joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1409c10b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409c1237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409c10e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409c10c7
add dl, dl
jne 0x1409c10ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409c114e
xor eax, eax
add dl, dl
jne 0x1409c10fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409c1205
add dl, dl
jne 0x1409c110e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409c111b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409c1128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409c1135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409c1142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409c10d6
mov eax, 1
add dl, dl
jne 0x1409c115e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409c116b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409c1153
sub eax, ebx
mov ebx, 1
jne 0x1409c11a4
mov ecx, 1
add dl, dl
jne 0x1409c1186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409c1193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409c117b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409c10d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409c11c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409c11cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409c11b5
cmp eax, 0x7d00
jae 0x1409c11f3
cmp eax, 0x500
jb 0x1409c11ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409c10d6
cmp eax, 0x7f
ja 0x1409c11f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409c10d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409c122a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409c10d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406b7550
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.1406bba50
sub rsp, rax
mov rax, qword [0x14070ff28]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov word [rsp + 0x30], bp
lea edi, [rbp + 0x28]
test al, al
je 0x1406b7602
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1406cb6e4
cmp rax, 1
jne 0x1406b765e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1406b75df
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1406b75d3
cmp rcx, 1
jb 0x1406b765e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1406b75a0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1406b7633
lea rcx, [rsp + 0x80]
call fcn.1406ce210
jmp 0x1406b7635
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1406bba20
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1406bfc08
int3
Function at 0x1406b84a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140757e2e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x1406b8523
mov edx, 3
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140757c80], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140757c80], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140757c80], rdx
call fcn.1406b63e0
cmp eax, ebx
jne 0x1406b868d
mov byte [0x140757e2e], 1
lea rdx, [0x1406ddac8]
mov rcx, rsi
call fcn.1406cb190
test eax, eax
je 0x1406b85ae
cmp byte [0x140757e2d], 1
je 0x1406b85ae
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758b80], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758b88], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758b90], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758b98], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758ba0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758ba8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758bb0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140758bb8], rax
mov byte [0x140757e2d], 1
mov r8, qword [0x140757c80]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x1406b85d7
inc rax
test cl, cl
jne 0x1406b85c0
mov ecx, r9d
jmp 0x1406b85dc
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x1406b85e3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1406b8648
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1406b8625
inc rax
test cl, cl
jne 0x1406b8610
mov ecx, r9d
jmp 0x1406b862a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1406b8631
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x1406b8600
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1406b8678
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1406b48f0
add rdi, 8
sub rbx, 1
jne 0x1406b8660
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1406c7ea4
call fcn.1406bfc08
int3
Function at 0x1406bb5c0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14070ff28]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
lea edi, [r14 + 0x28]
test al, al
je 0x1406bb671
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1406cb6e4
cmp rax, 1
jne 0x1406bb6a7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1406bb64d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1406bb640
cmp rcx, 1
jb 0x1406bb6a7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1406bb610
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1406bba20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1406bfc08
int3

Function at 0x1406bb8a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14070ff28]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
lea edi, [rbp + 0x28]
test al, al
je 0x1406bb94f
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1406cb6e4
cmp rax, 1
jne 0x1406bb985
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1406bb92c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1406bb920
cmp rcx, 1
jb 0x1406bb985
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1406bb8f0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1406bba20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1406bfc08
int3

Function at 0x1406bc498
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1406bc4e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1406bc4e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1406bc4e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1406bc4e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1406bc4e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1406bc4e4
xor al, al
add rsp, 0x28
ret
Function at 0x1406c1478
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1406c12e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1406c12e3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1406c12e3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1406c12e3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1406c12e3
cmp dword [rcx + 0x84], 0xe
jbe 0x1406c12e3
cmp dword [rcx + 0xf8], 0
je 0x1406c12e3
mov ecx, ebx
call fcn.1406c1394
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1406c1170
nop
cmp dword [rbp + 0x20], 0
je 0x1406c1331
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1406c133c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1406c1274
Function at 0x1406d3080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1406d3107
mov rsi, rbx
cmp word [rax], bp
je 0x1406d30c6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1406d30b0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1406d30ac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1406ce6e8
mov rdi, rax
test rax, rax
je 0x1406d30f4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1406bc840
mov rbp, rdi
xor ecx, ecx
call fcn.1406cf230
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1406d53b0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1406d53c6
mov al, 1
jmp 0x1406d5426
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1406d53d7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1406d5424
mov ecx, dword [rcx + 0x18]
nop
call fcn.1406d33c8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1406d5424
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1406d5424
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1406d5424
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1406d5426
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140001d60
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x48
lea rcx, str.flexflexflex
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ecx
xor r9d, r9d
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, rax
mov rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
call fcn.1400024e0
lea rcx, str._debug_:_press_enter_to_close_console__this_might_show_up_if_theres_an_issue_
call fcn.140001d00
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400024e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140060080]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x14005a2d0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x66636637
mov dword [rbp - 5], 0x66383463
mov word [rbp - 1], gethostname
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140002540
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xf]
call fcn.140001fb0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x140002594
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000258f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000258f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045b54
movdqa xmm0, xmmword [0x14005a2c0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x696e6f67
mov dword [rbp - 5], 0x62727473
mov word [rbp - 1], 0x78
movdqa xmm0, xmmword [0x14005a2a0]
movdqu xmmword [rbp + 0xf], xmm0
movdqa xmm1, xmmword [0x14005a2b0]
movdqu xmmword [rbp + 0x1f], xmm1
movdqa xmm0, xmmword [0x14005a280]
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x3f], 0x4d585d49
mov word [rbp + 0x43], 0x5c
nop dword [rax]
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x10], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x11], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x12], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x13], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x14], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x15], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x16], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x17], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x18], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x19], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x1a], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x1b], al
movzx eax, byte [rbp + 0xf]
xor byte [rbp + rbx + 0x1c], al
add rbx, 0xd
cmp rbx, 0x34
jb 0x1400025f0
mov byte [rbp + 0x44], 0
mov r9d, Ordinal_50
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140045af0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x140007370
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x140012330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14001238e
mov dl, 1
call fcn.140008fa0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140008fa0
mov eax, ebx
jmp 0x1400123d2
cmp ebx, 2
ja 0x1400123d0
mov r9, qword [rdi + 0x668]
lea rdx, [0x14004b2b0]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400123f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140060080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140012433
cmp qword [rcx + 0x678], 0
je 0x140012510
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140007770
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140012461
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400124a8
cmp byte [rdi + 0x1597], 0
jne 0x1400124a8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140012490
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140012508
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140012563
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140012529
mov dl, 1
mov rcx, rdi
call fcn.140008fa0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140008fa0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140045af0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14004b2b0]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140012508
call fcn.140045ed8
int3
Function at 0x140012570
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400126d6
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x140060080]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x1400126be
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.140007770
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x140012631
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400125f0
cmp byte [rax + rcx - 1], 0xa
jne 0x140012618
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x14001262c
lea r8, [0x140059b94]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.140007670
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140012636
cmp qword [rdi + 0x718], 0
je 0x14001267e
mov dl, 1
mov rcx, rdi
call fcn.140008fa0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140008fa0
jmp 0x1400126b6
mov r9, qword [rdi + 0x668]
lea rcx, [0x14004b2b0]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140045af0
add rsp, 0x860
pop rdi
ret

Function at 0x140012770
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400127b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140012950
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x140060080]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x1a0]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov rax, rcx
mov r12, r9
shl rax, 5
mov r15, r8
lea rbx, [rsi + 0x508]
mov rbp, qword [rsi + rcx*8 + 0x4c0]
add rbx, rax
mov rax, qword [rsi + 0x698]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140012a57
lea rax, [0x140012800]
cmp qword [rsi + rcx*8 + 0x4e8], rax
jne 0x140012a57
cmp qword [rbx], r13
je 0x1400129de
test rdi, rdi
je 0x140012a57
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.14001d7e0
cmp eax, 0xffffffff
je 0x140012a57
test al, 1
je 0x140012a57
mov rax, qword [rbx]
test rax, rax
jne 0x140012a30
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x140012a53
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140012a57
add qword [rbx + 0x10], rcx
jmp 0x140012a57
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x140012ac4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140012a90
mov dword [r14], 0x51
mov rax, r13
jmp 0x140012ac7
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140004110
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400123f0
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140045af0
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140013160
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x558], 0
je 0x14001317d
call fcn.140010580
test eax, eax
jne 0x1400131a3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x140013176
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x140013176
mov al, 1
add rsp, 0x28
ret