joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400206f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rcx]
xor edi, edi
mov rbx, rcx
mov esi, edi
lea ebp, [rdi + 1]
cmp al, 0x2d
jne 0x14002072b
mov esi, ebp
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0x2d
je 0x140020720
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x140020761
nop dword [rax + rax]
movsx eax, byte [rbx]
inc rbx
sub eax, 0x30
movsxd rcx, eax
lea rax, [rdi + rdi*4]
lea rdi, [rcx + rax*2]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x140020740
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_ispunct]
test eax, eax
jne 0x14002077b
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x140020780
inc rbx
jmp 0x140020761
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140020794
test rdi, rdi
cmove rdi, rbp
movsx eax, byte [rbx]
test al, al
jne 0x1400207a3
mov rax, rdi
jmp 0x14002083c
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp eax, 0x64
je 0x1400207ff
cmp eax, 0x68
je 0x1400207f6
cmp eax, 0x6d
je 0x1400207f0
cmp eax, 0x73
je 0x140020806
cmp eax, 0x77
je 0x1400207e7
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__rotate_offset:_unknown_character_n
call fcn.140001010
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
imul rdi, rdi, 0x93a80
jmp 0x140020806
imul rdi, rdi, 0x3c
jmp 0x140020806
imul rdi, rdi, 0xe10
jmp 0x140020806
imul rdi, rdi, 0x15180
mov eax, 0x15180
cmp rdi, rax
jb 0x140020833
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__rotate_offset:_value_is_greater_than_1_day_n
call fcn.140001010
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
sub rax, rdi
test esi, esi
cmove rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002bcf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rcx]
mov edi, edx
movzx eax, bl
mov rsi, r8
mov r8, qword [rcx + 8]
xor eax, 0x811c9dc5
imul r10d, eax, 0x1000193
mov rax, rbx
shr rax, 8
movzx eax, al
xor r10d, eax
mov rax, rbx
shr rax, 0x10
movzx eax, al
imul r11d, r10d, 0x1000193
xor r11d, eax
mov rax, rbx
shr rax, 0x18
movzx eax, al
imul ecx, r11d, 0x1000193
xor ecx, eax
mov rax, rbx
shr rax, 0x20
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, rbx
shr rax, 0x28
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, rbx
shr rax, 0x30
movzx eax, al
imul edx, ecx, 0x1000193
shr rbx, 0x38
xor edx, eax
imul eax, edx, 0x1000193
xor eax, ebx
imul ecx, eax, 0x1000193
movzx eax, r8b
xor eax, ecx
imul ecx, eax, 0x1000193
mov rax, r8
shr rax, 8
movzx eax, al
xor ecx, eax
mov rax, r8
shr rax, 0x10
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x18
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x20
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x28
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x30
movzx eax, al
imul edx, ecx, 0x1000193
shr r8, 0x38
xor edx, eax
imul eax, edx, 0x1000193
xor eax, r8d
mov r8, qword [rsi]
imul ecx, eax, 0x1000193
movzx eax, dil
xor eax, ecx
imul ecx, eax, 0x1000193
shr edi, 8
movzx eax, dil
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, r8b
xor ecx, eax
mov rax, r8
shr rax, 8
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x18
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x20
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x28
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x30
movzx eax, al
imul ecx, edx, 0x1000193
shr r8, 0x38
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, r8d
mov r8, qword [rsi + 8]
imul ecx, eax, 0x1000193
movzx eax, r8b
xor eax, ecx
imul ecx, eax, 0x1000193
mov rax, r8
shr rax, 8
movzx eax, al
xor ecx, eax
mov rax, r8
shr rax, 0x10
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x18
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x20
movzx eax, al
imul edx, ecx, 0x1000193
xor edx, eax
mov rax, r8
shr rax, 0x28
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov rax, r8
shr rax, 0x30
movzx eax, al
imul edx, ecx, 0x1000193
shr r8, 0x38
movzx ecx, r9b
xor edx, eax
imul eax, edx, 0x1000193
xor eax, r8d
imul eax, eax, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
shr r9d, 8
movzx eax, r9b
mov rbx, qword [rsp + 8]
xor edx, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
imul eax, edx, 0x1000193
ret
Function at 0x140033050
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp dword [rcx + 0x220], 0x100
mov rdi, rdx
mov ebp, dword [rcx + 0x270]
mov rbx, rcx
jne 0x14003314f
mov rdi, qword [rcx + 0x300]
cmp rdi, 1
jge 0x140033137
xor r8d, r8d
mov qword [rsp + 0x48], 0
mov esi, 2
mov ecx, esi
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400330d6
lea rdx, str.redis:_socket___failed_to_create_socket_n
xor ecx, ecx
call fcn.14004d730
lea ecx, [rsi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rbx + 0x2d8]
call qword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [rbx + 0x2f0]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x40], si
lea rdx, [rsp + 0x40]
mov word [rsp + 0x42], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140033130
lea rdx, str.redis:_connect___failed_n
xor ecx, ecx
call fcn.14004d730
lea rcx, str.connect
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov qword [rbx + 0x300], rdi
mov rax, qword [rbx + 0x218]
mov rdx, rdi
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, rdi
jmp 0x140033214
cmp byte [rdx], 0x2d
jne 0x14003316e
cmp byte [rdx + 1], 0
jne 0x14003316e
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test rax, rax
jne 0x140033245
and ebp, 0x80
mov qword [rsp + 0x30], 0
mov eax, ebp
mov dword [rsp + 0x28], pe_nt_image_headers64
neg eax
mov esi, 2
mov rcx, rdi
mov dword [rsp + 0x20], esi
sbb edx, edx
xor r9d, r9d
and edx, 4
bts edx, 0x1e
lea r8d, [rsi + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1400331d1
mov edx, 0x140
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open_osfhandle]
cmp eax, 0xffffffff
jne 0x140033231
lea rcx, [0x140056828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea rax, str.appending
test ebp, ebp
lea rbx, str.writing
mov ecx, esi
cmovne rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.out:_could_not_open_file_for__s_n
mov rcx, rax
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor eax, eax
mov dword [0x14006d728], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004da00
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x140056838]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x1400331d1
or dword [rbx + 0x230], 1
jmp 0x140033214
Function at 0x140036fb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, 0x558
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140037007
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov r8d, 0x558
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
and dword [rbx + 8], 0xfffffffe
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x14003705c
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [str.ssl_oids]
movsd qword [rax], xmm0
movzx eax, byte [0x14005ef38]
mov qword [rsp + 0x168], rsi
xor esi, esi
mov byte [rcx + 8], al
cmp qword [str.selftest], rsi
mov qword [0x14016e218], rbx
je 0x1400371d7
mov qword [rsp + 0x160], rbp
lea rbp, str.43.1006.51.341332
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r14
xor r14d, r14d
xor eax, eax
mov rbx, qword [rax + rbp]
xor edi, edi
movzx eax, byte [rbx]
test al, al
je 0x140037183
cmp al, 0x2e
jne 0x1400370d8
nop dword [rax]
inc rbx
cmp byte [rbx], 0x2e
je 0x1400370d0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov r9, qword [rsp + 0x30]
mov r8d, eax
cmp rbx, r9
je 0x140037183
mov rbx, r9
mov ecx, r8d
test r8, 0xfffffffff0000000
je 0x140037110
mov ecx, 4
jmp 0x14003713e
test rcx, 0xffffffffffe00000
je 0x140037120
mov ecx, 3
jmp 0x14003713e
test rcx, 0xffffffffffffc000
je 0x140037130
mov ecx, 2
jmp 0x14003713e
test rcx, 0xffffffffffffff80
je 0x140037162
mov ecx, 1
mov edx, ecx
imul ecx, ecx, 7
cmp rdi, 0x100
jae 0x14003715a
mov eax, r8d
shr eax, cl
or al, 0x80
mov byte [rsp + rdi + 0x40], al
inc rdi
add ecx, 0xfffffff9
add edx, 0xffffffff
jne 0x140037143
cmp rdi, 0x100
jae 0x140037177
and r8b, 0x7f
mov byte [rsp + rdi + 0x40], r8b
inc rdi
movzx eax, byte [r9]
test al, al
jne 0x1400370c5
mov rcx, qword [0x14016e218]
lea rdx, [rsp + 0x40]
mov r9, r14
mov dword [rsp + 0x20], 5
mov r8d, edi
call fcn.14003e620
inc esi
mov r14d, esi
lea rax, [rsi + rsi*2]
lea rax, [rax*8]
cmp qword [rax + rbp + 8], 0
jne 0x1400370b4
mov r14, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x160]
mov rcx, qword [0x14016e218]
call fcn.14003f1f0
mov rsi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004da00
add rsp, 0x150
pop rbx
ret
Function at 0x1400381a0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
sub rsp, 0x28
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov r9, rcx
lea r10, [0x140053c10]
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
movzx eax, byte [rsp]
not rax
mov dword [rsp + 4], 0x6765744c
movzx edx, al
mov dword [rsp + 0xc], 0xf0a577f
movzx ecx, byte [r11 - 0x27]
mov r8d, dword [r10 + rdx*4]
xor r8d, 0xffffff
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 0x26]
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 0x25]
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rax, 0x4c
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
mov eax, r8d
shr r8d, 8
xor rax, 0x74
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
mov eax, r8d
shr r8d, 8
xor rax, 0x65
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
mov eax, r8d
shr r8d, 8
xor rax, 0x67
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
movzx ecx, byte [r11 - 0x20]
mov eax, r8d
xor rcx, rax
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r11 - 0x1f]
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 0x1e]
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 0x1d]
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
xor r8d, dword [r10 + rax*4]
mov eax, r8d
shr r8d, 8
xor rax, 0x7f
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
mov eax, r8d
xor rax, 0x57
movzx ecx, al
shr r8d, 8
lea r11, [r11 - 0x27]
xor r8d, dword [r10 + rcx*4]
sub r11, r9
mov eax, r8d
mov edx, 0x66747032
xor rax, 0xa
shr r8d, 8
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
mov eax, r8d
shr r8d, 8
xor rax, 0xf
movzx ecx, al
xor r8d, dword [r10 + rcx*4]
lea r10, [rsp]
not r8d
sub r10, r9
mov eax, r8d
mov byte [rsp], r8b
shr eax, 0x18
mov byte [rsp + 3], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 2], al
mov eax, r8d
shr eax, 8
mov r8, 0xfffffffffffffffe
mov byte [rsp + 1], al
sub r8, r9
lea rax, [r9 + 2]
nop dword [rax]
lea rcx, [r8 + rax]
cmp rcx, 0x10
jae 0x1400383aa
movzx ecx, dl
xor cl, byte [r10 + rax - 2]
mov byte [rax - 2], cl
mov ecx, edx
shr ecx, 8
xor cl, byte [r11 + rax - 2]
mov byte [rax - 1], cl
mov ecx, edx
shr ecx, 0x10
xor cl, byte [rax + r10]
mov byte [rax], cl
mov ecx, edx
shr ecx, 0x18
xor cl, byte [rax + r11]
mov byte [rax + 1], cl
add rax, 4
ror edx, 0x1f
lea rcx, [r8 + rax]
cmp rcx, 0x10
jb 0x140038360
mov eax, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14004da00
add rsp, 0x28
ret
Function at 0x140039160
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, rcx
mov dword [rsp + 0x30], 0x2c0
mov r14, rdx
mov ecx, 1
movzx eax, byte [rsi]
test al, al
je 0x1400391be
mov r8, rsi
xor edx, edx
nop
sub al, 0x30
lea r8, [r8 + 1]
cmp al, 9
movzx eax, byte [r8]
cmova ecx, edx
test al, al
jne 0x140039190
test ecx, ecx
je 0x1400391be
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call fcn.14003a940
test rax, rax
cmovne rsi, rax
mov ecx, 0x2c0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400391fd
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140001010
lea eax, [rbx + 0xe]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov edi, eax
cmp eax, 0x6f
jne 0x140039247
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140039272
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov edi, eax
cmp eax, 0x6f
je 0x140039217
test edi, edi
je 0x140039296
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.if:_GetAdaptersInfo_failed_with_error:__u_n
mov rcx, rax
call fcn.140001010
mov eax, select
jmp 0x140039327
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140001010
mov eax, select
jmp 0x140039327
mov r9, rbx
movabs r10, 0x5c6563697665445c
lea rax, [r9 + 0xc]
mov r8, rsi
cmp qword [rax], r10
jne 0x1400392bc
cmp dword [rax + 8], 0x5f46504e
jne 0x1400392bc
add rax, 0xc
cmp qword [rsi], r10
jne 0x1400392ce
cmp dword [rsi + 8], 0x5f46504e
jne 0x1400392ce
lea r8, [rsi + 0xc]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400392e4
inc rax
test ecx, ecx
jne 0x1400392d1
test edx, edx
je 0x1400392f2
mov r9, qword [r9]
test r9, r9
jne 0x1400392a3
jmp 0x14003931c
test r9, r9
je 0x14003931c
cmp dword [r9 + 0x194], 6
jne 0x140039268
mov eax, dword [r9 + 0x198]
mov dword [r14], eax
movzx eax, word [r9 + 0x19c]
mov word [r14 + 4], ax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003a300
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [0x14005f430]
movzx eax, byte [0x14005f448]
lea rdx, [0x14005f44c]
mov rdi, rcx
mov byte [rsp + 0x38], al
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x14005f440]
movsd qword [rsp + 0x30], xmm0
mov word [rsp + 0x34], 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x14003a385
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Could_not_open_capture_file_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor eax, eax
jmp 0x14003a43b
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rsi
lea r8d, [rdx + 0x17]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x18
je 0x14003a3d2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Could_not_write_capture_file_header_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x14003a43b
mov ecx, 0x150
mov qword [rsp + 0x68], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14003a3f4
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov r8d, 0x150
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x1c]
mov r9, rdi
lea r8, [0x1400550f4]
mov edx, pe_nt_image_headers64
call fcn.140039520
mov rax, rbx
mov qword [rbx], rsi
mov dword [rbx + 0x11c], 2
mov dword [rbx + 0x120], 1
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004da00
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14003de30
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
sub rsp, 0x48
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0
mov rbp, rcx
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x20]
xor r9d, r9d
movups xmmword [rsp + 0x20], xmm0
mov rbx, rdx
movups xmmword [rsp + 0x30], xmm0
call fcn.140009fb0
cmp dword [rsp + 0x70], 0
je 0x14003de88
mov r8, rbx
lea rdx, str.SCRIPTING:_invalid_setTcpPorts_range:__s_n
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x14003def8
mov qword [rsp + 0x60], rsi
mov esi, ecx
mov qword [rsp + 0x68], rdi
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x40], r14
add rdi, 4
lea r14, str.scripting
mov ebx, dword [rdi - 4]
cmp ebx, dword [rdi]
ja 0x14003dedf
nop dword [rax + rax]
mov r8d, ebx
lea rdx, str.SCRIPTING:_using_port__d_n
xor ecx, ecx
call fcn.14004d730
movsxd rax, ebx
inc ebx
mov qword [rbp + rax*8 + 0x38], r14
cmp ebx, dword [rdi]
jbe 0x14003dec0
add rdi, 8
sub rsi, 1
jne 0x14003deb1
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x14003e120
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x1650]
mov rsi, rcx
test rdi, rdi
je 0x14003e306
cmp byte [rdi], 0
je 0x14003e306
mov qword [rsp + 0x40], rbx
call fcn.140046740
xor ecx, ecx
call qword [0x1401723e0]
lea rdx, str.Lua_version___d_n
mov ecx, 1
cvttsd2si ebx, qword [rax]
mov r8d, ebx
call fcn.14004d730
lea eax, [rbx - 0x1f6]
cmp eax, 1
jbe 0x14003e195
lea rdx, str.Unable_to_load_Lua_library_n
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [0x1401723d8]
mov rcx, rax
mov rbx, rax
call qword [0x1401723f0]
lea rdx, str.Masscan_Class
mov qword [rsi + 0x1658], rbx
mov rcx, rbx
call qword [0x140172438]
mov edx, 0xffffffff
mov rcx, rbx
call qword [0x140172440]
lea r8, str.__index
mov edx, 0xfffffffe
mov rcx, rbx
call qword [0x140172400]
xor r8d, r8d
lea rdx, str.setconfig
mov rcx, rbx
call qword [0x140172410]
mov edx, 0xfffffffe
mov rcx, rbx
call qword [0x140172430]
mov edx, 8
mov rcx, rbx
call qword [0x140172418]
lea rdx, str.Masscan_Class
mov rcx, rbx
mov qword [rax], rsi
call qword [0x140172408]
lea rdx, str.Masscan
mov rcx, rbx
call qword [0x140172420]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [0x1401723d0]
test eax, eax
je 0x14003e288
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 - 1]
call qword [0x140172460]
mov r9, rdi
lea r8, str.SCRIPTING:
lea rdx, str._s_error_loading:__s:__s_n
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.14004d730
mov rcx, rbx
call qword [0x1401723e8]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9, rdi
lea r8, str.SCRIPTING:
lea rdx, str._s_running_script:__s_n
mov ecx, 1
call fcn.14004d730
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [0x1401723c8]
test eax, eax
je 0x14003e327
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 - 1]
call qword [0x140172460]
mov r9, rdi
lea r8, str.SCRIPTING:
lea rdx, str._s_error_running:__s:__s_n
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.14004d730
mov rcx, rbx
call qword [0x1401723e8]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, str.SCRIPTING
xor ecx, ecx
lea rdx, str._s:_no_script_specified__use___script_option_n
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003e430
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rcx + 8]
mov r12, rcx
mov rsi, qword [rcx]
mov rdi, rdx
mov r14d, r8d
lea ecx, [rbx + r14]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x14003e498
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
call fcn.140001010
lea ecx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x40], rbp
test ebx, ebx
je 0x14003e4c1
mov r8, rsi
mov rcx, r15
sub r8, r15
mov rdx, rbx
nop dword [rax]
mov rax, qword [r8 + rcx]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14003e4b0
mov ebp, ebx
test r14d, r14d
je 0x14003e501
mov r8, r14
nop dword [rax + rax]
xor eax, eax
test ebx, ebx
je 0x14003e4ec
mov rdx, qword [rdi]
nop dword [rax]
cmp qword [rsi + rax*8], rdx
je 0x14003e4f7
inc eax
cmp eax, ebx
jb 0x14003e4e0
mov rax, qword [rdi]
mov ecx, ebp
inc ebp
mov qword [r15 + rcx*8], rax
add rdi, 8
sub r8, 1
jne 0x14003e4d0
mov rcx, qword [r12]
test rcx, rcx
je 0x14003e510
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov dword [r12 + 8], ebp
mov rbp, qword [rsp + 0x40]
mov qword [r12], r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret