joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061b50
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rbp + 0x70], rax
movups xmm0, xmmword [rdx + 0xc]
mov qword [rsp + 0x28], 0x148
movzx eax, cl
xorps xmm1, xmm1
mov dword [rsp + 0x30], 0
neg al
mov qword [rsp + 0x64], 0
mov eax, dword [rdx + 0x1c]
mov rbx, r8
movups xmmword [rsp + 0x3c], xmm0
sbb r8d, r8d
mov r9d, reloc.WS2_32.dll_socket
movups xmm0, xmmword [rdx + 0x20]
add r8d, 4
mov word [rsp + 0x38], r9w
test byte [rdx + 8], 4
movzx edi, cl
mov ecx, dword [rbx + 0x2b0]
movaps xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x6c], 0
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp], xmm1
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov dword [rbp + 0x60], 0
je 0x140061c39
mov eax, dword [rdx + 0x30]
mov dword [rbp + 0x64], eax
jmp 0x140061c40
mov dword [rbp + 0x64], 0xffffffff
mov eax, dword [rdx + 0x34]
test eax, eax
mov edx, ecx
cmovne edx, eax
cmp dword [rbx], 2
mov dword [rsp + 0x60], edx
jne 0x140061c70
cmp edx, ecx
jne 0x140061c70
lea r8, [rsp + 0x50]
mov ecx, r9d
lea rdx, str.fe80::8
call qword [sym.imp.WS2_32.dll_inet_pton]
mov edx, dword [rsp + 0x60]
cmp edx, 0xffffffff
jne 0x140061c91
mov rdx, qword [rbx + 0x140]
lea rcx, [rsp + 0x64]
mov r8d, 0x100
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x63], 0
mov r9, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movzx ecx, dil
call fcn.140061870
cmp dword [0x1400d3ed4], 3
movzx ebx, al
jb 0x140061cfa
mov ecx, 3
call fcn.14000ec70
test al, al
je 0x140061cf7
test bl, bl
lea rax, str.succeeded
lea r9, str.failed
mov ecx, 3
cmovne r9, rax
lea r8, str.deletion
test dil, dil
lea rax, str.addition
lea rdx, str.IPv6_route__s_via_service__s
cmovne r8, rax
call fcn.14000e820
movzx eax, bl
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x180
pop rdi
pop rbx
pop rbp
ret
Function at 0x140063950
Capabilities:
Convert ip address from string

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x1400639ad
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140063970
cmp rax, 0x41
ja 0x1400639ad
lfence
mov rdx, rcx
lea r8, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x48
ret

Function at 0x140063bb0
Capabilities:
Set socket configuration

Disassembly:
test rdx, rdx
je 0x140063d84
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x48], rax
movsxd rdi, ecx
mov rbx, rdx
mov ecx, edi
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], r14
call fcn.140063ab0
mov ecx, edi
mov ebp, eax
call fcn.140063b30
mov ecx, dword [rbx + 4]
mov r14d, eax
test ecx, ecx
je 0x140063c48
mov dword [rsp + 0x30], ecx
lea r9, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140063c48
mov ecx, 0x40
call fcn.14000ec70
test al, al
je 0x140063c48
mov r8d, dword [rsp + 0x30]
lea rdx, str.NOTE:_setsockopt_SO_SNDBUF_d_failed
mov ecx, 0x40
call fcn.14000e820
mov eax, dword [rbx]
test eax, eax
je 0x140063c9b
mov rcx, rdi
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140063c9b
mov ecx, 0x40
call fcn.14000ec70
test al, al
je 0x140063c9b
mov r8d, dword [rsp + 0x30]
lea rdx, str.NOTE:_setsockopt_SO_RCVBUF_d_failed
mov ecx, 0x40
call fcn.14000e820
cmp dword [0x1400d3ed4], 3
jb 0x140063d64
mov ecx, 0x2b000003
call fcn.14000ec70
test al, al
je 0x140063d64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x88], rsi
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x30], 4
mov r8d, 0x1001
mov rcx, rdi
mov rsi, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
xor ebx, ebx
test eax, eax
jne 0x140063d01
cmp dword [rsp + 0x30], 4
mov edi, dword [rsp + 0x3c]
je 0x140063d03
mov edi, ebx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockopt]
mov rsi, qword [rsp + 0x88]
test eax, eax
jne 0x140063d45
cmp dword [rsp + 0x38], 4
jne 0x140063d45
mov ebx, dword [rsp + 0x40]
mov dword [rsp + 0x28], edi
lea rdx, str.Socket_Buffers:_R__d___d__S__d___d_
mov r9d, ebx
mov dword [rsp + 0x20], ebp
mov r8d, r14d
mov ecx, 0x2b000003
call fcn.14000e820
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140063d90
Capabilities:
Create udp socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov r8d, dword [rdx + 0xc]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x11
je 0x140063de1
mov eax, dword [rdx + 8]
cmp eax, 2
je 0x140063de1
cmp eax, 1
je 0x140063dcd
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_socket.c
cmp r8d, 6
je 0x140063eae
jmp 0x140063e9c
mov ecx, dword [rdi + 4]
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x30], rax
jmp 0x140063e30
cmp dword [rdx + 8], 2
jne 0x140063ec0
mov ecx, dword [rdi + 4]
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
or dword [rbx + 0x1c0], 0x10
cmp qword [rbx + 0x268], 0
mov qword [rbx + 0x30], rax
je 0x140063e30
movups xmm0, xmmword [rdi]
mov edx, 1
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [rsp + 0x34]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x38], rax
mov eax, dword [rbx + 0x30]
lea rdx, [rbx + 0x1b4]
mov ecx, eax
call fcn.140063bb0
cmp byte [rbx + 0x1a0], 0
movzx eax, word [rdi + 4]
je 0x140063e91
cmp qword [rbx + 0x268], 0
je 0x140063e70
cmp dword [rbx + 0x24], 1
jne 0x140063e70
mov rcx, qword [rbx + 0x38]
lea r9, str.SOCKS
mov r8d, eax
mov byte [rsp + 0x20], 0
jmp 0x140063e86
mov rcx, qword [rbx + 0x30]
lea r9, str.TCP_UDP
mov r8d, eax
movzx eax, byte [rbx + 0x2a]
mov byte [rsp + 0x20], al
mov rdx, qword [rbx]
mov rdx, qword [rdx]
call fcn.140064600
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea r8, [0x14008d704]
mov edx, 0x477
call fcn.14000ed60
int3
lea r8, str.addrinfo__ai_socktype__SOCK_STREAM
mov edx, 0x3f7
call fcn.14000ed60
int3
lea r8, str.addrinfo__ai_socktype__SOCK_DGRAM
mov edx, 0x417
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_socket.c
call fcn.14000ed60
int3
Function at 0x140064600
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov r14, r9
mov qword [rsp + 0x38], rax
mov edi, r8d
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14006477a
mov qword [rsp + 0x50], rbx
mov rbx, rdx
cmp dword [rbx + 4], edi
je 0x140064676
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140064642
lea ecx, [rbx + 0x10]
call fcn.14000ec70
test al, al
je 0x140064752
mov ecx, edi
call fcn.140067560
lea rdx, str._s:_Socket_bind_failed:_Addr_to_bind_has_no__s_record
lea ecx, [rbx + 0x10]
jmp 0x140064747
cmp edi, 0x17
jne 0x1400646fd
cmp byte [rsp + 0xa0], al
setne al
cmp dword [0x1400d3ed4], 1
mov dword [rsp + 0x30], eax
jb 0x1400646b6
lea ecx, [rdi - 0x16]
call fcn.14000ec70
test al, al
je 0x1400646b6
mov r8d, dword [rsp + 0x30]
lea rdx, str.setsockopt_IPV6_V6ONLY_d_
lea ecx, [rdi - 0x16]
call fcn.14000e820
mov edx, 0x29
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov rcx, rbp
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400646fd
mov ecx, pe_nt_image_headers64
call fcn.14000ec70
test al, al
je 0x1400646fd
mov r8d, dword [rsp + 0x30]
lea rdx, str.Setting_IPV6_V6ONLY_d_failed
mov ecx, pe_nt_image_headers64
call fcn.14000e820
mov r8d, dword [rbx + 0x10]
mov rcx, rbp
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x14006475e
mov ecx, 0x110
call fcn.14000ec70
test al, al
je 0x140064752
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x38]
mov r8d, 2
lea rdx, [0x14009db98]
call fcn.140066b10
lea rdx, str._s:_Socket_bind_failed_on_local_address__s
mov ecx, 0x110
mov r9, rax
mov r8, r14
call fcn.14000e820
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r8, str.local
mov edx, 0x586
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_socket.c
call fcn.14000ed60
int3
Function at 0x1400647a0
Capabilities:
Connect socket
Get socket status

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x270
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
call fcn.1400102c0
movzx eax, word [rbx]
xor r12d, r12d
cmp ax, 2
je 0x1400647ed
cmp ax, 0x17
mov r8d, 0x1c
cmovne r8d, r12d
jmp 0x1400647f3
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140064809
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x1400648ff
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
movsxd r14, ebp
nop word [rax + rax]
mov eax, r12d
mov qword [rsp + 0x48], r14
test edi, edi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x3c], r12d
setg al
lea ecx, [rbp + 1]
mov dword [rsp + 0x38], eax
xor r9d, r9d
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test rsi, rsi
je 0x14006487f
call fcn.140086800
mov dword [rsi], eax
mov ecx, dword [rsi]
test ecx, ecx
jne 0x14006489c
test ebx, ebx
js 0x1400648e9
jg 0x1400648a8
sub edi, 1
js 0x1400648a1
cmp qword [0x1400d3e98], r12
je 0x140064830
xor edx, edx
call fcn.140027440
jmp 0x140064830
mov eax, r12d
jmp 0x1400648ef
mov eax, 0x274c
jmp 0x1400648ef
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], r12d
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x30], 4
mov r8d, 0x1007
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400648e9
cmp dword [rsp + 0x30], 4
jne 0x1400648e9
mov eax, dword [rsp + 0x34]
jmp 0x1400648ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rsp + 0x268]
mov r15, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x270
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140065960
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x2a0]
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140088390
test eax, eax
jne 0x1400659b0
lea rcx, [rsp + 0x30]
call fcn.140052ca0
mov rcx, qword [0x1400cb8d0]
mov eax, dword [0x1400cb8d8]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
jmp 0x1400659b7
mov rcx, qword [0x1400cb8d0]
mov eax, dword [rsi + 8]
mov r8d, 0
add eax, dword [rsi + 4]
mov r9, rdi
sub eax, ecx
lea rcx, [rbx + 0x38]
cmovns r8d, eax
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
mov rdx, qword [rdx + 0x20]
call fcn.140064920
mov eax, dword [rdi]
test eax, eax
jne 0x140065b04
mov rbp, qword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x268]
mov rdx, rbp
call fcn.140068430
test al, al
je 0x140065a79
xor r9d, r9d
lea rdx, [0x1400b2e20]
mov rcx, rbp
lea r8d, [r9 + 0xa]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xa
je 0x140065a4a
cmp dword [0x1400d3ed4], 1
jb 0x140065a79
mov ecx, 0x1000121
call fcn.14000ec70
test al, al
je 0x140065a79
lea rdx, str.establish_socks_proxy_passthru:_TCP_port_write_failed_on_send__
mov ecx, 0x1000121
call fcn.14000e820
jmp 0x140065a79
xor eax, eax
lea rdx, [rbx + 0x270]
xorps xmm0, xmm0
mov r8, rdi
movups xmmword [rbx + 0x270], xmm0
mov qword [rbx + 0x280], rax
mov rcx, rbp
mov dword [rbx + 0x288], eax
call fcn.1400686f0
test al, al
jne 0x140065a85
mov eax, dword [rdi]
test eax, eax
jne 0x140065a85
mov dword [rdi], 0xa
mov eax, dword [rdi]
test eax, eax
jne 0x140065b04
mov rax, qword [rbx + 0x290]
mov qword [rbx + 0x178], rax
mov rax, qword [rbx + 0x298]
mov qword [rbx + 0x180], rax
mov rax, qword [rbx]
movzx ecx, word [rax + 0x18]
cmp cx, 2
je 0x140065ac3
cmp cx, 0x17
jne 0x140065aca
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
jmp 0x140065aca
mov dword [rax + 0x1c], 0
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140065af2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, qword [rbx]
mov qword [rax + 0x10], 0
mov rax, qword [rbx]
mov qword [rax + 8], 0
xor r8d, r8d
mov r9, rdi
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140064b00
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400670e0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x228
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x210], rax
movzx eax, word [r8]
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp ax, 2
je 0x140067218
cmp ax, 0x17
jne 0x1400672c2
cmp word [r8 + 8], 0
jne 0x1400671b1
cmp word [r8 + 0xa], 0
jne 0x1400671b1
cmp word [r8 + 0xc], 0
jne 0x1400671b1
cmp word [r8 + 0xe], 0
jne 0x1400671b1
cmp word [r8 + 0x10], 0
jne 0x1400671b1
mov eax, 0xffff
cmp word [r8 + 0x12], ax
jne 0x1400671b1
mov r9, rdx
mov qword [rsp + 0x220], rbx
mov ebx, dword [r8 + 0x14]
lea rcx, [rsp + 0x90]
lea r8, str._s_ip
mov edx, 0x100
call fcn.140003260
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea r8, [0x14008d6e8]
mov edx, 0x80
mov r9, rax
lea rcx, [rsp + 0x190]
call fcn.140003260
mov rbx, qword [rsp + 0x220]
jmp 0x1400671fa
mov r9, rsi
lea r8, str._s_ip6
mov edx, 0x100
lea rcx, [rsp + 0x90]
call fcn.140003260
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x190]
mov r9d, 0x80
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [rax + 0x1c]
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea r8, [rsp + 0x190]
mov rcx, r14
lea rdx, [rsp + 0x90]
call fcn.14000ded0
test bpl, 1
jmp 0x140067264
lea rax, [0x14008d6e8]
and ebp, 1
lea r8, str._s_ip
mov r9, rsi
cmove r8, rax
lea rcx, [rsp + 0x90]
mov edx, 0x100
call fcn.140003260
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, [rsp + 0x90]
mov rcx, r14
mov r8, rax
call fcn.14000ded0
test ebp, 1
je 0x1400672c2
cmp word [rdi + 2], 0
je 0x1400672c2
mov r9, rsi
lea r8, str._s_port
mov edx, 0x100
lea rcx, [rsp + 0x90]
call fcn.140003260
movzx ecx, word [rdi + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r9d, ax
lea r8, [0x14009b4dc]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.140003260
lea r8, [rsp + 0x50]
mov rcx, r14
lea rdx, [rsp + 0x90]
call fcn.14000ded0
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x228
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
push r13
push r15
sub rsp, 0x50
movsxd rsi, dword [rsp + 0xa8]
lea rcx, [0x14009db94]
mov r13, r8
mov r12d, edx
call fcn.14000b920
lea rcx, str.SHA1
mov qword [rsp + 0x40], rax
call fcn.14000b920
mov qword [rsp + 0x48], rax
mov rcx, rsi
add rcx, 8
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14006b94c
mov r9, qword [rsp + 0x80]
mov rdx, r13
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x88], rbp
lea rbp, [rax + 8]
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0xa0]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x98], r14
xor r14d, r14d
mov qword [rsp + 0x28], rdi
mov qword [rax], r14
mov dword [rsp + 0x20], r12d
call fcn.14006b4c0
mov r9, qword [rsp + 0x80]
lea rdx, [r13 + 0x18]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r12d
call fcn.14006b4c0
test esi, esi
jle 0x14006b8e0
cmp esi, 0x40
jb 0x14006b8e0
lea rax, [rsi - 1]
lea rcx, [rax + rdi]
add rax, rbp
cmp rdi, rax
ja 0x14006b860
cmp rcx, rbp
jae 0x14006b8e0
mov r8, rsi
lea rcx, [rdi + 0x10]
mov rdx, rbp
and r8, 0xffffffffffffffc0
sub rdx, rdi
mov r9, 0xfffffffffffffff0
sub r9, rdi
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r14d, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rdx + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
lea rax, [r9 + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rdx + rcx - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rdx + rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, r8
jl 0x14006b880
movsxd rcx, r14d
mov r14, qword [rsp + 0x98]
cmp rcx, rsi
jge 0x14006b911
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
mov r8, rsi
sub r8, rcx
movzx edx, byte [rax + r9]
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x14006b900
mov rdi, rbp
xor eax, eax
mov rbp, qword [rsp + 0x88]
mov rcx, rsi
rep stosb byte [rdi], al
mov rdi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x14006b923
mov rdi, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r13
pop r12
pop rsi
pop rbx
ret
call fcn.14000ede0
int3
Function at 0x140078730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor sil, sil
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400788a7
cmp dword [rcx + 0x10], 0
jl 0x1400788a7
test byte [rcx], 1
je 0x1400788a7
cmp qword [rcx + 0x30], 0
je 0x1400788d9
cmp qword [rdx + 0x10], 0
je 0x1400788f2
xor ebp, ebp
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x14007879a
mov edx, dword [rbx + 0x28]
test edx, edx
js 0x14007879a
cmp edx, 1
jge 0x140078832
mov eax, dword [rbx + 0x20]
test eax, eax
js 0x1400788c0
test r8, r8
je 0x1400788c0
mov qword [rbx + 0x24], rbp
mov rcx, r8
mov r8d, ebp
test ebp, ebp
js 0x1400787cc
sub eax, ebp
movsxd rdx, ebp
sub eax, ebp
cmovns r8d, eax
add rdx, rcx
jmp 0x1400787dc
test rcx, rcx
je 0x1400787d9
movsxd rdx, ebp
add rdx, rcx
jmp 0x1400787dc
mov rdx, rbp
mov ecx, dword [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ecx, eax
test eax, eax
jle 0x14007889f
cmp qword [rbx + 0x30], rbp
je 0x14007890b
mov edx, dword [rbx + 0x28]
test edx, edx
js 0x14007890b
add eax, 0xf4240
cmp eax, 0x1e847f
ja 0x14007890b
add edx, ecx
js 0x14007890b
mov ecx, dword [rbx + 0x24]
add ecx, edx
cmp ecx, dword [rbx + 0x20]
jg 0x14007890b
mov dword [rbx + 0x28], edx
jmp 0x140078781
movsxd rcx, dword [rbx + 0x24]
mov sil, 1
movzx r8d, byte [rcx + r8]
lea eax, [rcx + 1]
mov dword [rbx + 0x24], eax
lea eax, [rdx - 1]
mov dword [rbx + 0x28], eax
cmp r8d, 0xd
je 0x140078781
cmp r8d, 0xa
je 0x14007889f
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x140078781
movsxd rdx, dword [rdi + 8]
test edx, edx
js 0x140078781
movsxd rcx, dword [rdi + 4]
lea eax, [rcx + rdx]
cmp eax, dword [rdi]
jge 0x140078781
lea eax, [rdx + 1]
add rcx, r9
mov dword [rdi + 8], eax
mov rax, rdx
add rax, rcx
je 0x140078781
mov byte [rax], r8b
jmp 0x140078781
mov rcx, rdi
call fcn.140003710
mov rbx, qword [rsp + 0x30]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, str.buf_init_so__read_buf__0_
mov edx, 0x121
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_status.c
call fcn.14000ed60
int3
lea r8, str.buf_defined_so__read_buf_
mov edx, 0x116
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_status.c
call fcn.14000ed60
int3
lea r8, str.buf_defined_buf_
mov edx, 0x117
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_status.c
call fcn.14000ed60
int3
lea r8, str.buf_inc_len_so__read_buf__len_
mov edx, 0x128
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_status.c
call fcn.14000ed60
int3
Function at 0x14007d980
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x180]
mov rbx, rcx
test eax, eax
jne 0x14007dac0
movups xmm0, xmmword [rcx + 0x1d8]
movsd xmm1, qword [rcx + 0x1e8]
movups xmmword [rcx + 0x1f0], xmm0
movsd qword [rcx + 0x200], xmm1
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14007d9ee
mov edi, dword [rcx + 0x1f8]
test edi, edi
js 0x14007d9d3
mov eax, edi
jmp 0x14007d9e4
test rax, rax
je 0x14007d9ee
mov eax, dword [rcx + 0x1f8]
xor edi, edi
test eax, eax
js 0x14007d9ee
cmp edi, eax
ja 0x14007dacb
jmp 0x14007d9f0
xor edi, edi
mov rcx, qword [rcx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x14007dae4
lfence
mov rax, qword [rbx + 0x200]
test rax, rax
je 0x14007da29
cmp dword [rbx + 0x1f8], 0
jl 0x14007da29
movsxd rdx, dword [rbx + 0x1f4]
add rdx, rax
jmp 0x14007da2b
xor edx, edx
mov rcx, qword [rbx + 0x178]
lea rax, [rbx + 0x188]
lea r9, [rbx + 0x1a8]
mov qword [rsp + 0x20], rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007da73
mov rcx, qword [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007dafd
mov dword [rbx + 0x1b0], 0
jmp 0x14007dab5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x14007da9e
mov eax, 1
mov dword [rbx + 0x1b0], edi
mov dword [rbx + 0x180], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14007db16
mov dword [rbx + 0x1b0], edi
mov eax, 2
mov dword [rbx + 0x180], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, str.len___BLEN_tt__reads.buf_
mov edx, 0xd78
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_tun.c
call fcn.14000ed60
int3
lea r8, str.ResetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd7b
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_tun.c
call fcn.14000ed60
int3
lea r8, str.SetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd88
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_tun.c
call fcn.14000ed60
int3
lea r8, str.SetEvent_tt__reads.overlapped.hEvent_
mov edx, 0xd9e
lea rcx, str.C:Users_vagrant_buildbotwindows_server_2019_static_msbuildopenvpn_srcopenvpn_tun.c
call fcn.14000ed60
int3