joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bb6f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov ecx, 0x2d0
call fcn.1400cf700
xor edx, edx
mov r8d, 0x2d0
mov rcx, rax
mov rdi, rax
call fcn.1401a9240
mov qword [rdi + 8], rbx
xor ebx, ebx
mov dword [rdi + 0xb8], ebx
call fcn.1400f3d30
lea r8, [0x1400b9870]
mov r9, rdi
xor edx, edx
mov rcx, rax
call fcn.140017040
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x90], rax
call fcn.14016dcc0
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x260], 0xffffffffffffffff
mov dword [rdi + 0xd0], ebx
mov dword [rdi + 0x258], ebx
mov qword [rdi + 0xd8], rax
call fcn.14016dcc0
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x100], rax
call fcn.14016dcc0
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x108], rax
mov dword [rdi + 0x114], ebx
call fcn.14016dcc0
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x158], rax
call fcn.14016dcc0
mov rcx, qword [rdi + 8]
lea rdx, [rdi + 0x10]
lea r8, [rsp + 0x20]
mov qword [rdi + 0x160], rax
mov dword [rdi + 0x16c], ebx
mov dword [rdi + 0xe0], 1
mov dword [rdi + 0x11c], 0xffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getpeername]
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
cmp word [rsp + 0x30], 0x17
jne 0x1400bb83a
mov dword [rdi + 0xd0], 1
mov rax, qword [0x14020e120]
cmp qword [rax + 0x10], rbx
je 0x1400bb866
mov rax, qword [rax + 0x18]
mov qword [rax + 0xc0], rdi
mov rax, qword [0x14020e120]
mov rcx, qword [rax + 0x18]
mov qword [rdi + 0xc8], rcx
jmp 0x1400bb871
mov qword [rax + 0x10], rdi
mov qword [rdi + 0xc8], rbx
mov qword [rdi + 0xc0], rbx
mov rax, qword [0x14020e120]
lea rdx, str.Connected._r_n
mov rcx, rdi
mov qword [rax + 0x18], rdi
call fcn.1400b8210
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401a8ec0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400bcaa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
nop
nop
nop
nop
mov rax, qword [rdi + 0x1a8]
cmp qword [rdi + 0x1a0], rax
jne 0x1400bcb33
mov ecx, 0x10000
call fcn.1400cf700
cmp qword [rdi + 0x190], r15
mov r11, rax
je 0x1400bcb02
mov rax, qword [rdi + 0x198]
mov qword [rax], r11
jmp 0x1400bcb09
mov qword [rdi + 0x190], rax
mov qword [r11], r15
add dword [rdi + 0x1b0], 1
lea rax, [r11 + 0x10000]
mov qword [rdi + 0x1a8], rax
lea rax, [r11 + 8]
mov qword [rdi + 0x198], r11
mov qword [rdi + 0x1a0], rax
mov r8d, dword [rdi + 0x1a8]
mov rdx, qword [rdi + 0x1a0]
mov rcx, qword [rdi + 8]
sub r8d, dword [rdi + 0x1a0]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
cmp r13d, 0xffffffff
je 0x1400bcd00
test eax, eax
je 0x1400bccfc
mov rsi, qword [rdi + 0x1a0]
mov rbx, r15
lea rax, [rsi + r13]
mov qword [rdi + 0x1a0], rax
nop
cmp byte [rsi], 0xa
jne 0x1400bcca2
test rbx, rbx
mov byte [rsi], r15b
je 0x1400bcba8
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc1c0
add rsi, 1
mov rbx, rsi
jmp 0x1400bcca6
mov ecx, dword [rdi + 0x1b0]
cmp ecx, 1
jne 0x1400bcbd2
mov rdx, qword [rdi + 0x198]
mov rcx, rdi
add rdx, 8
call fcn.1400bc1c0
add rsi, 1
mov rbx, rsi
jmp 0x1400bcca6
mov eax, esi
sub eax, dword [rdi + 0x198]
sub eax, 8
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd rcx, eax
imul rcx, rcx, 0xfff8
lea rcx, [rdx + rcx + 1]
call fcn.1400cf700
mov rbp, qword [rdi + 0x190]
cmp rbp, qword [rdi + 0x198]
mov r14, rax
mov r12, rax
je 0x1400bcc41
nop
mov rbx, qword [rbp]
lea rdx, [rbp + 8]
mov r8d, 0xfff8
mov rcx, r12
call fcn.1401a8ef0
mov rcx, rbp
add r12, 0xfff8
call fcn.1400cf780
cmp rbx, qword [rdi + 0x198]
mov rbp, rbx
jne 0x1400bcc10
mov rdx, qword [rdi + 0x198]
mov eax, esi
mov rcx, r12
sub eax, dword [rdi + 0x198]
add rdx, 8
sub eax, 8
movsxd r8, eax
call fcn.1401a8ef0
sub r12, qword [rdi + 0x198]
mov rdx, r14
mov byte [r12 + rsi - 8], r15b
mov rax, qword [rdi + 0x198]
mov rcx, rdi
mov qword [rdi + 0x190], rax
mov dword [rdi + 0x1b0], 1
call fcn.1400bc1c0
mov rcx, r14
call fcn.1400cf780
add rsi, 1
mov rbx, rsi
jmp 0x1400bcca6
add rsi, 1
sub r13d, 1
jne 0x1400bcb80
test rbx, rbx
je 0x1400bcad0
mov eax, dword [rdi + 0x1a0]
mov rcx, qword [rdi + 0x198]
mov rdx, rbx
sub eax, ebx
add rcx, 8
movsxd r8, eax
call fcn.1401a8ef0
mov r11d, dword [rdi + 0x1a0]
mov rax, qword [rdi + 0x198]
sub r11d, ebx
movsxd rcx, r11d
lea rcx, [rcx + rax + 8]
mov qword [rdi + 0x1a0], rcx
jmp 0x1400bcad0
xor eax, eax
jmp 0x1400bcd12
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400be040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r14, rdx
xor edi, edi
mov r12d, r9d
lea edx, [rdi + 1]
mov r13, r8
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x1400be107
lea rdx, [rsp + 0x38]
mov rcx, rax
mov qword [rsp + 0x68], rsi
call fcn.1400d76a0
test eax, eax
je 0x1400be0f9
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x38]
test ebx, ebx
jle 0x1400be0e5
movsxd rcx, ebx
call fcn.1400cf750
test rax, rax
mov rsi, rax
je 0x1400be0f4
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be0db
cmp dword [rsp + 0x30], ebx
jne 0x1400be0db
mov r9d, r12d
mov r8, r13
mov edx, ebx
mov rcx, rsi
call r14
mov edi, eax
mov rcx, rsi
call fcn.1400cf780
jmp 0x1400be0f4
mov r9d, r12d
mov r8, r13
xor edx, edx
xor ecx, ecx
call r14
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret

Function at 0x1400be120
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xor edi, edi
lea edx, [rdi + 1]
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be1e3
lea r9, [rsp + 0x30]
lea r8d, [rdi + 0x1a]
lea rdx, [rsp + 0x38]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be1da
cmp dword [rsp + 0x30], 0x1a
jne 0x1400be1da
mov eax, dword [rsp + 0x38]
and eax, 0xffffff00
cmp eax, 0x474e5000
jne 0x1400be1da
cmp dword [rsp + 0x44], 0x52444849
jne 0x1400be1da
mov eax, dword [rsp + 0x48]
movzx ecx, byte [rsp + 0x51]
cmp cl, 2
bswap eax
mov dword [rbx], eax
mov eax, dword [rsp + 0x4c]
bswap eax
mov dword [rbx + 4], eax
movzx eax, byte [rsp + 0x50]
mov dword [rbx + 8], eax
je 0x1400be1cf
cmp cl, 4
je 0x1400be1cb
cmp cl, 6
jne 0x1400be1d5
shl eax, 2
jmp 0x1400be1d2
add eax, eax
jmp 0x1400be1d2
lea eax, [rax + rax*2]
mov dword [rbx + 8], eax
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401a8ec0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400be210
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
xor ebx, ebx
lea edx, [rbx + 1]
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be288
lea r9, [rsp + 0x70]
lea r8d, [rbx + 0x1e]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be27f
cmp dword [rsp + 0x70], 0x1e
jne 0x1400be27f
cmp word [rsp + 0x30], 0x4d42
jne 0x1400be27f
mov eax, dword [rsp + 0x42]
mov ebx, 1
mov dword [rdi], eax
mov eax, dword [rsp + 0x46]
mov dword [rdi + 4], eax
movzx eax, word [rsp + 0x4c]
mov dword [rdi + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400be500
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
xor ebx, ebx
lea edx, [rbx + 1]
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be58b
lea r9, [rsp + 0x60]
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be582
cmp dword [rsp + 0x60], 0xa
jne 0x1400be582
cmp dword [rsp + 0x30], 0x38464947
jne 0x1400be582
movzx eax, word [rsp + 0x34]
cmp ax, 0x6139
je 0x1400be567
cmp ax, 0x6137
jne 0x1400be582
movzx eax, word [rsp + 0x36]
mov dword [rdi + 8], 8
mov ebx, 1
mov dword [rdi], eax
movzx eax, word [rsp + 0x38]
mov dword [rdi + 4], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400be5a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0xf0], rax
movsxd rbp, edx
xor ebx, ebx
mov rdi, r8
lea edx, [rbx + 1]
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be752
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x1400be67e
mov edx, dword [rsp + 0x5c]
xor r8d, r8d
mov rcx, rsi
add rdx, 0xffffffffffffff80
call fcn.1400db600
test eax, eax
je case.default.0x1400be67e
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov r8d, 0x80
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je case.default.0x1400be67e
cmp dword [rsp + 0x30], 0x80
jne case.default.0x1400be67e
cmp byte [rsp + 0x70], 0x54
jne case.default.0x1400be67e
cmp byte [rsp + 0x71], 0x41
jne case.default.0x1400be67e
cmp byte [rsp + 0x72], 0x47
jne case.default.0x1400be67e
cmp ebp, 6
ja case.default.0x1400be67e
lea rcx, [0x140000000]
mov eax, dword [rcx + rbp*4 + 0xbe778]
add rax, rcx
jmp rax
lea rdx, [rsp + 0x73]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017b7b0
jmp 0x1400be744
lea rdx, [rsp + 0x91]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017b7b0
jmp 0x1400be744
lea rdx, [rsp + 0xaf]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017b7b0
jmp 0x1400be744
lea rdx, [rsp + 0xcd]
mov r8d, 4
mov rcx, rdi
call fcn.14017b7b0
jmp 0x1400be744
lea rdx, [rsp + 0xd1]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017b7b0
jmp 0x1400be744
cmp byte [rsp + 0xed], bl
jne case.default.0x1400be67e
movzx eax, byte [rsp + 0xee]
test al, al
je case.default.0x1400be67e
lea rdx, [0x1401b0f64]
movzx r8d, al
mov rcx, rdi
call fcn.1401788c0
jmp 0x1400be744
movzx eax, byte [rsp + 0xef]
cmp al, 0x7e
jae case.default.0x1400be67e
movzx edx, al
mov rdx, qword [rcx + rdx*8 + 0x1ffd40]
mov rcx, rdi
call fcn.140177ed0
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401a8ec0
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c26b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rsi, rcx
mov qword [rsp + 0x40], r12
xor ebp, ebp
nop
cmp dword [rsi + 0x90], ebp
jne 0x1400c26ea
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1400c274f
mov eax, dword [rax + 8]
mov dword [rsi + 0x90], eax
mov rax, qword [rsi + 0x68]
movsxd r8, dword [rsi + 0x90]
mov rcx, qword [rsi]
movsxd rdx, dword [rax + 8]
xor r9d, r9d
add rdx, qword [rax + 0x10]
sub rdx, r8
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400c28a4
test eax, eax
je 0x1400c2858
sub dword [rsi + 0x90], eax
jne 0x1400c26d0
mov rax, qword [rsi + 0x68]
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax]
call fcn.1400cf780
mov rcx, rbx
call fcn.1400cf780
test rdi, rdi
mov qword [rsi + 0x68], rdi
jne 0x1400c26d0
mov qword [rsi + 0x70], rbp
jmp 0x1400c26d0
cmp dword [rsi + 0x94], ebp
je 0x1400c28b1
cmp qword [rsi + 0xc0], 0xffffffffffffffff
je 0x1400c288f
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x1400c2829
nop
mov rcx, qword [rsi]
movsxd rax, edi
movsxd rdx, r12d
sub rdx, rax
xor r9d, r9d
mov r8d, edi
add rdx, qword [rsi + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov ebx, eax
je 0x1400c284b
test eax, eax
je 0x1400c2858
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 0xe0]
sub edi, ebx
mov dword [rsi + 0xc8], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x1400c27a0
cmp ebx, 1
jne 0x1400c2874
cmp dword [rsi + 0x110], ebp
jne 0x1400c28b1
mov rcx, qword [rsi]
mov edx, ebx
mov dword [rsi + 0x110], ebx
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, ebx
jmp 0x1400c285a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400c28b1
xor eax, eax
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
cmp ebx, 2
je 0x1400c2858
test ebx, ebx
jne 0x1400c28b1
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [rbx + 1]
jmp 0x1400c285a
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, 1
jmp 0x1400c285a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400c2858
mov eax, 1
jmp 0x1400c285a
Function at 0x1400c7870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x198
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea r13, str.main.css
xor esi, esi
mov rbp, rdx
mov rdi, r13
mov r12, rcx
mov ebx, esi
nop
nop
nop
mov rdx, qword [rdi]
mov rcx, rbp
call fcn.14016eea0
test eax, eax
je 0x1400c78d0
add ebx, 1
add rdi, 0x18
cmp ebx, 8
jb 0x1400c78b0
jmp 0x1400c7add
mov rcx, qword [0x14020e210]
movsxd rax, ebx
mov qword [rsp + 0x190], r15
lea r15, [rax + rax*2]
mov r8d, 0xa
movzx edx, word [r13 + r15*8 + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
je 0x1400c7ad5
mov rcx, qword [0x14020e210]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
movsxd r13, eax
jle 0x1400c7ad5
mov rcx, qword [0x14020e210]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x1400c7ad5
mov rcx, rax
mov qword [rsp + 0x1e0], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r14, rax
je 0x1400c7ac4
lea rcx, [rsp + 0x60]
call fcn.14017d460
mov rdx, qword [0x14020e210]
lea rcx, [rsp + 0x60]
call fcn.1400d97c0
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
call fcn.1400d9f70
lea rcx, [rsp + 0x60]
call fcn.1400012c0
mov r11, qword [rsp + 0x40]
lea rbx, str.main.css
mov rbx, qword [rbx + r15*8 + 8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], r11
call fcn.14017d460
lea rdx, str.200_OK_r_n
mov rcx, r12
call fcn.1400c1de0
lea rdx, str.HTTP_1.0_200_OK_r_n
mov rcx, r12
call fcn.1400c3010
lea rdx, str.Server:_Everything_HTTP_Server_r_n
mov rcx, r12
call fcn.1400c3010
lea rdx, str.Content_Type:__s_r_n
mov r8, rbx
mov rcx, r12
call fcn.1400c3010
lea rdx, str.Content_Length:__I64u_r_n
mov r8, r13
mov rcx, r12
call fcn.1400c3010
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1ac0
mov r8, qword [rsp + 0x68]
lea rdx, str.Date:__s_r_n
mov rcx, r12
call fcn.1400c3010
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1ac0
mov r8, qword [rsp + 0x68]
lea rdx, str.Last_Modified:__s_r_n
mov rcx, r12
call fcn.1400c3010
lea rdx, str.Cache_Control:_private__max_age3600_r_n
mov rcx, r12
call fcn.1400c3010
lea rdx, str.Connection:_Close_r_n
mov rcx, r12
call fcn.1400c3010
mov rdx, qword [0x14020dfb0]
cmp byte [rdx], sil
je 0x1400c7a90
mov rcx, r12
call fcn.1400c3280
lea rdx, [0x1401b0f68]
mov rcx, r12
call fcn.1400c3010
lea rcx, [rsp + 0x60]
call fcn.1400012c0
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call fcn.1400c2ee0
mov rcx, r12
call fcn.1400c28c0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x190]
mov eax, esi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x198
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c89b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
mov rax, qword [rdi + 0x58]
cmp qword [rdi + 0x50], rax
jne 0x1400c8a1a
mov ecx, 0x10000
call fcn.1400cf700
cmp qword [rdi + 0x40], r15
mov r11, rax
je 0x1400c89f8
mov rax, qword [rdi + 0x48]
mov qword [rax], r11
jmp 0x1400c89fc
mov qword [rdi + 0x40], rax
mov qword [r11], r15
add dword [rdi + 0x60], 1
lea rax, [r11 + 0x10000]
mov qword [rdi + 0x58], rax
lea rax, [r11 + 8]
mov qword [rdi + 0x48], r11
mov qword [rdi + 0x50], rax
mov r8d, dword [rdi + 0x58]
mov rdx, qword [rdi + 0x50]
mov rcx, qword [rdi]
sub r8d, dword [rdi + 0x50]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
cmp r13d, 0xffffffff
je 0x1400c8bac
test eax, eax
je 0x1400c8ba8
mov rsi, qword [rdi + 0x50]
mov rbx, r15
lea rax, [rsi + r13]
mov qword [rdi + 0x50], rax
cmp byte [rsi], 0xa
jne 0x1400c8b5d
test rbx, rbx
mov byte [rsi], r15b
je 0x1400c8a7e
mov rdx, rbx
mov rcx, rdi
call fcn.1400c7c10
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
mov ecx, dword [rdi + 0x60]
cmp ecx, 1
jne 0x1400c8aa2
mov rdx, qword [rdi + 0x48]
mov rcx, rdi
add rdx, 8
call fcn.1400c7c10
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
mov eax, esi
sub eax, dword [rdi + 0x48]
sub eax, 8
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd rcx, eax
imul rcx, rcx, 0xfff8
lea rcx, [rdx + rcx + 1]
call fcn.1400cf700
mov rbp, qword [rdi + 0x40]
cmp rbp, qword [rdi + 0x48]
mov r14, rax
mov r12, rax
je 0x1400c8b0e
nop
nop
nop
mov rbx, qword [rbp]
lea rdx, [rbp + 8]
mov r8d, 0xfff8
mov rcx, r12
call fcn.1401a8ef0
mov rcx, rbp
add r12, 0xfff8
call fcn.1400cf780
cmp rbx, qword [rdi + 0x48]
mov rbp, rbx
jne 0x1400c8ae0
mov rdx, qword [rdi + 0x48]
mov eax, esi
mov rcx, r12
sub eax, dword [rdi + 0x48]
add rdx, 8
sub eax, 8
movsxd r8, eax
call fcn.1401a8ef0
sub r12, qword [rdi + 0x48]
mov rdx, r14
mov byte [r12 + rsi - 8], r15b
mov rax, qword [rdi + 0x48]
mov rcx, rdi
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x60], 1
call fcn.1400c7c10
mov rcx, r14
call fcn.1400cf780
add rsi, 1
mov rbx, rsi
jmp 0x1400c8b61
add rsi, 1
sub r13d, 1
jne 0x1400c8a56
test rbx, rbx
je 0x1400c89d2
mov eax, dword [rdi + 0x50]
mov rcx, qword [rdi + 0x48]
mov rdx, rbx
sub eax, ebx
add rcx, 8
movsxd r8, eax
call fcn.1401a8ef0
mov r11d, dword [rdi + 0x50]
mov rax, qword [rdi + 0x48]
sub r11d, ebx
movsxd rcx, r11d
lea rcx, [rcx + rax + 8]
mov qword [rdi + 0x50], rcx
jmp 0x1400c89d2
xor eax, eax
jmp 0x1400c8bbe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400cc1b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp byte [reloc.WS2_32.dll_accept], 0
mov ebx, edx
mov rdi, rcx
je 0x1400cc277
mov ecx, edx
call fcn.1400cc0b0
test eax, eax
je 0x1400cc277
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, ebx
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
test eax, eax
mov r11d, eax
je 0x1400cc277
add ebx, 0xfffffff0
shl r11d, 0x10
cmp ebx, 0x80
ja case.0x1400cc23d.19
lea rdx, [0x140000000]
movsxd rax, ebx
movzx eax, byte [rdx + rax + 0xcc2a8]
mov ecx, dword [rdx + rax*4 + 0xcc29c]
add rcx, rdx
jmp rcx
bts r11d, 0x19
jmp case.0x1400cc23d.19
bts r11d, 0x18
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov ecx, r11d
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x1400cc277
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140177f70
mov eax, 1
jmp 0x1400cc279
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401a8ec0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x1400cc7c0
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x6b0
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
lea rcx, [rsp + 0x140]
mov rsi, r8
mov rdi, rdx
call fcn.14017d460
lea rcx, [rsp + 0x20]
call fcn.14017d460
lea rcx, [rsp + 0x480]
call fcn.14017d460
lea rcx, [rsp + 0x260]
call fcn.14017d460
lea rcx, [rsp + 0x140]
xor r12d, r12d
mov r8, rsi
mov rdx, rbx
mov ebp, r12d
call fcn.1401787d0
lea rcx, [rsp + 0x20]
mov r8, rsi
mov rdx, rdi
call fcn.1401787d0
mov rcx, qword [rsp + 0x28]
call fcn.1400d5630
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x480]
call fcn.14017e200
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x260]
call fcn.14017e200
nop
nop
nop
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x488]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400cc8cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.copy_failed:__d_n
mov edx, eax
call fcn.1400b3fe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1400cc8d5
lea ecx, [rax + 0x44]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 1
cmp ebp, 0x64
jne 0x1400cc880
jmp 0x1400cc8d5
mov r12d, 1
lea rcx, [rsp + 0x260]
call fcn.1400012c0
lea rcx, [rsp + 0x480]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x140]
call fcn.1400012c0
mov eax, r12d
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x6b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cc930
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.EVERYTHING_TASKBAR_NOTIFICATION
call fcn.1400d7fb0
test rax, rax
mov rbx, rax
je 0x1400cc9df
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400cc9df
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x100000
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
lea edx, [r9 + 0x10]
xor r8d, r8d
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400cc9d1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400cc9d1
lea r9, str.Timed_out_while_waiting_for_Everything.exe_to_close
lea r8, str._main_close_existing_process
lea rcx, str.._srcmain.c
mov edx, 0x1bc
call fcn.1400b41b0
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret