joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022950
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x10050650]
mov qword [rsp + 0xd0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r12
mov r12, rdx
mov rbx, r8
lea rcx, [rsp + 0x41]
xor dil, dil
xor edx, edx
mov r8d, 0x87
mov byte [rsp + 0x40], dil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov r8d, 0x1001
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OpenFile]
test eax, eax
movsxd rsi, eax
jne 0x100229ed
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x10041710]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10024b50
lea rdx, str._comm__write_file__s__OpenFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10024c50
jmp 0x10022a4c
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10022a40
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x10041748]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10024b50
lea rdx, str._comm__write_file__s__WriteFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10024c50
jmp 0x10022a43
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x128]
mov al, dil
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
call fcn.1003b040
add rsp, 0x108
ret
Function at 0x10022e30
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x10023600
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1198
call fcn.1003b070
sub rsp, rax
mov rax, qword [0x10050650]
mov qword [rsp + 0x1170], rax
cmp ecx, dword [reloc.WS2_32.dll_connect]
mov qword [rsp + 0x1180], rdi
mov edi, ecx
jb 0x10023846
test rdx, rdx
je 0x10023846
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x1188], rsi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x870]
xor edx, edx
mov r8d, 0x900
call sub.msvcrt.dll_memset
xor esi, esi
lea rcx, [rsp + 0x58]
cmp edi, 8
cmova edi, esi
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x62]
movzx edx, word [rsp + 0x60]
movzx r9d, word [rsp + 0x5a]
lea rax, [0x100507d0]
mov r11d, edi
movzx edi, word [rsp + 0x5e]
lea r8, str.GWCLI
mov qword [rsp + 0x48], r8
shl r11, 4
lea r8, str.__02d__02d__02d:_02d:_02d___s___s_
add r11, rax
movzx eax, word [rsp + 0x64]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rcx, [rsp + 0x70]
mov edx, 0x800
mov dword [rsp + 0x20], edi
call fcn.100235a0
mov r8, qword [rsp + 0x11a8]
lea r9, [rsp + 0x11b0]
lea rcx, [rsp + 0x870]
mov edx, 0x800
call qword [sym.imp.msvcrt.dll__vsnprintf]
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x70]
mov r8d, 0x7ff
call qword [sym.imp.msvcrt.dll_strncat]
lea rdx, [0x1004183c]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x86f], sil
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
lea rdx, [0x10041840]
lea rcx, [rsp + 0x70]
mov r8d, 0x7ff
call qword [sym.imp.msvcrt.dll_strncat]
mov eax, dword [reloc.WS2_32.dll_accept]
mov byte [rsp + 0x86f], sil
test al, 1
je 0x1002377f
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [reloc.WS2_32.dll_accept]
test al, 2
je 0x1002383e
mov qword [rsp + 0x30], rsi
lea rcx, str.c:gwlog.txt
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x1190], rbx
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x10023836
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x20000
jbe 0x100237fe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
not rcx
mov qword [rsp + 0x20], rsi
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1190]
mov rsi, qword [rsp + 0x1188]
mov rdi, qword [rsp + 0x1180]
mov rcx, qword [rsp + 0x1170]
call fcn.1003b040
add rsp, 0x1198
ret
Function at 0x10023bd0
Capabilities:
Get mac address on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov dword [rcx], 0
mov rbp, rcx
mov qword [rsp + 0x78], rdi
mov ecx, 0x2c0
mov qword [rsp + 0x50], r12
xor r12b, r12b
mov esi, edx
call qword [sym.imp.msvcrt.dll_malloc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x2c0
mov rcx, rax
mov rdi, rax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10023c3d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x10023da1
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x60], rbx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10023d8b
test rdi, rdi
mov rbx, rdi
je 0x10023d99
cmp dword [rbx + 0x194], 6
jne 0x10023d7f
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
mov r11, rax
je 0x10023d7f
lea r9, [rbx + 0x1b8]
test r9, r9
je 0x10023d7f
nop
nop
nop
lea r8, [r9 + 8]
mov rax, r11
sub r8, r11
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x10023cc3
inc rax
test ecx, ecx
jne 0x10023cb0
test edx, edx
je 0x10023cd4
mov r9, qword [r9]
test r9, r9
jne 0x10023ca0
jmp 0x10023d7f
movzx edx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19b]
movzx r11d, byte [rbx + 0x19a]
movzx r9d, byte [rbx + 0x199]
movzx r8d, byte [rbx + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
lea rdx, [0x10041868]
lea rcx, [rbp + 4]
mov r12b, 1
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
movzx r11d, byte [rbx + 0x198]
mov byte [rbp + 0x84], r11b
movzx eax, byte [rbx + 0x199]
mov byte [rbp + 0x85], al
movzx eax, byte [rbx + 0x19a]
mov byte [rbp + 0x86], al
movzx eax, byte [rbx + 0x19b]
mov byte [rbp + 0x87], al
movzx eax, byte [rbx + 0x19c]
mov byte [rbp + 0x88], al
movzx eax, byte [rbx + 0x19d]
mov dword [rbp], 1
mov byte [rbp + 0x89], al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x10023c63
test rdi, rdi
je 0x10023d99
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov al, r12b
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x58
ret
Function at 0x100244b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor al, al
add rsp, 0x28
ret

Function at 0x100244d0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
cmp ecx, 1
jl 0x100244de
cmp ecx, 3
jle 0x10024510
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
movzx r11d, ax
jne 0x100244f8
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
mov ecx, 3
cmp r11w, 0x404
cmove eax, ecx
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x100245e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x10050650]
mov qword [rsp + 0x100], rax
cmp byte [0x10054d00], 0
jne 0x10024819
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x64]
xor ebx, ebx
xor edx, edx
mov r8d, 0x98
mov dword [rsp + 0x60], ebx
mov qword [r11 + 0x20], rdi
call sub.msvcrt.dll_memset
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x2c]
xor edx, edx
mov dword [rsp + 0x28], ebx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov dword [0x10054d24], ebx
call fcn.100208c0
lea rdx, str.kernel32.dll
test rdx, rdx
mov rsi, rbx
je 0x1002467b
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1002467b
mov rcx, rdx
call sub.KERNEL32.dll_LoadLibraryA
mov rsi, rax
lea rdx, str.GetNativeSystemInfo
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
mov rcx, rsi
mov rdi, rax
call fcn.100208c0
test rdi, rdi
mov rsi, qword [rsp + 0x130]
je 0x100246ab
lea rcx, [rsp + 0x28]
call rdi
jmp 0x100246b6
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100247dc
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
movzx eax, word [rsp + 0x6c]
cmp edx, 5
mov dword [0x10054d14], edx
mov dword [0x10054d18], ecx
mov dword [0x10054d20], eax
jne 0x10024793
test ecx, ecx
jne 0x1002470c
mov dword [0x10054d10], 1
jmp 0x10024809
cmp ecx, 1
jne 0x10024720
mov dword [0x10054d10], 2
jmp 0x10024809
cmp ecx, 2
jne 0x10024809
cmp byte [rsp + 0xfa], 1
jne 0x1002474a
cmp word [rsp + 0x28], 9
jne 0x1002474a
mov dword [0x10054d10], 3
jmp 0x10024809
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10024787
cmp word [rsp + 0xf8], 0x8000
je 0x10024787
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10024809
mov dword [0x10054d10], 5
jmp 0x10024809
mov dword [0x10054d10], 4
jmp 0x10024809
cmp edx, 6
jne 0x10024809
test ecx, ecx
jne 0x100247b1
cmp byte [rsp + 0xfa], 1
setne bl
add ebx, edx
mov dword [0x10054d10], ebx
jmp 0x10024809
cmp ecx, 1
jne 0x100247cb
cmp byte [rsp + 0xfa], cl
sete bl
add ebx, 8
mov dword [0x10054d10], ebx
jmp 0x10024809
cmp ecx, 2
jne 0x10024809
mov dword [0x10054d10], 0xa
jmp 0x10024809
xor ecx, ecx
call fcn.1001f320
lea rdx, str._error_
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__detect_OS_type_failed:__s
mov rcx, rax
mov r8, rdi
call fcn.10024c50
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov byte [0x10054d00], 1
mov rcx, qword [rsp + 0x100]
call fcn.1003b040
add rsp, 0x118
ret
Function at 0x10024b70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
lea rsi, [0x10054db0]
xor edx, edx
mov r8d, 0x5000
mov rcx, rsi
mov qword [rsp + 0x40], rdi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x30]
lea rdi, [rsp + 0x70]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x10041bc0]
mov rcx, rsi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_swprintf]
mov rdx, qword [rsp + 0x68]
mov r8, rdi
movsxd rbx, eax
lea rcx, [rsi + rbx*2]
call qword [sym.imp.msvcrt.dll_vswprintf]
lea rdx, [0x10041be8]
add eax, ebx
cdqe
lea rcx, [rsi + rax*2]
call qword [sym.imp.msvcrt.dll_swprintf]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x10024c50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2801
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], rdi
call fcn.10001dd0
xor eax, eax
lea rcx, [rsp + 0x30]
lea rsi, [rsp + 0x90]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
mov rdi, qword [rsp + 0x50]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.__02u:_02u:_02u__s
mov rcx, rdi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
mov rdx, qword [rsp + 0x88]
mov r8, rsi
movsxd rbx, eax
lea rcx, [rdi + rbx]
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rdx, [0x10041bbc]
add ebx, eax
movsxd rcx, ebx
add rcx, rdi
call qword [sym.imp.msvcrt.dll_sprintf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rdi, rdi
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
je 0x10024d3e
mov rcx, rdi
call fcn.1003aa90
mov rdi, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x10026bd0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x10050650]
mov qword [rsp + 0xe0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbp, rcx
mov rbx, rdx
lea rcx, [rsp + 0x51]
mov r8d, 0x87
xor edx, edx
mov qword [r11 - 8], rsi
mov byte [rsp + 0x50], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
xor esi, esi
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x10026cf9
mov qword [rsp + 0xf8], rdi
movsxd rdi, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [rsp + 0x30], eax
je 0x10026ce8
lea rcx, [rsp + 0x38]
mov edx, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001dd0
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10026cdb
lea edx, [rsi + 1]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001dd0
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.10025de0
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rbp
call fcn.10026310
test rsi, rsi
je 0x10026cdb
mov rcx, rsi
call fcn.1003aa90
test rbx, rbx
je 0x10026ce8
mov rcx, rbx
call fcn.1003aa90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
call fcn.1003b040
add rsp, 0x108
ret

Function at 0x10028050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
mov rbx, rdx
mov rax, r8
lea rdx, [rsp + 0x68]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10028096
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret
Function at 0x100280b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2878
call fcn.1003b070
sub rsp, rax
mov rax, qword [0x10050650]
mov qword [rsp + 0x2840], rax
mov qword [rsp + 0x2870], rbx
mov qword [rsp + 0x2868], rbp
mov rbx, rcx
mov qword [rsp + 0x2860], rsi
mov rbp, rdx
mov rsi, r8
lea rcx, [rsp + 0x41]
mov r8d, 0x27ff
xor edx, edx
mov qword [rsp + 0x2858], rdi
mov dword [rsp + 0x30], 0x2800
mov byte [rsp + 0x40], 0
mov rdi, r9
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [rsp + 0x2858]
test eax, eax
mov ebx, eax
jne 0x10028185
mov rax, qword [rsi]
mov edx, dword [rsp + 0x30]
test rax, rax
je 0x1002815e
cmp rax, rdx
jbe 0x10028161
mov qword [rsi], rdx
mov r8, qword [rsi]
test r8, r8
je 0x10028183
lea rdx, [rsp + 0x40]
dec r8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncpy]
mov r11, qword [rsi]
mov byte [r11 + rbp - 1], 0
mov eax, ebx
mov rsi, qword [rsp + 0x2860]
mov rbp, qword [rsp + 0x2868]
mov rbx, qword [rsp + 0x2870]
mov rcx, qword [rsp + 0x2840]
call fcn.1003b040
add rsp, 0x2878
ret

Function at 0x10028210
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x10028250
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
pop rdi
ret
Function at 0x1002a7a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x48], r13
mov ebp, r8d
mov rbx, rdx
mov r13, rcx
jne 0x1002a806
lea rdx, [0x10041fe8]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_Invalid_Socket.
mov rcx, rax
call fcn.10024c50
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
test rdx, rdx
jne 0x1002a84f
lea rdx, [0x10042028]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_NULL_buffer.
mov rcx, rax
call fcn.10024c50
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r8d, r8d
mov esi, r12d
je 0x1002a8e4
nop
nop
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
add rdx, rbx
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002a89a
test eax, eax
je 0x1002a8e4
add r12d, eax
sub ebp, eax
jne 0x1002a870
jmp 0x1002a8e4
mov qword [rsp + 0x78], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1001f320
lea rdx, [0x10042060]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10024c50
mov rdi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
test ebp, ebp
mov rbp, qword [rsp + 0x68]
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x58
ret
Function at 0x1002a910
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r13
mov ebp, r9d
mov r13, rcx
mov rbx, r8
mov rdi, rdx
jne 0x1002a96f
lea rdx, [0x10042090]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_Invalid_Socket.
mov rcx, rax
call fcn.10024c50
mov eax, 0xffffffff
jmp 0x1002aa49
test rbx, rbx
jne 0x1002a9a7
lea rdx, [0x100420d0]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_NULL_buffer.
mov rcx, rax
call fcn.10024c50
lea eax, [rbx - 1]
jmp 0x1002aa49
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r9d, r9d
mov esi, r12d
je 0x1002aa37
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
mov r8d, ebp
add rdx, rbx
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002a9f7
test eax, eax
je 0x1002aa37
add r12d, eax
sub ebp, eax
jne 0x1002a9c0
jmp 0x1002aa37
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1001f320
lea rdx, [0x10042110]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10024b50
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10024c50
test ebp, ebp
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1002ab20
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rcx
mov rcx, qword [rcx]
mov ebx, r8d
cmp rcx, 0xffffffffffffffff
jne 0x1002ab7c
lea rdx, [0x10042140]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_Invalid_Socket.
mov rcx, rax
call fcn.10024c50
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
test rdx, rdx
jne 0x1002abc0
lea rdx, [0x10042180]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_NULL_buffer.
mov rcx, rax
call fcn.10024c50
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
cmp byte [rsi + 8], 0
mov qword [rsp + 0x58], rbp
je 0x1002abe4
mov r8d, 1
test ebx, ebx
cmovg r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
jmp 0x1002ac12
lea rax, [rsp + 0x30]
mov r8d, 1
test ebx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
cmovg r8d, ebx
xor r9d, r9d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1002ac63
mov qword [rsp + 0x68], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1001f320
lea rdx, [0x100421b8]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10024b50
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10024c50
mov rdi, qword [rsp + 0x68]
jmp 0x1002ac96
test ebp, ebp
jne 0x1002ac96
test ebx, ebx
jle 0x1002ac96
lea rdx, [0x100421e8]
lea rcx, [rsp + 0x30]
call fcn.10024b50
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_info:_The_connection_has_been_gracefully_closed.
mov rcx, rax
call fcn.10024c50
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret