joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140156e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa8]
mov r15, rcx
mov rbx, rdx
mov r13, r8
mov rsi, r9
cmp rdx, 2
jbe 0x140156f90
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x1401570c0
cmp ax, 0x2f
je 0x140157018
cmp word [rcx + 2], 0x3a
je 0x140157100
nop dword [rax + rax]
lea rcx, [rsi + rbp + 4]
add rcx, r14
add rcx, rbx
add rcx, rcx
call fcn.1401419c0
mov rdx, qword [rsp + 0xa0]
mov r8, r14
mov r12, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
lea rdi, [r12 + r14*2]
test r14, r14
jne 0x14015704f
mov rcx, rdi
mov r8, rbx
lea rdi, [rdi + rbx*2]
mov rdx, r15
call sub.msvcrt.dll_wcsncpy
test rbx, rbx
jne 0x140157090
mov r8, rsi
mov rdx, r13
lea rbx, [rdi + rsi*2]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
test rbp, rbp
je 0x140156f58
test rsi, rsi
jne 0x140156ff8
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
mov r8, rbp
lea rbx, [rbx + rbp*2]
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, r12
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140157080
test al, 0x10
jne 0x140157080
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x140156ed0
movzx eax, word [rcx]
cmp ax, 0x2f
je 0x140157018
cmp ax, 0x5c
je 0x140157018
cmp rdx, 2
jne 0x140156ed0
cmp word [rcx + 2], 0x3a
jne 0x140156ed0
cmp r14, 1
jbe 0x1401570cb
mov rcx, qword [rsp + 0xa0]
mov r8d, 2
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1401570cb
add r15, 4
sub rbx, 2
lea rdi, [r14 + r14]
jmp 0x140157023
cmp word [rbx - 2], 0x2e
je 0x140156f41
mov edx, 0x2e
add rbx, 2
mov word [rbx - 2], dx
jmp 0x140156f41
mov edi, 4
mov r14d, 2
lea rcx, [rsi + rbp + 4]
add rcx, rbx
add rcx, r14
add rcx, rcx
call fcn.1401419c0
mov rdx, qword [rsp + 0xa0]
mov r8, r14
mov r12, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
add rdi, r12
movzx edx, word [rdi - 2]
lea rcx, [0x1404726f0]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x140156f06
mov r8d, 0x5c
add rdi, 2
mov word [rdi - 2], r8w
jmp 0x140156f06
mov rcx, r12
xor r12d, r12d
call fcn.1401419e0
jmp 0x140156f77
movzx edx, word [rdi - 2]
lea rcx, [0x1404726f0]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x140156f21
mov ecx, 0x5c
add rdi, 2
mov word [rdi - 2], cx
jmp 0x140156f21
cmp word [rcx + 2], 0x5c
jne 0x140157018
lea rcx, [rsi + rbp + 4]
add rcx, rbx
add rcx, rcx
call fcn.1401419c0
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rdi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov r12, rdi
jmp 0x140156f06
movzx eax, word [r15 + 4]
cmp ax, 0x2f
je 0x1401570cb
cmp ax, 0x5c
jne 0x140156fbd
jmp 0x1401570cb
Function at 0x140157210
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
mov r12, rcx
mov ebx, edx
cmp edx, 0x1c
ja 0x1401572f0
cmp edx, 2
je 0x14015726f
jg 0x140157260
mov eax, 0xfffff02a
test edx, edx
jne 0x140157256
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1401572b0
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, ebx
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
cmp edx, 9
je 0x14015726f
mov eax, 0xfffff02a
cmp edx, 0xf
jne 0x140157256
mov edx, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x140157256
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp eax, 5
je 0x1401572c0
mov ecx, r13d
call fcn.140146240
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140146240
jmp 0x140157256
lea rdx, [rsp + 0x2c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140157295
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x140157256
jmp 0x140157295
mov eax, 0xfffff019
jmp 0x140157256
Function at 0x140159dc0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x140159e30
test ah, 0x80
je 0x140159e40
mov eax, dword [rcx + 0x10]
cmp eax, 0xc
je 0x140159e10
cmp eax, 0xe
je 0x140159e20
mov r8d, 0xfffff008
cmp eax, 7
je 0x140159e08
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x140472d71]
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0xfffff02a
mov eax, r8d
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x14015bde0
add rsp, 0x28
jmp 0x140162b10
mov r8d, 0xfffff00d
jmp 0x140159e08
mov r8d, 0xfffff031
jmp 0x140159e08
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x14015be48
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov r8d, eax
mov eax, dword [rsp + 0x4c]
cmp r8d, 0xffffffff
je 0x14015be30
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140146240
add rsp, 0x58
ret
mov eax, 0xfffff008
jmp 0x14015be27
push r13
push r12
sub rsp, 0x38
mov eax, dword [rcx + 0x100]
mov r12, rdx
mov r13d, r8d
test eax, eax
jne 0x140162b68
lea r9, [rsp + 0x2c]
call fcn.14015eed0
test eax, eax
jne 0x140162b50
mov edx, r13d
mov rcx, r12
call fcn.1401441d0
add rsp, 0x38
pop r12
pop r13
ret
mov ecx, dword [rsp + 0x2c]
call fcn.140146240
add rsp, 0x38
pop r12
pop r13
ret
mov eax, 0xfffff008
jmp 0x140162b41
Function at 0x14015a840
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x58], edx
mov r12, rcx
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x60], r8d
mov r8d, 8
mov dword [rsp + 0x20], 4
call rbx
cmp eax, 0xffffffff
je 0x14015a8b2
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x14015a890
xor eax, eax
add rsp, 0x38
pop rbx
pop r12
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov edx, 6
mov rcx, r12
mov r8d, 3
call rbx
cmp eax, 0xffffffff
jne 0x14015a881
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop r12
ret

Function at 0x14015a8c0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [rdx + 0x110], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
mov dword [rsp + 0x48], 1
jne 0x14015aad0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14015a9b0
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14015a9a0
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x14015a9c0
mov edx, dword [rsi + 0x58]
mov eax, edx
and eax, 0x80000
cmp edi, 0x17
je 0x14015a9e5
mov rcx, qword [0x1404c90c0]
mov ecx, dword [rcx]
or ecx, eax
je 0x14015aaa0
test edx, 0x1000000
jne 0x14015aa20
test edx, 0x2000000
jne 0x14015aa61
mov qword [rsi + 0x110], rbx
cmp edi, 0x17
je 0x14015aa88
xor eax, eax
and edx, 0x400000
jne 0x14015a9f8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x14015a9a0
mov edx, dword [rsi + 0x58]
mov eax, 0x80000
or edx, 0x80000
mov dword [rsi + 0x58], edx
cmp edi, 0x17
jne 0x14015a94e
mov rcx, qword [0x1404c90d0]
mov ecx, dword [rcx]
jmp 0x14015a957
mov dword [rsp + 0x3c], eax
mov r8d, 0x93
lea rdx, str.src_win_tcp.c
lea rcx, [0x140472ec0]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x14015a991
mov dword [rsp + 0x4c], 1
lea r9, [rsp + 0x4c]
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14015aae0
mov edx, dword [rsi + 0x58]
test edx, 0x2000000
je 0x14015a977
mov r8d, 0x3c
mov edx, 1
mov rcx, rbx
call fcn.14015a840
test eax, eax
jne 0x14015a991
mov edx, dword [rsi + 0x58]
jmp 0x14015a977
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x14015a9a0
mov edx, dword [rsi + 0x58]
or edx, 0x20000
mov dword [rsi + 0x58], edx
jmp 0x14015a95f
mov eax, 0xfffff00e
jmp 0x14015a991
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14015a991
jmp 0x14015aa52
Function at 0x14015ab00
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx eax, word [rdx]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov r12, rdx
mov edi, r8d
mov esi, r9d
cmp rcx, 0xffffffffffffffff
je 0x14015ab68
cmp ax, 0x17
je 0x14015abd8
mov r8d, edi
mov rdx, r12
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x14015ac20
or dword [rbx + 0x58], 0x2000
xor r13d, r13d
mov eax, r13d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
test r9b, 1
je 0x14015ab78
cmp ax, 0x17
jne 0x14015ac10
movzx ecx, ax
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14015ac48
mov rcx, qword [rbx + 8]
movzx r9d, word [r12]
mov r8, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0
call fcn.14015a8c0
mov r13d, eax
test eax, eax
jne 0x14015ac60
movzx eax, word [r12]
mov rcx, qword [rbx + 0x110]
cmp ax, 0x17
jne 0x14015ab33
nop dword [rax + rax]
and esi, 1
lea r9, [rsp + 0x3c]
mov edx, 0x29
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x3c], esi
mov r8d, 0x1b
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
jmp 0x14015ab33
mov r13d, 0x57
jmp 0x14015ab52
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2740
jne 0x14015ab52
mov dword [rbx + 0x118], 0x2740
jmp 0x14015ab48
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14015ab52
Function at 0x14015bde0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x140159e30
test ah, 0x80
je 0x140159e40
mov eax, dword [rcx + 0x10]
cmp eax, 0xc
je 0x140159e10
cmp eax, 0xe
je 0x140159e20
mov r8d, 0xfffff008
cmp eax, 7
je 0x140159e08
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x140472d71]
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0xfffff02a
mov eax, r8d
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x14015bde0
add rsp, 0x28
jmp 0x140162b10
mov r8d, 0xfffff00d
jmp 0x140159e08
mov r8d, 0xfffff031
jmp 0x140159e08
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x14015be48
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov r8d, eax
mov eax, dword [rsp + 0x4c]
cmp r8d, 0xffffffff
je 0x14015be30
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140146240
add rsp, 0x58
ret
mov eax, 0xfffff008
jmp 0x14015be27
push r13
push r12
sub rsp, 0x38
mov eax, dword [rcx + 0x100]
mov r12, rdx
mov r13d, r8d
test eax, eax
jne 0x140162b68
lea r9, [rsp + 0x2c]
call fcn.14015eed0
test eax, eax
jne 0x140162b50
mov edx, r13d
mov rcx, r12
call fcn.1401441d0
add rsp, 0x38
pop r12
pop r13
ret
mov ecx, dword [rsp + 0x2c]
call fcn.140146240
add rsp, 0x38
pop r12
pop r13
ret
mov eax, 0xfffff008
jmp 0x140162b41
Function at 0x14015c570
Capabilities:
Set socket configuration

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
cmp dword [rdx + 0x10], 0xc
mov rsi, rcx
mov rbx, rdx
mov r12, r8
je 0x14015c5a1
mov r8d, 0x45a
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
mov rcx, qword [r12 + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14015c670
mov eax, dword [r12 + 0x40]
test eax, eax
js 0x14015c635
mov dword [rsp + 0x20], 8
mov r8d, 0x700b
mov edx, 0xffff
lea r9, [rbx + 0x110]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14015c630
mov rax, qword [rbx + 0x130]
mov qword [r12 + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], r12
test rax, rax
je 0x14015c64e
xor edx, edx
mov rcx, rbx
call rax
mov eax, dword [rbx + 0x78]
test eax, eax
jne 0x14015c655
nop dword [rax]
mov r8d, 0x481
lea rdx, str.src_win_tcp.c
lea rcx, [0x140472f47]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x14015c655
mov rcx, qword [r12 + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r12 + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
jne 0x14015c708
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x14015c610
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x14015c665
test dl, 1
jne 0x14015c6e0
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov eax, dword [rbx + 0x58]
test al, 0x40
je 0x14015c64e
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x14015c720
test al, 1
jne 0x14015c6a8
test al, 4
je 0x14015c6a8
mov edx, eax
and edx, 0xffffffbb
mov dword [rbx + 0x58], edx
test al, 8
je 0x14015c6a8
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
nop dword [rax]
cmp qword [rbx + 0x100], 0
je 0x14015c64e
mov rcx, qword [r12 + 0x40]
call fcn.1401680b0
mov r12, qword [rbx + 0x100]
mov ecx, eax
call fcn.140146240
mov rcx, rbx
mov edx, eax
call r12
jmp 0x14015c64e
test dl, 0x20
jne 0x14015c665
mov rax, qword [rsi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov rdx, r12
mov rcx, rbx
call fcn.140159f90
jmp 0x14015c64e
jns 0x14015c6a8
mov r8d, 0x462
lea rdx, str.src_win_tcp.c
lea rcx, [0x14047301d]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x14015c6a8
Function at 0x14015c750
Capabilities:
Set socket configuration

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rsi, rcx
mov rbx, rdx
mov r12, r8
je 0x14015c782
mov r8d, 0x489
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
sub dword [rbx + 0x7c], 1
jne 0x14015c890
mov eax, dword [rbx + 0x58]
test al, 1
je 0x14015c828
mov eax, dword [rsi + 0x20]
test eax, eax
je 0x14015c8bb
mov rcx, qword [r12 + 0x40]
sub eax, 1
mov dword [rsi + 0x20], eax
test ecx, ecx
js 0x14015c8eb
mov ecx, 0x3e3
test byte [rbx + 0x58], 1
je 0x14015c850
mov rdi, qword [r12 + 0x70]
call fcn.140146240
mov rcx, r12
mov edx, eax
call rdi
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x14015c900
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x14015c7f0
test dl, 1
jne 0x14015c800
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
test dl, 0x20
jne 0x14015c7f0
mov rax, qword [rsi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
test al, 4
je 0x14015c797
mov edx, eax
and edx, 0xfffffffb
mov dword [rbx + 0x58], edx
test al, 8
je 0x14015c797
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x14015c797
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, eax
test eax, eax
jne 0x14015c928
or dword [rbx + 0x58], 0xc080
add dword [rsi + 0xa8], 1
jmp 0x14015c7c4
jns 0x14015c797
mov r8d, 0x48b
lea rdx, str.src_win_tcp.c
lea rcx, [0x140472f10]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsi + 0x20]
test eax, eax
jne 0x14015c7a2
lea rcx, [0x140472f2b]
mov r8d, 0x48b
lea rdx, str.src_win_tcp.c
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsi + 0x20]
mov rcx, qword [r12 + 0x40]
sub eax, 1
mov dword [rsi + 0x20], eax
test ecx, ecx
jns 0x14015c7b5
call fcn.1401680b0
mov ecx, eax
jmp 0x14015c7c4
mov r8d, 0x4a2
lea rdx, str.src_win_tcp.c
lea rcx, [0x140472f47]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x14015c7e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x14015c7c4

Function at 0x14015cb20
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x14015cb68
mov eax, dword [rbx + 0x58]
test esi, esi
jne 0x14015cb50
and eax, 0xfeffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x1000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
lea r9, [rsp + 0x3c]
mov edx, 6
mov r8d, 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14015cb38
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14015cb49
jmp 0x14015cb38
Function at 0x14015d460
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov r12, rax
test rax, rax
je 0x14015d440
xor eax, eax
lock cmpxchg qword [rbx + 8], r12
mov r13, rax
test rax, rax
jne 0x14015d400
call rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14015d3e0
mov byte [rbx], 1
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8d, 0x36
lea rdx, str.src_win_thread.c
lea rcx, str.result
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x14015d3ce
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14015d3d1
mov r8d, 0x3e
lea rdx, str.src_win_thread.c
lea rcx, str.result__WAIT_OBJECT_0
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp qword [sym.imp.msvcrt.dll__assert]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateEvent
mov ecx, eax
call fcn.140146180
nop
nop word cs:[rax + rax]
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1407b2be0], eax
cmp eax, 0xffffffff
je 0x1403f7540
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop

Function at 0x14015d500
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rdi, r8
mov rbp, r9
test byte [rdx], 1
je 0x14015d5f8
mov rbx, qword [rdx + 8]
test rbx, rbx
jne 0x14015d5c8
mov ecx, 0x18
call fcn.1401419c0
mov r12, rax
test rax, rax
je 0x14015d5ff
mov qword [rax], rdi
xor ecx, ecx
mov r9, rax
lea r8, [0x14015d480]
mov qword [rax + 8], rbp
mov edx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, rax
test rax, rax
jne 0x14015d5a8
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, r12
mov ebx, dword [rax]
call fcn.1401419e0
mov eax, 0xfffff01a
cmp ebx, 0x16
ja 0x14015d5b8
lea rax, [0x1404731a0]
mov eax, dword [rax + rbx*4]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rsi], rax
mov qword [r12 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x34]
lea rbx, [rbx + rax - 1]
neg rax
and rbx, rax
mov eax, ebx
cmp rax, rbx
je 0x14015d529
mov eax, 0xfffff019
jmp 0x14015d5b8
xor ebx, ebx
jmp 0x14015d529
mov eax, 0xfffff027
jmp 0x14015d5b8
Function at 0x14015eaa0
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, byte [rsp + 0xc0]
mov rbx, rcx
mov r12d, edx
mov ebp, r9d
movzx edi, r8b
lea rsi, [rsp + 0x30]
jmp 0x14015eb11
mov dword [rsp + 0x20], r14d
mov edx, r12d
mov rcx, rsi
mov r9d, ebp
mov r8d, edi
call fcn.14015e9f0
mov rcx, qword [rbx + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x14015eb38
call r15
cmp eax, 0x57
jne 0x14015eb50
mov rcx, qword [rbx + 0x110]
mov rdx, rsi
call r13
test eax, eax
jne 0x14015eae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x14015eae0
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x14015eb3a
Function at 0x140162560
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x140162640
test cl, 1
je 0x1401625b8
test edx, 0x10000
je 0x1401625a2
test edx, 0x2000000
jne 0x1401625e0
and edx, 0x200000
je 0x140162670
xor r12d, r12d
mov eax, r12d
add rsp, 0x70
pop rbx
pop r12
pop r13
ret
test cl, 4
je 0x140162586
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x140162586
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x140162586
mov r9d, 0x10
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov r8d, 1
mov word [rsp + 0x50], r9w
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1401625a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1401625a5
jns 0x140162586
lea rdx, str.src_win_tty.c
mov r8d, 0x422
lea rcx, [0x140473787]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x140162586
lea rcx, [0x1407b2c18]
call fcn.14015db00
mov eax, 2
xchg dword [0x1407b2c6c], eax
cmp eax, 1
je 0x1401626a8
lea rcx, [0x1407b2c18]
call fcn.14015dad0
or dword [rbx + 0x58], 0x200000
jmp 0x1401625a2
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140162778
lea rdx, [0x1407b2c50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140162810
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x1401627f8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140162698
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140162698
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r12d, r12d
jne 0x1401625a5
jmp 0x140162698
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401627e3
lock or dword [0x1407b2c68], 1
jmp 0x140162701