joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bdd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000be1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000be1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000be1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000be1a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000be1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000be1c
xor al, al
add rsp, 0x28
ret

Function at 0x14000fb38
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f9a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f9a3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f9a3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f9a3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f9a3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f9a3
cmp dword [rcx + 0xf8], 0
je 0x14000f9a3
mov ecx, ebx
call fcn.14000fa54
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f830
nop
cmp dword [rbp + 0x20], 0
je 0x14000f9f1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f9fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f934
Function at 0x140019124
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400191ab
mov rsi, rbx
cmp word [rax], bp
je 0x14001916a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019154
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019150
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016954
mov rdi, rax
test rax, rax
je 0x140019198
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020400
mov rbp, rdi
xor ecx, ecx
call fcn.140015978
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b774
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b78a
mov al, 1
jmp 0x14001b7ea
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b79b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b7e8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400198c8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b7e8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b7e8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b7e8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b7ea
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001fc00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001fc28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001fc28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1403e0bc0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1403e0bcd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1403e0bdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1403e0bc5
lea eax, [rcx + 1]
jmp 0x1403e0beb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1403e0bfe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1403e0be4
sub eax, 3
jb 0x1403e0c1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1403e0c6d
sar eax, 1
movsxd rbp, eax
jb 0x1403e0c54
jmp 0x1403e0c2c
add ebx, ebx
jne 0x1403e0c2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1403e0c54
inc ecx
add ebx, ebx
jne 0x1403e0c3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1403e0c54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1403e0c4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1403e0c3c
add ecx, 2
jmp 0x1403e0c59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1403e0b82
jmp 0x1403e0bcd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3de000]
mov eax, dword [rdi]
or eax, eax
je 0x1403e0cd5
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3f4184]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1403e0c79
jns 0x1403e0cae
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1403e0cb8
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1403e0ccf
mov qword [rbx], rax
add rbx, 8
jmp 0x1403e0c99
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1403e0d2d
sub rsp, 0xffffffffffffff80
jmp 0x140107a00
Function at 0x18001e640
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1801130d0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x18001e697
mov word [rsp + 0x40], r15w
lea rax, vtable.CVolObject.0
mov qword [r14], rax
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
lea rcx, vtable.CWString.0
mov qword [r14], rcx
lea rbx, [r14 + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rbx], rax
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
lea rax, vtable.CVolMem.0
mov qword [rbx], rax
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x28], r15
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x30], 0x40
mov qword [r14 + 0x18], r15
mov qword [r14 + 0x50], 0xfe
mov qword [r14], rcx
cmp word [rsp + 0x40], 0
je 0x18001e84d
mov rsi, qword [r14 + 0x18]
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x18001e79f
mov rax, rdi
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rsi + rax*2], 0
jne 0x18001e720
lea rbp, [rax*2 + 2]
mov qword [rbx + 0x28], r15
cmp qword [rbx + 0x20], rbp
jl 0x18001e77d
cmp rbp, 2
jne 0x18001e753
mov rcx, qword [rbx + 0x18]
movzx eax, word [rsi]
mov word [rcx], ax
add qword [rbx + 0x28], rbp
jmp 0x18001e79b
cmp rbp, 4
jne 0x18001e767
mov rcx, qword [rbx + 0x18]
mov eax, dword [rsi]
mov dword [rcx], eax
add qword [rbx + 0x28], rbp
jmp 0x18001e79b
cmp rbp, 8
jne 0x18001e77d
mov rcx, qword [rbx + 0x18]
mov rax, qword [rsi]
mov qword [rcx], rax
add qword [rbx + 0x28], rbp
jmp 0x18001e79b
test rbp, rbp
jle 0x18001e79b
mov rdx, rbp
mov rcx, rbx
call fcn.1800418f0
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.18009d4b0
mov qword [r14 + 0x18], r15
mov rsi, qword [rbx + 0x28]
cmp rsi, 2
jb 0x18001e7bd
mov rax, qword [rbx + 0x18]
cmp word [rax + rsi - 2], 0
jne 0x18001e7bd
add rsi, 0xfffffffffffffffe
mov qword [rbx + 0x28], rsi
lea rax, [rsp + 0x40]
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x18001e7c2
lea rdi, [rdi*2 + 2]
mov rax, qword [rbx + 0x20]
sub rax, rsi
cmp rax, rdi
jl 0x18001e82a
cmp rdi, 2
jne 0x18001e7fa
mov rcx, qword [rbx + 0x18]
movzx eax, word [rsp + 0x40]
mov word [rsi + rcx], ax
add qword [rbx + 0x28], rdi
jmp 0x18001e84d
cmp rdi, 4
jne 0x18001e811
mov rcx, qword [rbx + 0x18]
mov eax, dword [rsp + 0x40]
mov dword [rsi + rcx], eax
add qword [rbx + 0x28], rdi
jmp 0x18001e84d
cmp rdi, 8
jne 0x18001e82a
mov rcx, qword [rbx + 0x18]
mov rax, qword [rsp + 0x40]
mov qword [rsi + rcx], rax
add qword [rbx + 0x28], rdi
jmp 0x18001e84d
test rdi, rdi
jle 0x18001e84d
lea rdx, [rsi + rdi]
mov rcx, rbx
call fcn.1800418f0
lea rcx, [rsi + rax]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.18009d4b0
nop
mov dword [rsp + 0x20], 1
mov rax, r14
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18009ad10
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x18001ea60
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1801130d0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [0x180117850]
test rax, rax
jne 0x18001eaa6
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
test eax, eax
sete cl
mov qword [0x180117850], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18009ad10
add rsp, 0x1d8
ret
Function at 0x18003d940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x18003d972
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x18003da67
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x18003da67
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x18003da5e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x18003da3c
cmp rdi, 1
jne 0x18003d9fa
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x18003da59
cmp rdi, 2
jne 0x18003da11
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x18003da59
cmp rdi, 4
jne 0x18003da26
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x18003da59
cmp rdi, 8
jne 0x18003da3c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x18003da59
test eax, eax
je 0x18003da59
mov rdx, rdi
mov rcx, rbx
call fcn.1800418f0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.18009d4b0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x18003f160
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1801130d0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
test rcx, rcx
je 0x18003f346
cmp word [rcx], 0
je 0x18003f346
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov edi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x18003f25b
test ax, ax
je 0x18003f29a
cmp word [rbx + 2], 0x3a
jne 0x18003f29a
cmp word [rbx + 4], 0x5c
jne 0x18003f29a
mov edx, 0x5c
mov rcx, rbx
call fcn.18009d08c
test rax, rax
je 0x18003f295
cmp rax, rbx
jbe 0x18003f27e
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rbx
lea r8, [rax + 2]
sar r8, 1
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180043290
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x18003f2b0
cmp qword [rsp + 0x68], rdi
je 0x18003f2f7
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x18003f2f7
cmp word [rdi], 0
je 0x18003f2f7
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x18003f2f7
cmp word [rdi], 0
je 0x18003f2d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x18003f303
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x18003f303
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x18003f328
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + Ordinal_26]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x18003f348
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.18009ad10
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180041f30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x18004203a
cmp word [rdx], 0
je 0x18004203a
mov qword [rsp + 0x30], rbp
lea rdx, [0x1800fa91c]
mov rcx, rax
mov qword [rsp + 0x38], rdi
mov rsi, 0xffffffffffffffff
call fcn.1800aa33c
mov rdi, rax
test rax, rax
je 0x18004200a
xor edx, edx
lea r8d, [rsi + 3]
mov rcx, rax
call fcn.1800a9b30
mov rcx, rdi
call fcn.1800aad54
xor r8d, r8d
movsxd rbp, eax
xor edx, edx
mov rcx, rdi
call fcn.1800a9b30
test rbp, rbp
jle 0x180042000
mov rdx, rbp
mov rcx, rbx
call fcn.180041870
mov rcx, rax
lea edx, [rsi + 2]
mov r9, rdi
mov r8, rbp
call fcn.1800aa798
mov rcx, rdi
mov rbp, rax
call fcn.1800ab044
test eax, eax
jne 0x180042002
mov rdx, rbp
mov rcx, rbx
call fcn.1800418f0
mov rcx, rdi
call fcn.1800a98c4
mov rax, rbp
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor esi, esi
mov rcx, rdi
call fcn.1800a98c4
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x18004201d
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + Ordinal_27]
mov qword [rbx + 0x18], 0
mov rax, rsi
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x20], 0
jmp 0x180041feb
mov rbx, qword [rsp + 0x40]
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rsi
ret

Function at 0x1800555d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1800b7598
cdqe
add rsp, 0x28
ret

Function at 0x180056bf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x180115fb8], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x180056c9f
test rdi, rdi
je 0x180056c9f
mov eax, dword [0x180115fbc]
test eax, eax
jne 0x180056c97
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.180056940
mov ecx, 2
call fcn.1800acd84
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.180060c00
mov rcx, qword [0x180115fb0]
call fcn.1800b01b0
call fcn.1800a9310
mov dword [rax], listen
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x180115fbc], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x180056cc7
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.180056940
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180056d40
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x180115fb8], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x180056def
test rdi, rdi
je 0x180056def
mov eax, dword [0x180115fbc]
test eax, eax
jne 0x180056de7
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.180056940
mov ecx, 2
call fcn.1800acd84
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.180060c00
mov rcx, qword [0x180115fb0]
call fcn.1800b01b0
call fcn.1800a9310
mov dword [rax], listen
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x180115fbc], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x180056e17
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.180056940
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18007b2a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
lea r9, str.F:_vcpkg_vcpkg_buildtreescurl_srce5cd7b457b_ffb4748466.cleanlibgetenv.c
xor ebp, ebp
mov ebx, 1
mov edx, ebx
xor ecx, ecx
lea r8d, [rbp + 0x2d]
call fcn.180056ae0
mov rdi, rax
test rax, rax
je 0x18007b329
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x18007b35f
cmp ebx, esi
je 0x18007b35f
cmp ebx, 0x8000
ja 0x18007b35f
cmp ebx, esi
jb 0x18007b35a
mov edx, ebx
lea r9, str.F:_vcpkg_vcpkg_buildtreescurl_srce5cd7b457b_ffb4748466.cleanlibgetenv.c
mov r8d, reloc.WLDAP32.dll_Ordinal_45
mov rcx, rdi
call fcn.180056ae0
mov rdi, rax
test rax, rax
jne 0x18007b2e0
mov edx, Ordinal_50
mov rcx, rbp
lea r8, str.F:_vcpkg_vcpkg_buildtreescurl_srce5cd7b457b_ffb4748466.cleanlibgetenv.c
call fcn.1800568e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x18007b33f
mov edx, Ordinal_60
mov rcx, rdi
jmp 0x18007b331
Function at 0x1800a5a70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800a5947
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800a5947
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800a5947
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800a5947
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800a5947
cmp dword [rcx + 0x84], 0xe
jbe 0x1800a5947
cmp dword [rcx + 0xf8], 0
je 0x1800a5947
mov ecx, ebx
call fcn.1800a59e8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800a57d8
cmp dword [rbp + 0x20], 0
je 0x1800a5994
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800a599c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800a58e0

Function at 0x1800c0834
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1800c0811
call fcn.1800a9310
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.1800a1e54
or eax, 0xffffffff
jmp 0x1800c082e
sub dword [rcx + 0x10], 1
jns 0x1800c0820
add rsp, 0x28
jmp fcn.1800beaec
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1800c07f0
Function at 0x1800c4a64
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800c4a84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800a92a0
or eax, 0xffffffff
jmp 0x1800c4a86
xor eax, eax
add rsp, 0x28
ret
Function at 0x140056a60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140056a6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140056a7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140056a65
lea eax, [rcx + 1]
jmp 0x140056a8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140056a9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140056a84
sub eax, 3
jb 0x140056abe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140056b0d
sar eax, 1
movsxd rbp, eax
jb 0x140056af4
jmp 0x140056acc
add ebx, ebx
jne 0x140056aca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140056af4
inc ecx
add ebx, ebx
jne 0x140056ada
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140056af4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140056aed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140056adc
add ecx, 2
jmp 0x140056af9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140056a22
jmp 0x140056a6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140056b59
cmp rsi, rcx
jae 0x140056b61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140056b40
cmp al, 0x8f
ja 0x140056b40
cmp byte [rsi - 2], 0xf
je 0x140056b46
sub al, 0xe8
cmp al, 1
ja 0x140056b2a
cmp rsi, rcx
jae 0x140056b61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140056b30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140056b61
lodsb al, byte [rsi]
jmp 0x140056b40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x54000]
mov eax, dword [rdi]
or eax, eax
je 0x140056bca
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x82074]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140056b6e
jns 0x140056ba3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140056bad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140056bc4
mov qword [rbx], rax
add rbx, 8
jmp 0x140056b8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140056c22
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0