joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3142
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fbd00
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fbdc3
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fbe51
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b021c
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fbe4c
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fbe51
jmp 0x1401fbdb5
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fbe7b
xor eax, eax
jmp 0x1401fbeae
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fbeae
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b31c9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1401ad690
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x3c4], 0
lea rcx, [0x1402831c3]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x14]
mov rax, qword [rbp + 0x410]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x410]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0163
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0x18
mov dword [rbp + 0xa4], 0x18
mov dword [rbp + 0xc4], 0x10
mov rax, qword gs:[0x60]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov eax, 0x10
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp qword [rax + 0x30], 0
je 0x1401ad7b3
lea rdx, [0x14023ccc0]
mov rax, qword [rbp + 0x168]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401ad7b3
jmp 0x1401ad7c3
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x128], rax
jne 0x1401ad76c
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
mov r9d, 0xa
mov r8d, 0xc
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x410]
call fcn.1400b0163
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xc
mov r8d, dword [rbp + 0x184]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0749
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax + 8]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x410]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0749
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x350]
call fcn.1400b1ec3
mov qword [rbp + 0x3d8], rax
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x418]
call fcn.1400b1e41
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
lea rcx, [rbp + 0x350]
call fcn.1400b0352
nop
mov rax, qword [rbp + 0x418]
jmp 0x1401ad913
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x14015b250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1402830ac]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x100]
mov qword [rax], 0
mov ecx, 0x28
call fcn.140140290
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14015b2a7
mov eax, 7
jmp 0x14015b36c
cmp dword [0x14026a004], 0
jne 0x14015b2c4
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400b230a
nop
jmp 0x14015b32f
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x110]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 8]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
lea r8, [0x14015b4c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rax, qword [rbp + 8]
cmp qword [rax], 0
jne 0x14015b32f
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400b230a
nop
mov rax, qword [rbp + 8]
cmp qword [rax + 0x10], 0
jne 0x14015b35c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rbp + 8]
mov dword [rcx + 8], eax
mov rcx, qword [rbp + 0x110]
call qword [rbp + 0x108]
mov rcx, qword [rbp + 8]
mov qword [rcx + 0x20], rax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rbp + 8]
mov qword [rax], rcx
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14020c670
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400b30ac
movzx eax, al
test eax, eax
jne 0x14020c690
mov ecx, 7
call fcn.1400b26f7
nop
mov byte [rsp + 0x20], 0
call fcn.1400b27d8
mov byte [rsp + 0x21], al
cmp dword [0x14026ee68], 1
jne 0x14020c6b4
mov ecx, 7
call fcn.1400b26f7
nop
jmp 0x14020c70c
cmp dword [0x14026ee68], 0
jne 0x14020c707
mov dword [0x14026ee68], 1
lea rdx, [0x14021c8a0]
lea rcx, [0x14021c570]
call fcn.1400b1626
test eax, eax
je 0x14020c6e8
mov eax, 0xff
jmp 0x14020c811
lea rdx, [0x14021c460]
lea rcx, [section..rdata]
call fcn.1400b27a6
mov dword [0x14026ee68], 2
jmp 0x14020c70c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400b2675
call fcn.1400b2152
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14020c769
mov rcx, qword [rsp + 0x30]
call fcn.1400b1257
movzx eax, al
test eax, eax
je 0x14020c769
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140284020]
nop
call fcn.1400b236e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14020c79d
mov rcx, qword [rsp + 0x38]
call fcn.1400b1257
movzx eax, al
test eax, eax
je 0x14020c79d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400b2d82
nop
call fcn.14020c880
mov dword [rsp + 0x28], eax
call fcn.1400b2008
movzx eax, al
test eax, eax
jne 0x14020c7bc
mov ecx, dword [rsp + 0x28]
call fcn.1400b0311
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14020c7cb
call fcn.1400b2dfa
nop
xor edx, edx
mov cl, 1
call fcn.1400b1162
mov eax, dword [rsp + 0x28]
jmp 0x14020c811
add rsp, 0x68
ret

Function at 0x140f7842c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f78436
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f7845f
pop rbp
sub rbp, 0x33
sub rbp, 0xf7842c
sub rsp, 0x20
jmp 0x140f7847e
mov rax, 0xf7842c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb2a6e3c9
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f7849d
jmp 0x140f784b4
add dword [rax + 0x20], 0xc9f54042
leave
leave
or dword [rax + 8], 0xc9c9c8c1
or eax, 0x90e8120
invalid
Function at 0x1400110b4
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x1400124e0
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400240bd]
call fcn.1400113ed
movzx eax, word [rbp + 0x100]
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001aef0]
call fcn.14001137a
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011235
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d90
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014da3
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014dcd
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014de1
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014df3
xor al, al
jmp 0x140014e11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e0f
xor al, al
jmp 0x140014e11
mov al, 1
add rsp, 0x38
ret
Function at 0x1800113d5
Capabilities:
Hash data with crc32

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x5c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x1800113ea
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x50], rcx
mov dword [rbp + 0x58], edx
mov byte [rbp], 0
mov rax, qword [0x1800f6340]
test rax, rax
jne 0x180011549
mov eax, 0x40
mov edx, 0x400
mov rcx, qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x38], rcx
mov ecx, eax
mov rax, qword [rbp + 0x38]
call rax
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x180011549
mov dword [rbp + 0xc], 0
mov eax, dword [rbp + 0xc]
cmp eax, 0x100
jge 0x18001153e
mov byte [rbp], 1
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0x14], eax
mov dword [rbp + 0x18], 0
mov eax, dword [rbp + 0x18]
cmp eax, 8
jl 0x18001149c
jmp 0x180011504
mov eax, 1
add eax, dword [rbp + 0x18]
mov dword [rbp + 0x18], eax
jmp 0x180011485
movzx eax, byte [rbp]
test eax, eax
jne 0x1800114b3
lea rax, [0x180101e28]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x14]
test al, 1
je 0x1800114e4
movzx eax, byte [rbp]
test eax, eax
jne 0x1800114d1
lea rax, [0x180101e28]
mov rcx, rax
call fcn.180064a90
mov byte [rbp], 1
mov eax, dword [rbp + 0x14]
shr eax, 1
xor eax, 0xedb88320
mov dword [rbp + 0x14], eax
jmp 0x18001148f
movzx eax, byte [rbp]
test eax, eax
jne 0x1800114fb
lea rax, [0x180101e28]
mov rcx, rax
call fcn.180064a90
mov byte [rbp], 1
shr dword [rbp + 0x14], 1
jmp 0x18001148f
movzx eax, byte [rbp]
test eax, eax
jne 0x18001151b
lea rax, [0x180101e28]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0xc]
movsxd rax, eax
imul rax, rax, 4
add rax, qword [rbp + 0x28]
mov edx, dword [rbp + 0x14]
mov dword [rax], edx
mov eax, 1
add eax, dword [rbp + 0xc]
mov dword [rbp + 0xc], eax
jmp 0x180011466
mov rax, qword [rbp + 0x28]
mov qword [0x1800f6340], rax
mov rax, qword [0x1800f6340]
test rax, rax
jne 0x180011560
mov eax, 0
lea rsp, [rbp + 0x40]
pop rbp
ret
mov dword [rbp + 4], 0xffffffff
mov eax, dword [rbp + 0x58]
mov dword [rbp + 8], eax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 8]
mov dword [rbp + 0x10], eax
mov eax, 0xffffffff
add eax, dword [rbp + 8]
mov dword [rbp + 8], eax
mov eax, dword [rbp + 0x10]
test eax, eax
je 0x1800115c7
mov eax, dword [rbp + 4]
shr eax, 8
mov edx, dword [rbp + 4]
and edx, 0xff
mov rcx, qword [rbp + 0x30]
movzx ecx, byte [rcx]
movzx ecx, cl
xor edx, ecx
imul rdx, rdx, 4
add rdx, qword [0x1800f6340]
xor eax, dword [rdx]
mov dword [rbp + 4], eax
mov eax, 1
add rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rax
jmp 0x180011575
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x180014ec4
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x7c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180014edc
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x30], rbx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x14], 0
mov dword [rbp + 0x18], 0
lea rax, [rbp + 0x48]
mov dword [rax], 8
lea rax, [rbp + 0x48]
add rax, 4
mov dword [rax], 0
mov byte [rbp + 0x14], 1
mov eax, 0x67
lea rdx, [rbp + 0x48]
mov ecx, 8
lea rbx, [rbp + 8]
mov rsi, qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov dword [rbp + 0x28], ecx
mov ecx, eax
mov eax, dword [rbp + 0x28]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
test eax, eax
jl 0x180014f8b
lea rax, [rbp + 0x48]
add rax, 4
mov eax, dword [rax]
test al, 2
je 0x180014f8b
mov dword [rbp + 0x18], 1
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x24], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x58]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x24]
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x180014eed
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x7c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180014edc
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x30], rbx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x14], 0
mov dword [rbp + 0x18], 0
lea rax, [rbp + 0x48]
mov dword [rax], 8
lea rax, [rbp + 0x48]
add rax, 4
mov dword [rax], 0
mov byte [rbp + 0x14], 1
mov eax, 0x67
lea rdx, [rbp + 0x48]
mov ecx, 8
lea rbx, [rbp + 8]
mov rsi, qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov dword [rbp + 0x28], ecx
mov ecx, eax
mov eax, dword [rbp + 0x28]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
test eax, eax
jl 0x180014f8b
lea rax, [rbp + 0x48]
add rax, 4
mov eax, dword [rax]
test al, 2
je 0x180014f8b
mov dword [rbp + 0x18], 1
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x24], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x58]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x24]
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x180015b00
Capabilities:
Check if file exists

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x8c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180015b18
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x60], rax
mov dword [rbp], 0
mov eax, 1
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov dword [rbp + 8], eax
mov eax, dword [rbp + 8]
or eax, 1
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 0xc], eax
mov dword [rbp + 0x10], 0
mov eax, dword [rbp + 0x10]
cmp eax, 0x1a
jl 0x180015b9c
jmp 0x180015bff
mov eax, 1
add eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
jmp 0x180015b85
lea rax, [rbp + 0x38]
lea rdx, [0x180101eea]
mov ecx, 0x41
add ecx, dword [rbp + 0x10]
mov dword [rbp + 0x28], ecx
mov rcx, rax
mov eax, dword [rbp + 0x28]
mov r8d, eax
call fcn.1800674d0
mov dword [rbp + 0x14], eax
lea rax, [rbp + 0x38]
mov rdx, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rax
call rdx
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
cmp eax, 0xffffffff
je 0x180015b8f
mov eax, dword [rbp + 0x20]
test al, 0x10
je 0x180015b8f
mov eax, 1
mov edx, dword [rbp + 0x10]
mov ecx, edx
shl eax, cl
or eax, dword [rbp]
mov dword [rbp], eax
jmp 0x180015b8f
mov eax, dword [rbp + 8]
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 0x18], eax
mov eax, dword [rbp]
mov dword [rbp + 0x24], eax
lea rax, reloc.WS2_32.dll_accept
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x60]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x180015b29
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x8c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180015b18
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x60], rax
mov dword [rbp], 0
mov eax, 1
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov dword [rbp + 8], eax
mov eax, dword [rbp + 8]
or eax, 1
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 0xc], eax
mov dword [rbp + 0x10], 0
mov eax, dword [rbp + 0x10]
cmp eax, 0x1a
jl 0x180015b9c
jmp 0x180015bff
mov eax, 1
add eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
jmp 0x180015b85
lea rax, [rbp + 0x38]
lea rdx, [0x180101eea]
mov ecx, 0x41
add ecx, dword [rbp + 0x10]
mov dword [rbp + 0x28], ecx
mov rcx, rax
mov eax, dword [rbp + 0x28]
mov r8d, eax
call fcn.1800674d0
mov dword [rbp + 0x14], eax
lea rax, [rbp + 0x38]
mov rdx, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rax
call rdx
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
cmp eax, 0xffffffff
je 0x180015b8f
mov eax, dword [rbp + 0x20]
test al, 0x10
je 0x180015b8f
mov eax, 1
mov edx, dword [rbp + 0x10]
mov ecx, edx
shl eax, cl
or eax, dword [rbp]
mov dword [rbp], eax
jmp 0x180015b8f
mov eax, dword [rbp + 8]
mov rdx, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
call rdx
mov dword [rbp + 0x18], eax
mov eax, dword [rbp]
mov dword [rbp + 0x24], eax
lea rax, reloc.WS2_32.dll_accept
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x60]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x180015eca
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x40]
mov qword [rsp], rax
mov rax, 0x11c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180015ee2
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0xd8], rsi
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rdx
mov dword [rbp + 0x100], r8d
mov byte [rbp + 0x68], 0
lea rax, [rbp + 0x38]
mov edx, 1
mov rcx, qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov qword [rbp + 0xb0], rcx
mov rcx, rax
mov rax, qword [rbp + 0xb0]
call rax
mov dword [rbp + 0x6c], eax
lea rax, [rbp + 0x38]
mov edx, 1
mov ecx, 0
mov ebx, 0
mov rsi, qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [rbp + 0xb8], rcx
mov rcx, rax
mov rax, qword [rbp + 0xb8]
mov r8, rax
mov r9d, ebx
call rsi
mov dword [rbp + 0x70], eax
mov dword [rbp + 0x18], 0x18
mov dword [rbp + 0x28], 1
lea rax, [rbp + 0x38]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0xf0]
mov edx, 0x40000000
mov ecx, 1
lea rbx, [rbp + 0x18]
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp + 0xc0], ecx
mov rcx, rax
mov eax, dword [rbp + 0xc0]
mov r8d, eax
mov r9, rbx
call rsi
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
cmp rax, 0xffffffffffffffff
jne 0x180016059
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x74]
mov dword [rbp + 0x7c], eax
mov eax, 0
mov dword [rbp + 0x90], eax
lea rax, reloc.WS2_32.dll_closesocket
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov eax, dword [rbp + 0x90]
mov rbx, qword [rbp + 0xd0]
mov rsi, qword [rbp + 0xd8]
lea rsp, [rbp + 0xe0]
pop rbp
ret
mov byte [rbp + 0x68], 1
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xf8]
mov ecx, dword [rbp + 0x100]
lea rbx, [rbp + 8]
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0xc8], ecx
mov rcx, rax
mov eax, dword [rbp + 0xc8]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x78], eax
mov eax, dword [rbp + 0x78]
test eax, eax
jne 0x180016114
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x80], eax
mov eax, dword [rbp + 0x80]
mov dword [rbp + 0x88], eax
mov rax, qword [rbp + 0xa8]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0x8c], eax
mov eax, 0
mov dword [rbp + 0x94], eax
lea rax, reloc.WS2_32.dll_closesocket
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov eax, dword [rbp + 0x94]
mov rbx, qword [rbp + 0xd0]
mov rsi, qword [rbp + 0xd8]
lea rsp, [rbp + 0xe0]
pop rbp
ret
mov rax, qword [rbp + 0xa8]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0x84], eax
mov eax, 1
mov dword [rbp + 0x98], eax
lea rax, reloc.WS2_32.dll_closesocket
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov eax, dword [rbp + 0x98]
mov rbx, qword [rbp + 0xd0]
mov rsi, qword [rbp + 0xd8]
lea rsp, [rbp + 0xe0]
pop rbp
ret