joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013c82d
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402aef90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402ae8e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402aefd9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140541020]
jmp 0x1402aefe8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14013c9e0
Capabilities:
Set environment variable

Disassembly:
jmp 0x140397d50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140137e90
lea rcx, [rsp + 0x48]
call fcn.140137e90
call fcn.1401393bc
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1401379b3
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140397dbf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1401386f6
lea rcx, [rsp + 0x78]
call fcn.1401386f6
mov eax, dword [rsp + 0x24]
jmp 0x140397e50
call fcn.1401393bc
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1401379b3
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140397e06
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1401386f6
lea rcx, [rsp + 0x78]
call fcn.1401386f6
mov eax, dword [rsp + 0x2c]
jmp 0x140397e50
lea rcx, [rsp + 0x48]
call fcn.140137d2d
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140137d2d
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1401386f6
lea rcx, [rsp + 0x78]
call fcn.1401386f6
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14013ca3a
Capabilities:
Reference sql statements

Disassembly:
jmp 0x14016c660
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x168]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
mov dword [rbp + 4], 0
movzx eax, byte [0x1404535b2]
test eax, eax
jne 0x14016c6b3
xor eax, eax
jmp 0x14016c76c
xor edx, edx
mov ecx, dword [rbp + 0x130]
call fcn.14013b298
mov qword [rbp + 0xf8], rax
mov rax, qword [0x140453638]
mov qword [rbp + 0x100], rax
mov eax, dword [rbp + 0x138]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0xf8]
lea r8, str.loginlog
lea rdx, str.SELECT_count___FROM___s__WHERE__ip____s_AND___rcode___0_OR__rcode___1__AND__time____NOW_____INTERVAL__d_MINUTE
mov rcx, qword [rbp + 0x100]
call fcn.140138935
cmp eax, 0xffffffff
jne 0x14016c724
mov eax, dword [0x14044e340]
add eax, 8
mov r8d, eax
lea rdx, str.C:UsersuserDesktop_raTest_srcloginloginlog.cpp
mov rcx, qword [0x140453638]
call fcn.140138584
mov rcx, qword [0x140453638]
call fcn.1401360db
test eax, eax
jne 0x14016c769
xor r9d, r9d
lea r8, [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x140453638]
call fcn.140136c66
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.140136a1d
mov dword [rbp + 4], eax
mov rcx, qword [0x140453638]
call fcn.140135b45
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b8a6
mov rax, rdi
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x14013ce31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14017de60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x130
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, setsockopt
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x14044e640]
xor rax, rbp
mov qword [rbp + 0x108], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
lea rax, [rbp + 8]
lea rcx, str.0123456789abcdef
mov rdi, rax
mov rsi, rcx
mov ecx, setsockopt
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x38], 0
jmp 0x14017dee1
mov rax, qword [rbp + 0x38]
inc rax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x140]
cmp qword [rbp + 0x38], rax
jae 0x14017df68
mov rax, qword [rbp + 0x138]
movzx eax, byte [rax]
and eax, 0xf0
sar eax, 4
cdqe
mov rcx, qword [rbp + 0x130]
movzx eax, byte [rbp + rax + 8]
mov byte [rcx], al
mov rax, qword [rbp + 0x130]
inc rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x138]
movzx eax, byte [rax]
and eax, 0xf
sar eax, 0
cdqe
mov rcx, qword [rbp + 0x130]
movzx eax, byte [rbp + rax + 8]
mov byte [rcx], al
mov rax, qword [rbp + 0x130]
inc rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x138]
inc rax
mov qword [rbp + 0x138], rax
jmp 0x14017ded6
mov rax, qword [rbp + 0x130]
mov byte [rax], 0
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b8a6
mov rax, rdi
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
call fcn.140138d40
lea rsp, [rbp + 0x110]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013cea9
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x1401795a0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x14044e640]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
mov dword [rbp + 4], 0
cmp qword [rbp + 0x260], 0
je 0x140179607
cmp dword [rbp + 0x268], 0
jg 0x14017960e
xor eax, eax
jmp 0x1401796eb
mov edx, 0xff
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14017963a
lea rcx, str.socket_getips:_No_hostname_defined__n
call fcn.1401388b3
xor eax, eax
jmp 0x1401796eb
lea rcx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x140179668
lea rcx, str.socket_getips:_Cannot_resolve_our_own_hostname_to_an_IP_address_n
call fcn.1401388b3
xor eax, eax
jmp 0x1401796eb
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x148], rax
jmp 0x140179684
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x268]
cmp dword [rbp + 4], eax
jge 0x1401796c8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
cmp qword [rcx + rax*8], 0
je 0x1401796c8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x260]
mov dword [rdx + rcx*4], eax
jmp 0x14017967c
cmp dword [rbp + 4], 0
jne 0x1401796e8
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x260]
mov dword [rcx + rax*4], 0x7f000001
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b8a6
mov rax, rdi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.140138d40
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret

Function at 0x14013d110
Capabilities:
Resolve dns

Disassembly:
jmp 0x1401770c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14017711c
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbp + 0xd4], eax
jmp 0x140177126
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14013d5cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14036da30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14044e640]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x28], 0
jmp 0x14036da6c
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x20
jge 0x14036da98
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x20
jae 0x14036da87
jmp 0x14036da8c
call fcn.14013aaf5
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x68], 0
jmp 0x14036da62
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
and eax, 7
mov ecx, 1
mov dword [rsp + 0x40], ecx
movzx ecx, al
mov eax, dword [rsp + 0x40]
shl eax, cl
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x68], al
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x44], 0
jne 0x14036daa5
cmp qword [rsp + 0xa0], 0
je 0x14036db25
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
jmp 0x14036db35
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x14036db96
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x14036db96
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14036db49
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x14036dbaf
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x14036dc06
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x14036dc04
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14036dc06
jmp 0x14036dba2
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
je 0x14036dc2e
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jmp 0x14036dc37
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140138d40
add rsp, 0x98
ret
Function at 0x14037f5d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401366d5
sub rsp, rax
mov rax, qword [0x14044e640]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14051f530]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14037f7c2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14037f716
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14037f716
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14037f6fb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14037f698
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14037f782
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14037f7e1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14037f7bd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14037f7e1
jmp 0x14037f66e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140138d40
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14037f890
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401366d5
sub rsp, rax
mov rax, qword [0x14044e640]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14051f530]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14037fa9d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14037f9e9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14037f9e9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14037f9c9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14037f958
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14037fa5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14037fabc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14037fa98
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14037fabc
jmp 0x14037f92e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140138d40
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140004d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd r10, dword [0x140028800]
movsxd r9, dword [0x140028808]
movsxd rdi, dword [0x1400287fc]
movsxd rax, dword [0x1400287f8]
movsxd r8, dword [0x140028804]
mov rsi, rcx
mov r11, r10
mov rbp, rdx
mov ebx, 2
sub rbx, r9
imul r11, rax
inc rax
imul rbx, r8
imul rax, rdi
sub rbx, rax
mov eax, 1
sub rax, r8
add rbx, r11
add rbx, r10
imul rax, r10
lea rdx, [rcx + rbx]
sub rax, r11
add rax, r9
xor r9d, r9d
add rax, rdi
lea rax, [rax + rax*2]
shl rax, 7
movsxd rcx, dword [rax + rcx + 0x3c]
lea rax, [rdx + rbx*4]
mov edx, dword [rcx + rax + 0x88]
add rdx, rsi
mov r10d, dword [rdx + 0x20]
mov ebx, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x24]
mov r11d, dword [rdx + 0x18]
add r10, rsi
add rbx, rsi
add rdi, rsi
test r11d, r11d
je 0x140004e43
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r10]
mov r8, rbp
add rax, rsi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140004e33
inc rax
test ecx, ecx
jne 0x140004e20
test edx, edx
je 0x140004e5a
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x140004e10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov eax, dword [0x1400287fc]
mov ecx, dword [0x1400287f4]
imul ecx, dword [0x140028800]
imul eax, dword [0x140028804]
sub ecx, eax
sub ecx, dword [0x140028808]
add ecx, dword [0x1400287fc]
add ecx, dword [0x140028800]
add ecx, r9d
movzx ecx, word [rdi + rcx*2]
mov eax, dword [rbx + rcx*4]
add rax, rsi
jmp 0x140004e45
Function at 0x140005530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
lea rax, [rbp - 0x20]
mov rbx, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, str.SoftwareMessageCrackerWizard
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400056f0
movups xmm0, xmmword [0x140023640]
lea rcx, [rbp - 0x18]
lea rax, [rbx + 4]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x20]
lea rdx, str.wRect.Top
movups xmmword [rbx], xmm0
xor r9d, r9d
xor r8d, r8d
mov dword [rbp - 0xc], edi
mov dword [rbp - 0x14], 0xffffffff
mov dword [rbp - 0x10], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.wRect.Left
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp - 0x18]
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x20]
lea rdx, str.wRect.Right
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp - 0x18]
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x20]
lea rdx, str.wRect.Bottom
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0xc]
lea rdx, str.DarkMode
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x14]
lea rdx, str.StayOnTop
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
lea rdx, str.WindowAlpha
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbp - 0xc], edi
mov rcx, qword [rbp - 0x20]
setne al
cmp dword [rbp - 0x14], edi
mov byte [rbx + 0x10], al
setne al
mov byte [rbx + 0x11], al
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x14], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000570c
lea r8, str.Message_Cracker_Wizard
lea rdx, str.Cannot_load_or_create_MessageCrackerWizard_registry_entries
mov r9d, 0x10030
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140006d60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005730
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rax, [rsp + 0x50]
mov rdi, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rdx, str.SoftwareMessageCrackerWizard
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400058e5
mov rcx, qword [rsp + 0x50]
mov eax, ebx
lea rdx, str.wRect.Top
cmp byte [rdi + 0x10], al
mov r9d, 4
mov dword [rsp + 0x28], 4
setne al
cmp byte [rdi + 0x11], bl
setne bl
mov dword [rsp + 0x5c], eax
lea rax, [rdi + 4]
xor r8d, r8d
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.wRect.Left
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 8]
lea rdx, str.wRect.Right
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0xc]
lea rdx, str.wRect.Bottom
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
lea rdx, str.DarkMode
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.StayOnTop
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x14]
lea rdx, str.WindowAlpha
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005901
lea r8, str.Message_Cracker_Wizard
lea rdx, str.Cannot_load_or_create_MessageCrackerWizard_registry_entries
mov r9d, 0x10030
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140006d60
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x140008914
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000877c