joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012320
Capabilities:
Get session information

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rbx], eax
cmp eax, 0xffffffff
jne 0x14001235a
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x30]
mov dword [rsp + 0x40], ecx
mov r8d, 0x19
lea rcx, [rsp + 0x40]
mov edx, eax
mov qword [rsp + 0x20], rcx
xor dil, dil
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x1400123ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WTSQuerySessionInformation_fail__lu
lea rcx, [0x140077e88]
call fcn.140004170
jmp 0x14001240c
mov rcx, qword [rsp + 0x30]
cmp dword [rcx + 0xc], 0
jne 0x140012401
lea rbx, [rcx + 0x56]
test rbx, rbx
je 0x140012401
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1400123fc
lea r9, [rsp + 0x38]
mov r8d, 1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x1400123fc
mov rcx, qword [rsp + 0x38]
cmp dword [rcx + 0x14], 2
sete dil
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001240c
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
movzx eax, dil
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
Function at 0x140013600
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140026cc0
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.140026cc0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140013650
test rax, rax
je 0x14001371d
cmp word [rsp + rax*2 + 0x1e], 0x5c
lea rcx, [0x140064120]
lea rdx, [0x140064100]
mov r8, rbx
cmove rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140001d70
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.1400261e0
mov rbx, rax
test rax, rax
je 0x140013716
nop
lea rax, [rsp + 0x20]
mov r9, rbx
sub r9, rax
lea r8, [rsp + 0x20]
sar r9, 1
lea rcx, [rsp + 0x230]
inc r9
mov edx, 0x104
call fcn.14002f15c
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400136df
test al, 0x10
jne 0x140013700
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140013700
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001371d
mov edx, 0x5c
lea rcx, [rbx + 2]
call fcn.1400261e0
mov rbx, rax
test rax, rax
jne 0x1400136a0
mov eax, 1
jmp 0x14001371f
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x450
pop rbx
ret

Function at 0x140013910
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x38], 0x208
mov rsi, r9
mov qword [rsp + 0x30], rbx
mov rdi, r8
mov dword [rsp + 0x3c], ebx
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140013983
cmp eax, 2
jne 0x14001396b
xor eax, eax
jmp 0x1400139d6
mov r8d, eax
lea rdx, str.RegOpenKeyEx_error
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x1400139d4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400139c4
mov r8d, eax
lea rdx, str.RegQueryValueEx_error
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x1400139c9
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400139f0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
lea rax, [rsp + 0x30]
mov rdi, r8
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlcfgAdll
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140013a5d
cmp eax, 2
jne 0x140013a45
xor eax, eax
jmp 0x140013a99
mov r8d, eax
lea rdx, str.RegOpenKeyEx_error
lea rcx, [0x140077e88]
call fcn.140004170
jmp 0x140013a97
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140013a87
mov r8d, eax
lea rdx, str.RegDeleteValue_error
lea rcx, [0x140077e88]
call fcn.140004170
jmp 0x140013a8c
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140013ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x30], rax
lea rdx, str.SYSTEMCurrentControlSetControlcfgAdll
mov dword [rsp + 0x38], eax
mov rbx, r8
mov dword [rsp + 0x40], eax
mov r9d, 1
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140013b4f
cmp eax, 2
jne 0x140013b37
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
mov r8d, eax
lea rdx, str.RegOpenKeyEx_error
lea rcx, [0x140077e88]
call fcn.140004170
jmp 0x140013bac
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [0x140077e88]
test eax, eax
je 0x140013b90
mov r8d, eax
lea rdx, str.RegQueryValueEx_error
jmp 0x140013b9c
mov r8d, dword [rsp + 0x38]
lea rdx, str.dwUiResult_lu
call fcn.1400042c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
Function at 0x140013bd0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013c34
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rbx
test eax, eax
jne 0x140013c4e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x50
pop rbx
ret
Function at 0x140013fa0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0xe0]
mov rdi, rdx
mov rsi, qword [rsp + 0xf0]
xor edx, edx
mov ebp, r8d
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.140026cc0
xor eax, eax
mov dword [rsp + 0x20], WSAStartup
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140014045
lea rdx, str.ShellExecuteEx_fail
lea rcx, [0x140077e88]
call fcn.140004ef0
xor eax, eax
jmp 0x140014081
test ebp, ebp
je 0x14001407c
mov rcx, qword [rsp + 0x88]
mov edx, 0xffffffff
mov byte [rsi], 0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001406b
mov byte [rsi], 1
jmp 0x14001407c
mov rcx, qword [rsp + 0x88]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140023e40
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140016e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140016ea5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140016ea5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140016e95
nop
cmp rbx, rcx
jae 0x140016ea5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140016e80
cmp rbx, rcx
jae 0x140016ea5
cmp word [rbx], 0
je 0x140016ea5
mov rax, rbx
jmp 0x140016ea7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140019070
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x890
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140026cc0
lea rbx, [0x140076d00]
mov edx, 0x104
lea r9, [0x140076af0]
mov qword [rsp + 0x20], rbx
lea r8, str._s_s.zip
lea rcx, [rsp + 0x40]
call fcn.1400012b0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400190e9
test al, 0x10
jne 0x1400190e9
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.140026cc0
lea r9, [0x140076af0]
mov qword [rsp + 0x20], rbx
lea r8, str._s_s.zip
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.1400012b0
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x208
call fcn.140026cc0
lea rax, [0x140077330]
mov edx, 0x104
lea r9, str.liveupdate01s.asus.com
mov qword [rsp + 0x20], rax
lea r8, str.https:___s__s
lea rcx, [rsp + 0x460]
call fcn.1400012b0
lea rcx, [0x140077750]
call fcn.14002f0b8
mov edx, eax
lea rcx, [0x140077750]
mov eax, 0x51eb851f
mov edi, 1
imul edx
mov ebx, edx
sar ebx, 5
mov edx, ebx
shr edx, 0x1f
add ebx, edx
cmove ebx, edi
call fcn.14002f0b8
mov r9d, eax
lea rcx, [rsp + 0x460]
mov eax, 0x51eb851f
mov r8d, ebx
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
lea rdx, [rsp + 0x250]
sub r9d, eax
call fcn.140010010
xor edx, edx
mov qword [rsp + 0x30], rax
mov r8d, 0x208
lea rcx, [rsp + 0x670]
mov rbx, rax
mov dword [rax + 0x868], edi
call fcn.140026cc0
mov eax, dword [rbx + 0x860]
test eax, eax
jne 0x14001920f
mov qword [rbx + 0x888], 0xf
mov qword [rbx + 0x890], 0x64
cmp eax, edi
jne 0x140019228
lea rdx, str.file_is_already_has_used
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x140019232
mov dword [rbx + 0x8dc], 0x3e8
cmp dword [rbx + 0x860], edi
jne 0x14001924f
lea rdx, str.file_is_already_has_used
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x140019259
mov dword [rbx + 0x8e0], 0x3e8
mov rdx, rbx
call fcn.14000dfe0
movzx edi, al
cmp al, 1
jne 0x14001927d
lea r9, [rsp + 0x670]
mov rdx, rbx
lea r8, [rsp + 0x38]
call fcn.14000d1c0
lea rdx, [rsp + 0x30]
call fcn.14000ddb0
xor eax, eax
cmp dil, 1
sete al
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x8a0]
add rsp, 0x890
pop rdi
ret
Function at 0x14001a100
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001a12d
xor eax, eax
jmp 0x14001a273
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001a167
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001a167
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14001a273
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001a266
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001a1aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001a1b9
movsx ecx, dil
jmp 0x14001a20d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x14001a266
cmp eax, 1
jle 0x14001a227
cmp eax, 3
jne 0x14001a266
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14003100c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001a26b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001a254
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140030c18
cmp rsi, rax
jne 0x14001a266
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001a26b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001bcc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x520], rbx
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x30], rcx
mov rbx, qword [rdx + 0x10]
mov rbp, rbx
shr rbp, 4
lea r14d, [rbp + 1]
shl r14d, 4
mov dword [rsp + 0x30], r14d
movsxd rsi, r14d
inc rsi
mov rcx, rsi
call fcn.140024144
mov r15, rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140026cc0
cmp qword [rdi + 0x18], 0x10
jb 0x14001bd41
mov rdi, qword [rdi]
mov rcx, r15
sub rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx + rdi], al
inc rdi
test al, al
jne 0x14001bd50
and ebx, 0xf
mov edx, reloc.WS2_32.dll_recv
sub edx, ebx
test edx, edx
jle 0x14001bd82
movsxd rax, ebp
shl rax, 4
mov edi, ebx
add rax, r15
add rdi, rax
mov ecx, edx
movsx rax, dl
rep stosb byte [rdi], al
movsxd r14, r14d
mov byte [r14 + r15], 0
mov rcx, rsi
call fcn.140024144
mov r12, rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140026cc0
lea rax, vtable.AES.0
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
xor ebx, ebx
mov qword [rsp + 0x40c], rbx
mov dword [rsp + 0x414], ebx
lea rcx, [rsp + 0x40]
call fcn.140016100
movzx edi, byte [rsp + 0x48]
test dil, dil
je 0x14001bea1
test r14, r14
je 0x14001bea1
movsxd r8, dword [rsp + 0x410]
xor edx, edx
mov rax, r14
div r8
test rdx, rdx
jne 0x14001bea1
mov ebp, ebx
mov rbx, r15
mov rsi, r12
test rax, rax
je 0x14001bea1
nop
lea rax, [rsp + 0x438]
test dil, dil
je 0x14001be47
xor edx, edx
test r8d, r8d
jle 0x14001be47
lea rcx, [rsp + 0x438]
mov rdi, rbx
sub rdi, rcx
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
lea rax, [rax + 1]
inc edx
cmp edx, dword [rsp + 0x410]
jl 0x14001be32
mov r8, rsi
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x40]
call fcn.140015a30
movsxd r8, dword [rsp + 0x410]
mov rdx, rsi
lea rcx, [rsp + 0x438]
call fcn.140026770
movsxd r8, dword [rsp + 0x410]
add rbx, r8
add rsi, r8
inc ebp
xor edx, edx
mov rax, r14
div r8
mov rcx, rax
movsxd rax, ebp
cmp rax, rcx
jae 0x14001bea1
movzx edi, byte [rsp + 0x48]
jmp 0x14001be10
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, r13
call fcn.1400108f0
mov rcx, r15
call fcn.140023e64
mov rcx, r12
call fcn.140023e64
nop
mov rax, r13
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x520]
add rsp, 0x4d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d0e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rdi
sub rsp, 0x220
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rdi, rcx
mov qword [rsp + 0x20], 0
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14001d13b
mov r8d, eax
lea rdx, str.WSAStartup_failed_with_error:__d_n
lea rcx, [0x140077e88]
call fcn.1400042c0
mov eax, 1
jmp 0x14001d31d
xor eax, eax
mov dword [rsp + 0x2c], 2
xorps xmm0, xmm0
mov qword [rsp + 0x200], rax
xorps xmm1, xmm1
mov word [rsp + 0x208], ax
mov r8d, 0x4d4
mov dword [rsp + 0x30], 1
lea rdx, [0x14005fe64]
mov dword [rsp + 0x34], 6
lea rcx, [rsp + 0x200]
mov dword [rsp + 0x28], 1
movdqu xmmword [rsp + 0x38], xmm0
movdqu xmmword [rsp + 0x48], xmm1
call fcn.1400054a0
lea r9, [rsp + 0x20]
xor ecx, ecx
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x200]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14001d1dd
mov r8d, eax
lea rdx, str.getaddrinfo_failed_with_error:__d_n
lea rcx, [0x140077e88]
call fcn.1400042c0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x14001d31d
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x238], rbx
mov r8d, dword [rax + 0xc]
mov edx, dword [rax + 8]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001d238
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socket_failed_with_error:__ld
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [rbx + 2]
jmp 0x14001d315
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14001d2b1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2740
jne 0x14001d277
lea rdx, str.socket_address_is_alreay_use
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x14001d293
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.bind_failed_with_error:__d
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
jmp 0x14001d315
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov edx, 0x7fffffff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x14001d301
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.listen_failed_with_error:__d_n
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x14001d315
mov dword [rdi + 0x420], 0xbb8
xor eax, eax
mov byte [rdi + 0x18], 1
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x220
pop rdi
ret
Function at 0x14001d340
Capabilities:
Create thread
Set socket configuration

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x10]
lea rdx, str.Wait_client_enter
mov rdi, rcx
lea rcx, [0x140077e88]
call fcn.1400042c0
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
cmp byte [rdi + 8], 0
mov rbx, rax
jne 0x14001d527
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
xor r14d, r14d
nop word [rax + rax]
lea rdx, str.Ready_client_enter
lea rcx, [0x140077e88]
call fcn.1400042c0
cmp rbx, 0xffffffffffffffff
jne 0x14001d3d9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.Accept_failed_with_error:__d_n
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x927c0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rdi + 0x420], r14d
jle 0x14001d46d
lea r9, [rdi + 0x420]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14001d437
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Set_send_timeout_fail__lu
mov r8d, eax
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14001d4ef
lea r9, [rdi + 0x420]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14001d46d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.set_recv_timeout_fail__lu
jmp 0x14001d41a
mov ecx, 0x18
call fcn.140024108
mov qword [rsp + 0x50], rax
lea rcx, [rdi + 0x20]
mov rdx, r14
mov byte [rax], r14b
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
nop
cmp qword [rcx], r14
je 0x14001d4c3
inc rdx
add rcx, 8
cmp rdx, 0x80
jl 0x14001d490
lea rdx, str.connect_is_max_limit
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14001d4ef
mov qword [rdi + rdx*8 + 0x20], rax
lea r8, [0x14001c240]
xor edx, edx
mov qword [rsp + 0x28], r14
mov r9, rax
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Wait_client_enter
lea rcx, [0x140077e88]
call fcn.1400042c0
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
cmp byte [rdi + 8], r14b
je 0x14001d390
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
lea rdx, str.Stop_socket
lea rcx, [0x140077e88]
call fcn.1400042c0
xor eax, eax
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret