joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048560
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nPause_energy_server._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___pause____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cd94c]
mov qword [r11 - 0x30], rax
lea rax, [0x1400ddeb0]
mov qword [r11 - 0x28], rax
lea rax, [0x1400d84f8]
mov qword [r11 - 0x20], rax
lea rax, [0x1400dde60]
mov qword [r11 - 0x18], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
nop word [rax + rax]
cmp edi, 6
jge 0x1400485ef
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cd934]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1400485c0
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x14004862e
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140048647
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140048660
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140048680
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nRestart_energy_server._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___restart____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cd9e4]
mov qword [r11 - 0x30], rax
lea rax, [0x1400de000]
mov qword [r11 - 0x28], rax
lea rax, [0x1400d92e8]
mov qword [r11 - 0x20], rax
lea rax, [0x1400ddfb0]
mov qword [r11 - 0x18], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
nop word [rax + rax]
cmp edi, 6
jge 0x14004870f
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cd974]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1400486e0
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x14004874e
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140048767
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140048780
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140048a20
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x80
lea rax, str._nSend_a_control_command_to_the_device._n
mov qword [r11 - 0x58], rax
lea rax, str._nUsage:__esrv___device_control__command_____address__address___n
mov qword [r11 - 0x50], rax
lea rax, str.________________port__port______diagnostic__n
mov qword [r11 - 0x48], rax
lea rax, [0x1400cda84]
mov qword [r11 - 0x40], rax
lea rax, [0x1400ded50]
mov qword [r11 - 0x38], rax
lea rax, [0x1400d9528]
mov qword [r11 - 0x30], rax
lea rax, str.command_is_a_string._If_the_command_string_has_space_characters__n
mov qword [r11 - 0x28], rax
lea rax, str.then_enclose_it_between_double_quotes____._n
mov qword [r11 - 0x20], rax
lea rax, str.Refer_to_the_device_support_module_user_guide_for_a_list_of_commands._n
mov qword [r11 - 0x18], rax
lea rax, [0x1400debb0]
mov qword [r11 - 0x10], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
nop dword [rax]
cmp edi, 0xa
jge 0x140048adf
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x30]
lea rdx, [0x1400cda6c]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x140048ab0
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x140048b1e
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140048b37
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140048b50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140049490
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, str._nPrint_esrv_and_PL_version._n
mov qword [rsp + 0x28], rax
lea rax, str._nUsage:__esrv___version_n
mov qword [rsp + 0x30], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
nop
cmp edi, 2
jge 0x1400494ef
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cdd7c]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1400494c0
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x14004952e
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140049547
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049560
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140049580
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xc0
lea rax, str._nDisplay_this_message_on_supported_data_ranges._n
mov qword [rsp + 0x30], rax
lea rax, str._nUsage:__esrv___ranges_n_n
mov qword [rsp + 0x38], rax
lea rax, str.___Max_Joules......................................184_467_440_737_095_000.00_n
mov qword [rsp + 0x40], rax
lea rax, str.___Max_kWh..................................................51_240_955_760.30_n
mov qword [r11 - 0x80], rax
lea rax, str.___Max_kWh_With_Overflows..........945_228_797_002_602_000_000_000_000_000.00_n
mov qword [r11 - 0x78], rax
lea rax, [0x1400cddc4]
mov qword [r11 - 0x70], rax
lea rax, str._________________Time_to_Overflow________________Rate_________________________n
mov qword [r11 - 0x68], rax
lea rax, str.______________________________________________________________________________n
mov qword [r11 - 0x60], rax
lea rax, str.___..............5_849_424_173.55_years__.......................1_W_n
mov qword [r11 - 0x58], rax
lea rax, str.___................584_942_417.36_years__......................10_W_n
mov qword [r11 - 0x50], rax
lea rax, str.___.................58_494_241.74_years__.....................100_W_n
mov qword [r11 - 0x48], rax
lea rax, str.___..................5_849_424.17_years__...................1_000_W......1_kW_n
mov qword [r11 - 0x40], rax
lea rax, str.___....................584_942.42_years__..................10_000_W.....10_kW_n
mov qword [r11 - 0x38], rax
lea rax, str.___.....................58_494.24_years__.................100_000_W....100_kW_n
mov qword [r11 - 0x30], rax
lea rax, str.___......................5_849.42_years__...............1_000_000_W......1_MW_n
mov qword [r11 - 0x28], rax
lea rax, str.___........................584.94_years__..............10_000_000_W.....10_MW_n
mov qword [r11 - 0x20], rax
lea rax, str.___.........................58.49_years__.............100_000_000_W....100_MW_n
mov qword [r11 - 0x18], rax
lea rax, str.___..........................5.85_years__...........1_000_000_000_W......1_GW_n
mov qword [r11 - 0x10], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
cmp edi, 0x12
jge 0x140049693
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x30]
lea rdx, [0x1400cdd94]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x140049664
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x1400496d2
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x1400496eb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049704
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140049730
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nFlush_energy_server._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___flush____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cddf4]
mov qword [r11 - 0x30], rax
lea rax, [0x1400e1a00]
mov qword [r11 - 0x28], rax
lea rax, [0x1400d9f28]
mov qword [r11 - 0x20], rax
lea rax, [0x1400e19a0]
mov qword [r11 - 0x18], rax
lea rax, [0x1400e1950]
mov qword [r11 - 0x10], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
cmp edi, 7
jge 0x1400497c4
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cdddc]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x140049795
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x140049803
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x14004981c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049835
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140049860
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nSynchronize_energy_server._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___synch____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cde34]
mov qword [r11 - 0x30], rax
lea rax, [0x1400e1bb0]
mov qword [r11 - 0x28], rax
lea rax, [0x1400da108]
mov qword [r11 - 0x20], rax
lea rax, [0x1400e1b50]
mov qword [r11 - 0x18], rax
lea rax, [0x1400e1b00]
mov qword [r11 - 0x10], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
cmp edi, 7
jge 0x1400498f4
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cde0c]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1400498c5
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x140049933
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x14004994c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049965
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140049990
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nReset_energy_counters_to_zero._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___reset____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cde64]
mov qword [r11 - 0x30], rax
lea rax, [0x1400e1da0]
mov qword [r11 - 0x28], rax
lea rax, [0x1400da2e8]
mov qword [r11 - 0x20], rax
lea rax, str.Note:_all_the_channels_of_the_target_ersv_instance_s__are_reset._n
mov qword [r11 - 0x18], rax
lea rax, [0x1400e1cb0]
mov qword [r11 - 0x10], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
cmp edi, 7
jge 0x140049a24
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cde4c]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1400499f5
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x140049a63
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140049a7c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049a95
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140049ac0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, str._nStop_energy_server._n
mov qword [r11 - 0x40], rax
lea rax, str._nUsage:__esrv___stop____address__address______port__port______diagnostic__n
mov qword [r11 - 0x38], rax
lea rax, [0x1400cde8c]
mov qword [r11 - 0x30], rax
lea rax, str.address_is_the_IPv4_address_string_displayed_when_esrv_was_started._n
mov qword [r11 - 0x28], rax
lea rax, str.port_is_the_TCP_port_string_displayed_when_esrv_was_started._n
mov qword [r11 - 0x20], rax
lea rax, str.__diagnostic_activates_diagnostic_messages_display_during_runtime._n
mov qword [r11 - 0x18], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
nop word [rax + rax]
cmp edi, 6
jge 0x140049b4f
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cde7c]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x140049b20
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x140049b8e
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140049ba7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140049bc0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140049f90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
lea rax, str._nStart_and_control_energy_server._n
mov qword [rsp + 0x28], rax
lea rax, str._nUsage:__esrv_____start____restart____stop____pause____resume____reset____synch_
mov qword [rsp + 0x30], rax
lea rax, str._n_________________flush____ranges____version____device_control____status____help___n
mov qword [rsp + 0x38], rax
lea rax, str._nContext_sensitive_help_is_available_for_each_command__i.e.___esrv___start___help__n
mov qword [rsp + 0x40], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
cmp edi, 4
jge 0x14004a006
movsxd rbx, edi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rsp + rbx*8 + 0x28]
lea rdx, [0x1400cdfac]
call fcn.1400010a0
inc edi
mov dword [rsp + 0x20], edi
jmp 0x140049fd7
lea rcx, [0x140101140]
call fcn.140018c50
lea rdx, [0x140112c58]
call fcn.140008db0
call fcn.14004c1f0
cmp dword [0x140186e60], 1
jne 0x14004a045
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], rsi
mov dword [0x140186e60], esi
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x14004a05e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], rsi
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x14004a077
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14004a090
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov rcx, qword [rcx + 0x73130]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14004a0e3
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x7308c], 0
xor eax, eax
jmp 0x14004a0f6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x30
pop rbx
ret

Function at 0x14004a110
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov rcx, qword [rcx + 0x73130]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14004a163
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x7308c], 1
xor eax, eax
jmp 0x14004a176
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x30
pop rbx
ret
Function at 0x14004a540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
xor r12d, r12d
mov r15d, r12d
mov ebx, r12d
mov dword [rsp + 0x4c], r12d
mov byte [rsp + 0x48], bl
test rcx, rcx
je 0x14004a5e6
lea r14, [rcx + 0x71030]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x40], r14
mov esi, r12d
mov dword [rsp + 0x34], r12d
nop word [rax + rax]
cmp esi, dword [rdi + 0x73030]
jge 0x14004a648
nop dword [rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x4c]
mov r8d, 1
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x73068]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004a5ed
mov eax, 1
jmp 0x14004a658
cmp dword [rsp + 0x4c], 1
je 0x14004a5f6
jmp 0x14004a5c0
movzx eax, byte [rsp + 0x48]
mov byte [r14], al
inc r14
mov qword [rsp + 0x40], r14
add r15d, dword [rsp + 0x4c]
mov dword [rsp + 0x38], r15d
mov rdx, qword [rdi + 0x78]
test rdx, rdx
je 0x14004a63d
movsxd rcx, ebx
mov rax, qword [rdi + 0x70]
movzx ecx, byte [rcx + rax]
cmp byte [rsp + 0x48], cl
jne 0x14004a636
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, edx
je 0x14004a648
jmp 0x14004a63d
mov ebx, r12d
mov dword [rsp + 0x30], ebx
inc esi
mov dword [rsp + 0x34], esi
jmp 0x14004a5b0
mov dword [rdi + 0x73038], r15d
xor eax, eax
jmp 0x14004a658
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x14004aa90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x14004aadf
lea rdx, [rcx + 0x72030]
mov qword [rsp + 0x20], 0
lea r9, [rcx + 0x7303c]
mov r8d, dword [rcx + 0x73034]
mov rcx, qword [rcx + 0x73068]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004aadf
mov eax, dword [rbx + 0x7303c]
cmp dword [rbx + 0x73034], eax
je 0x14004aaef
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
jmp 0x14004aaf8
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140077cb0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor r15d, r15d
mov dword [r11 - 0x40], r15d
mov r14d, r15d
mov dword [r11 - 0x64], r15d
mov qword [r11 - 0x30], r15
mov qword [r11 - 0x38], r15
mov esi, r15d
mov qword [r11 - 0x60], r15
test rcx, rcx
je 0x140077df9
test rdx, rdx
je 0x140077df9
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x48], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x140077df9
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x38], rsi
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov ecx, r15d
mov dword [rsp + 0x30], ecx
cmp ecx, dword [rdi + 0xc]
jae 0x140077d6b
mov eax, 1
shl rax, cl
or rbx, rax
mov qword [rsp + 0x40], rbx
inc ecx
jmp 0x140077d4e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
je 0x140077df9
mov r14d, 1
mov dword [rsp + 0x34], r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x48]
lea r8, [0x140077b30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rbx, rax
test rax, rax
je 0x140077df9
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140077ddf
cmp eax, 0x102
jne 0x140077ddd
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140077df9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
je 0x140077df9
xor eax, eax
jmp 0x140077e25
nop
cmp r14d, 1
jne 0x140077e12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov eax, 1
jmp 0x140077e25
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret