joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c270
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
jne 0x14006c2a3
movzx eax, byte [rsp + 0x20]
jmp 0x14006c37b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp qword [rsp + 0x30], 0
je 0x14006c329
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x68]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 0x68], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xbc]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0xbc], eax
mov byte [rsp + 0x20], 1
jmp 0x14006c34f
cmp qword [rsp + 0x28], 0
je 0x14006c34f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xbc]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0xbc], eax
mov byte [rsp + 0x20], 1
jmp 0x14006c36b
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x70
pop rdi
ret
Function at 0x14006c4c0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x48], 0xc0000001
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x20]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14006c524
xor al, al
jmp 0x14006c6f0
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.140024a10
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jl 0x14006c6b2
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
jmp 0x14006c580
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
test rax, rax
je 0x14006c6b2
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x50]
call fcn.140029000
cmp rax, qword [rsp + 0x80]
jne 0x14006c6ad
mov qword [rsp + 0x50], 0
jmp 0x14006c5c4
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x50], rax
jae 0x14006c6ad
mov qword [rsp + 0x40], 0
imul rax, qword [rsp + 0x50], 0x50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
jl 0x14006c6a8
call fcn.140061760
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax]
and eax, 0x20
test eax, eax
je 0x14006c695
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.140062430
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14006c695
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x89], 1
call fcn.140061760
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
and eax, 0xffffffdf
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
cmp qword [rsp + 0x28], 0
je 0x14006c686
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x14006c6f0
cmp qword [rsp + 0x40], 0
je 0x14006c6a8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006c5b7
jmp 0x14006c569
jmp 0x14006c6d9
cmp qword [rsp + 0x28], 0
je 0x14006c6ee
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor al, al
add rsp, 0x78
ret
Function at 0x14006c700
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x28], 0xc0000001
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x24]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14006c76a
movzx eax, byte [rsp + 0x20]
jmp 0x14006c95b
mov eax, dword [rsp + 0x24]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140024a10
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006c91a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x14006c7c6
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
test rax, rax
je 0x14006c91a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call fcn.140029000
cmp rax, qword [rsp + 0x90]
jne 0x14006c915
mov qword [rsp + 0x50], 0
jmp 0x14006c80a
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x50], rax
jae 0x14006c913
mov qword [rsp + 0x40], 0
imul rax, qword [rsp + 0x50], 0x50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006c859
mov dword [rsp + 0x38], 1
jmp 0x14006c861
mov dword [rsp + 0x38], 0
cmp dword [rsp + 0x38], 1
jne 0x14006c90e
call fcn.140061760
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax]
and eax, 4
test eax, eax
je 0x14006c8dc
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
call fcn.140062430
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14006c8b3
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x88], 1
call fcn.140061760
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
and eax, 0xfffffffb
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
jmp 0x14006c903
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006c7fd
jmp 0x14006c91a
jmp 0x14006c7af
jmp 0x14006c941
cmp qword [rsp + 0x70], 0
je 0x14006c956
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movzx eax, byte [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x14006cd60
Capabilities:
Attach user process memory

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
jne 0x14006cd97
movzx eax, byte [rsp + 0x20]
jmp 0x14006ce65
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp qword [rsp + 0x30], 0
je 0x14006ce11
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov byte [rsp + 0x20], 1
jmp 0x14006ce2e
cmp qword [rsp + 0x28], 0
je 0x14006ce2e
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov byte [rsp + 0x20], 1
jmp 0x14006ce55
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x70
pop rdi
ret

Function at 0x1400f5a90
Capabilities:
Encode data using xor

Disassembly:
je 0x140194372
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.140241757
or byte [rcx + rbp*4], dl
xor al, 0x8f
imul ebx, dword [rax + 0x11], 0xffffffad
jb 0x1400f5aa5
mov edx, 0x1654ee27
outsd dx, dword [rsi]
movabs al, byte [0xfc8020ca3e35f806]
invalid

Function at 0x1401314d1
Capabilities:
Encode data using xor

Disassembly:
or r9w, 0xb
sub ecx, 0x46b135cd
neg rcx
mov rcx, qword [rsp + 0x10]
sub r9w, r9w
or r9w, 0xf73

Function at 0x14016f198
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0xffffffffcfb72324
push r8
push r9

Function at 0x140173965
Capabilities:
Encode data using xor

Disassembly:
not dword [rsp + 0x10]
lea r15, [r15*2 + 0x2f9a139f]
mov r15, qword [rsp + 0x38]
setae byte [rsp + 0x10]
add qword [rsp + 0x28], 0xffffffffbfefa09f
xor qword [rsp + 0x10], 0x7894590e
sub qword [rsp + 0x10], 0x14c830ff
not byte [rsp + 0x10]
or word [rsp + 0x10], 0x3cf8
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
call fcn.140241757
mov esi, 0xff4033bf
fadd qword [rax + 0x33]
scasb al, byte [rdi]
invalid
Function at 0x180008c40
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180069028]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rcx + 0x58], 0xfffffeff
mov rbx, rcx
sub dword [rcx + 0x7c], 1
mov eax, dword [rcx + 0x58]
jne 0x180008c81
test al, 1
jne 0x180008c81
test al, 0x40
je 0x180008c81
and eax, 0xffffffbf
mov dword [rcx + 0x58], eax
test al, 0x20
je 0x180008c81
mov rax, qword [rcx + 8]
dec dword [rax + 8]
mov eax, dword [rcx + 0x58]
bt eax, 0x11
jae 0x180008cee
bt eax, 0x19
jae 0x180008cd8
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x180008cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180016f60
add rsp, 0x50
pop rbx
ret
bt eax, 0x16
jb 0x180008cee
call fcn.180008d10
test eax, eax
jne 0x180008cf0
or dword [rbx + 0x58], 0x400000
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180016f60
add rsp, 0x50
pop rbx
ret

Function at 0x180008d10
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rdi
sub rsp, 0x78
mov rax, qword [0x180069028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rcx
or edx, 0xffffffff
mov rcx, qword [0x18006cc08]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180008e73
mov eax, 2
mov qword [rsp + 0xa0], rsi
xchg dword [0x18006c904], eax
cmp eax, 1
je 0x180008d7d
mov rcx, qword [0x18006cc08]
lea edx, [rdi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x180008e79
xor eax, eax
jmp 0x180008e57
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x98], rbx
lea rcx, str.conout_
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov qword [rsp + 0x70], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180008ddd
lea rdx, [0x18006cbe8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x180008ddd
lock or dword [0x18006cc00], 1
mov esi, 1
mov dword [rsp + 0x50], 0xd0001
mov r14d, select
mov word [rsp + 0x48], si
mov ecx, r14d
mov dword [rsp + 0x4c], esi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rbp + 0x110]
lea r9, [rsp + 0x40]
mov r8d, esi
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], r14w
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x70]
test eax, eax
jne 0x180008e3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x180008e4d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov eax, edi
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180016f60
add rsp, 0x78
pop rdi
pop rbp
ret
call fcn.180021334
int3
call fcn.180021334
int3
Function at 0x180008f70
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180069028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb8]
mov ebp, r9d
movzx r12d, r8b
mov r15d, edx
mov rsi, rcx
cmp dword [r14], 0
je 0x180008faf
or eax, 0xffffffff
jmp 0x180009136
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r13
movzx r13d, byte [rsp + 0xb0]
nop word [rax + rax]
mov rcx, qword [rsi + 0x110]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x180008fef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
movsx eax, word [rsp + 0x34]
mov ebx, r15d
movsx edx, word [rsp + 0x38]
movsx r9d, word [rsp + 0x28]
sub edx, eax
mov eax, dword [0x180069bf4]
inc edx
mov edi, dword [0x180069be0]
mov r11d, dword [0x180069bf0]
movsx r8d, word [rsp + 0x2e]
mov dword [0x180069be0], r9d
mov dword [0x180069bf0], edx
cmp eax, 0xffffffff
jne 0x180009036
mov eax, r8d
jmp 0x180009042
mov ecx, r8d
sub ecx, edx
inc ecx
cmp eax, ecx
cmovl eax, ecx
movsx r10d, word [rsp + 0x2a]
lea ecx, [rdx + rax]
cmp ecx, r10d
jle 0x180009055
mov eax, r10d
sub eax, edx
test eax, eax
mov r10d, 0
cmovs eax, r10d
mov dword [0x180069bf4], eax
cmp edi, 0xffffffff
je 0x1800090a2
cmp r11d, 0xffffffff
je 0x1800090a2
cmp r9d, edi
jne 0x18000907c
cmp edx, r11d
je 0x1800090a2
mov ecx, 0x1c
call fcn.180005810
movzx r8d, word [rsp + 0x2e]
xor r10d, r10d
mov eax, dword [0x180069bf4]
mov edx, dword [0x180069bf0]
mov r9d, dword [0x180069be0]
test r13b, r13b
je 0x1800090af
movsx ecx, r8w
add ecx, ebp
jmp 0x1800090b2
lea ecx, [rax + rbp]
cmp ecx, eax
jge 0x1800090ba
mov ecx, eax
jmp 0x1800090c7
lea r8d, [rdx + rax]
cmp ecx, r8d
jl 0x1800090c7
lea ecx, [r8 - 1]
test r12b, r12b
je 0x1800090d4
movsx ebx, word [rsp + 0x2c]
add ebx, r15d
test ebx, ebx
jns 0x1800090dd
mov ebx, r10d
jmp 0x1800090e6
cmp ebx, r9d
jl 0x1800090e6
lea ebx, [r9 - 1]
mov word [rsp + 0x22], cx
mov rcx, qword [rsi + 0x110]
mov word [rsp + 0x20], bx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x180009122
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x180008fd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
or eax, 0xffffffff
jmp 0x180009124
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180016f60
add rsp, 0x60
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x180009150
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180069028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x1800091a2
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x1800091aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
or eax, 0xffffffff
jmp 0x18000925c
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x180009249
nop dword [rax]
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x180009249
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x18000923e
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x18000927a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1800091d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180016f60
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x38]
mov dword [0x180069bf4], r14d
call fcn.180008e80
xor eax, eax
jmp 0x180009254
Function at 0x18000c2f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x78
mov rdi, rcx
mov ecx, dword [rcx + 0x150]
mov rbp, qword [rdi + 0x180]
cmp ecx, 0xffffffff
jne 0x18000c328
mov qword [rdi + 0x88], 0xfffffffffffff00d
mov dword [rdi + 0x14c], 6
add rsp, 0x78
pop rdi
pop rbp
ret
mov qword [rsp + 0xa0], rbx
xor ebx, ebx
mov qword [rsp + 0x60], r13
mov r13d, ebx
mov qword [rsp + 0x50], r15
call fcn.18001c14c
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18000c36e
lea ecx, [rbx + 6]
mov dword [rdi + 0x14c], 6
call fcn.180011510
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
jmp 0x18000c47d
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x58], r14
cmp rbp, 0xffffffffffffffff
je 0x18000c3c2
xor eax, eax
lea r8, [rsp + 0x98]
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea r12, [rsp + 0x30]
lea r9d, [rax + 1]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000c3c5
mov r13d, 1
jmp 0x18000c3c5
mov r12, rbx
mov esi, ebx
cmp rbp, 0xffffffffffffffff
je 0x18000c3de
mov eax, esi
add rax, rbp
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
mov rax, qword [rdi + 0x178]
lea r9, [rsp + 0x90]
mov ecx, ebx
add rcx, rcx
mov qword [rsp + 0x20], r12
mov r8d, dword [rax + rcx*8]
mov rdx, qword [rax + rcx*8 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [rsp + 0x90]
inc ebx
mov r14d, eax
test eax, eax
je 0x18000c421
cmp ebx, dword [rdi + 0x170]
jb 0x18000c3c7
mov r12, qword [rsp + 0x68]
test r13d, r13d
je 0x18000c442
mov rdx, qword [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test r14d, r14d
mov r14, qword [rsp + 0x58]
jne 0x18000c46f
test esi, esi
jne 0x18000c46f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rdi + 0x14c], eax
call fcn.180011510
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
jmp 0x18000c478
mov eax, esi
mov qword [rdi + 0x88], rax
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop rdi
pop rbp
ret

Function at 0x18000ee30
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rcx, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x18000ee6b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret
Function at 0x18000ee80
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x38], 0x3c
mov rcx, rbx
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x18000eecb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x40
pop rbx
ret
cmp dword [rsp + 0x30], 0
je 0x18000eef6
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8d, [rdx - 3]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18000eebf
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x18000ef00
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x110], 0xffffffffffffffff
mov esi, r9d
mov rdi, r8
mov dword [rsp + 0x50], 1
mov rbx, rdx
mov rbp, rcx
je 0x18000ef3c
mov eax, 0xfffff00e
jmp 0x18000f01e
lea r8, [rsp + 0x50]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x18000ef5f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000f01e
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x18000ef7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000f01e
mov rdx, qword [rbp + 0x38]
xor r9d, r9d
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x18000ef73
mov eax, dword [0x18006cea0]
cmp esi, 0x17
mov r8, qword [0x18006ce18]
cmove eax, dword [0x18006ce9c]
test r8, r8
je 0x18000efdf
test dword [rbx + 0x58], 0x100000
jne 0x18000efdf
test eax, eax
jne 0x18000efdf
mov dl, 3
mov rcx, rdi
call r8
test eax, eax
je 0x18000efd4
or dword [rbx + 0x58], 0x40000
jmp 0x18000efdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x18000ef73
test dword [rbx + 0x58], 0x2000000
je 0x18000eff4
mov rdx, rdi
call fcn.18000ee30
test eax, eax
jne 0x18000f01e
test dword [rbx + 0x58], 0x4000000
je 0x18000f009
mov rdx, rdi
call fcn.18000ee80
test eax, eax
jne 0x18000f01e
mov qword [rbx + 0x110], rdi
cmp esi, 0x17
jne 0x18000f01c
or dword [rbx + 0x58], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f2d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r14
sub rsp, 0x30
cmp qword [rcx + 0x110], 0xffffffffffffffff
mov r14d, r8d
mov rdi, rdx
mov rbx, rcx
jne 0x18000f344
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000f31e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000f3a9
movzx r9d, word [rdi]
mov r8, rsi
mov rcx, qword [rbx + 8]
mov rdx, rbx
call fcn.18000ef00
mov ebp, eax
test eax, eax
je 0x18000f344
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebp
jmp 0x18000f3a9
cmp word [rdi], 0x17
jne 0x18000f375
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x68]
mov edx, 0x29
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
mov r8d, r14d
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x18000f3a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x18000f3a9
mov dword [rbx + 0x118], eax
or dword [rbx + 0x58], 0x200
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret