and rdi, 0xfffffffffffffff8
mov rcx, r12
mov qword [rbx + 0xa8], 0
sub rcx, rdi
mov qword [rbx + 0x1a0], 0
mov rdx, rsi
add ecx, 0x100
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, rbx
call fcn.00564a50
cmp eax, 0xffffffff
je 0x582b58
xor edx, edx
mov rcx, rbx
lea rdi, [rsp + 0x50]
call fcn.00566950
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov r9d, 0x10
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.0055fc70
test eax, eax
mov r13d, eax
jle 0x582db0
lea ecx, [rax - 1]
lea r8, [rdi + 8]
xor eax, eax
add rcx, 1
shl rcx, 4
mov rdx, qword [rdi + rax]
mov qword [rbx + rax + 0xb0], rdx
mov rdx, qword [r8 + rax]
mov dword [rbx + rax + 0xa8], edx
add rax, 0x10
cmp rax, rcx
jne 0x582c40
mov rax, qword [rsp + 0x48]
mov dword [rbx + 0xa0], r13d
mov rsi, qword [rax]
test rsi, rsi
mov qword [rbx + 0x98], rsi
je 0x582d6d
xor edi, edi
mov rcx, rsi
mov edx, 0x10
add edi, 1
call fcn.0055f490
mov rsi, qword [rsi]
test rsi, rsi
jne 0x582c81
cmp r13d, edi
jne 0x582d6d
mov rcx, rbx
call fcn.0055f5b0
lea rax, [rsp + 0x44]
mov rcx, qword [rbx + 0x88]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbp
lea r9, [rsp + 0x40]
mov r8d, r13d
mov qword [rsp + 0x20], rax
mov rdx, r12
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x582d30
or byte [rbx + 0x90], 1
xor esi, esi
jmp 0x582b5d
lea rax, str.evbuffer_launch_read_
lea r8, str.buffer_iocp.c
lea rdx, str._s:_d:_Assertion__s_failed_in__s
mov r9d, 0x104
mov ecx, 0xdeaddead
mov qword [rsp + 0x28], rax
lea rax, str._buf_o__write_in_progress
mov qword [rsp + 0x20], rax
call fcn.005771e0
nop word cs:[rax + rax]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x582cde
mov rcx, qword [rbx + 0x98]
lea rdx, [rbx + 0xa0]
mov r8d, 0x10
call fcn.00582560
mov rcx, rbx
xor edx, edx
call fcn.005669a0
mov rcx, rbx
call fcn.00561380
jmp 0x582b58
lea rax, str.evbuffer_launch_read_
lea r8, str.buffer_iocp.c
lea rdx, str._s:_d:_Assertion__s_failed_in__s
mov r9d, 0x120
mov ecx, 0xdeaddead
mov qword [rsp + 0x28], rax
lea rax, str.npin__nvecs
mov qword [rsp + 0x20], rax
call fcn.005771e0
mov esi, 0xffffffff
jmp 0x582b6d
mov dword [rbx + 0xa0], eax
mov rax, qword [rsp + 0x48]
xor edi, edi
mov rsi, qword [rax]
test rsi, rsi
mov qword [rbx + 0x98], rsi
jne 0x582c7f
jmp 0x582c99
Function at 0x58d3c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00731d84]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x58d4e0
mov rax, qword [0x00731d88]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x58d40c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x58d4c6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x58d3f0
mov rcx, rsi
call fcn.0058e000
test rax, rax
mov r12, rax
je 0x58d518
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00731d88]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.0058e150
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00731d88]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x58d4fb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x58d4bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x58d4bf
add rbx, qword [0x00731d88]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x58d4e7
add dword [0x00731d84], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x58d417
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0058d350
mov rax, qword [0x00731d88]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.0058d350
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0058d350
nop
nop dword [rax + rax]

Function at 0x58dc70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00732060]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00732040]
test rbx, rbx
je 0x58dcc4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x58dcbb
test rsi, rsi
je 0x58dcbb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x58dca0
lea rcx, [0x00732060]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x58e000
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x006d0f70]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x58e020
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.0058dee0
test eax, eax
je 0x58e018
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x58e07d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x58e074
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x58e018
add rdx, 0x28
cmp rdx, r9
jne 0x58e060
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x594cd0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
sub r8d, 1
mov edi, ecx
mov ecx, 0x66666667
mov eax, r8d
mov rbp, rdx
movsxd rsi, r8d
imul ecx
sar r8d, 0x1f
mov rbx, r9
mov ecx, edx
sar ecx, 2
sub ecx, r8d
je 0x594d25
mov r8d, 0x66666667
nop dword [rax]
mov eax, ecx
sar ecx, 0x1f
add r12d, 1
imul r8d
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x594d10
mov edx, dword [rbx + 0x2c]
cmp edx, 0xffffffff
je 0x594da0
mov ecx, dword [rbx + 0xc]
cmp r12d, edx
mov r9, rbx
cmovl r12d, edx
mov r8d, 1
lea edx, [r12 + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, edi
mov rdx, rbp
mov dword [rbx + 0xc], eax
add r12d, 1
call fcn.00594590
mov ecx, dword [rbx + 8]
mov eax, dword [rbx + 0x2c]
mov rdx, rbx
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call fcn.00594140
add dword [rbx + 0xc], r12d
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00594a00
mov eax, dword [0x0067e550]
cmp eax, 0xffffffff
je 0x594dcc
test eax, eax
je 0x594dbc
mov edx, 2
mov dword [rbx + 0x2c], edx
jmp 0x594d2d
call fcn.00599d30
test al, 1
mov edx, 3
jne 0x594daf
jmp 0x594db4
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x594df4
movsx eax, byte [rax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x0067e550], eax
jmp 0x594dab
xor eax, eax
jmp 0x594de9

Function at 0x59b1d0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x0067e5f8], eax
je 0x59b1ea
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop