joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800056b4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1800056e2
xor eax, eax
jmp 0x1800057c8
cmp qword [rcx + 0x68], 0
je 0x1800056f3
call fcn.1800057e4
jmp 0x1800057c8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000570a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000570c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000573e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18001fac0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1800057c2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180005775
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18000579e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18000eacc
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1800057c2
cmp rsi, rbx
ja 0x18000577c
test rsi, rsi
je 0x1800057c2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18000eacc
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180016db0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180006880
sub rsp, rax
mov rax, qword [0x180076040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180015990
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180016dff
mov rax, rbp
jmp 0x180016f07
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x78720]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180017ed0
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x78720]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180016f03
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180016f03
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180017ed0
test rax, rax
js 0x180016f03
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180016f03
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180016ef5
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180016ef5
cmp byte [rcx], 0xd
jne 0x180016edb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180016eea
cmp byte [rcx + 1], 0xa
jne 0x180016eea
inc rcx
jmp 0x180016eea
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x76470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180016ebd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180016f07
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180006010
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180017128
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18001713e
mov al, 1
jmp 0x18001719e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18001714f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18001719c
mov ecx, dword [rcx + 0x18]
nop
call fcn.18001d9ec
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001719c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18001719c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18001719c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18001719e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180017270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180078720]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1800172c7
cmp word [rdx], r13w
jne 0x1800172c7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800172cc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800173f1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x180017412
lea r9, [rdx + 2]
cmp cx, r11w
je 0x180017305
mov rdx, r9
mov word [rbx], cx
jmp 0x18001732c
cmp r9, r8
jae 0x18001733c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800172e6
jmp 0x1800173f1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800173e6
cmp dword [rsp + 0x80], esi
je 0x1800173e6
lea r8, [0x180078720]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800173be
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18001738e
mov word [rbx], r13w
jmp 0x1800173ee
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18001739b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800173ee
cmp word [rsp + 0x70], r13w
jne 0x1800173cb
cmp rbx, r14
je 0x180017388
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.180017ed8
cmp word [rsp + 0x70], r13w
je 0x1800173f1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180078720]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800173eb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800173f1
Function at 0x18001a488
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001a4b8
xor eax, eax
jmp 0x18001a57b
mov rbp, rbx
cmp word [rax], si
je 0x18001a4dd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001a4c4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001a4c0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180018ba0
movsxd r14, eax
test eax, eax
jne 0x18001a51b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001a4b1
mov rcx, r14
call fcn.180014194
mov rdi, rax
test rax, rax
jne 0x18001a534
xor ecx, ecx
call fcn.18001185c
jmp 0x18001a510
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180018ba0
test eax, eax
jne 0x18001a565
mov rcx, rdi
call fcn.18001185c
jmp 0x18001a56f
xor ecx, ecx
call fcn.18001185c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18001cdcc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180011c54
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18001ce6d
cmp ebx, dword [rsp + 0x30]
je 0x18001ce66
test esi, esi
je 0x18001ce66
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18001ce41
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18001ce4e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18001ce2b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18001ce52
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18001ce6f
mov eax, 1
jmp 0x18001ce6f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001f820
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001f848
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18001f848
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180020940
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800f8370]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x1800fbdf4], 1
jne 0x1800209a7
movzx eax, byte [0x1800fbdec]
test eax, eax
je 0x180020985
mov eax, 1
jmp 0x180020b48
movzx eax, byte [0x1800fbec1]
test eax, eax
je 0x18002099a
mov eax, 2
jmp 0x180020b48
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180020967
movzx eax, byte [0x1800fbdec]
test eax, eax
je 0x1800209bc
mov eax, 1
jmp 0x180020b48
movzx eax, byte [0x1800fbec1]
test eax, eax
je 0x1800209d1
mov eax, 2
jmp 0x180020b48
cmp dword [0x1800fbdf4], 2
jne 0x1800209fc
movzx eax, byte [0x1800fbded]
test eax, eax
je 0x1800209f1
mov eax, 0x96
jmp 0x180020b48
mov eax, dword [0x1800fbdf0]
jmp 0x180020b48
mov dword [0x1800fbdf4], 1
lea rcx, [rsp + 0x60]
call fcn.1800197e0
nop
lea rdx, [rsp + 0xc0]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [rsp + 0x38]
call fcn.180062710
nop
call fcn.180070b30
call fcn.18005e930
lea rax, [0x180021950]
mov qword [0x1800fc570], rax
call fcn.18002beb0
mov rcx, qword [rsp + 0x280]
call fcn.180020d10
call fcn.1800356d0
call fcn.180011ac0
call fcn.180011b20
mov dword [rsp + 0x20], 0
cmp dword [0x1800fbdf0], 0
jne 0x180020a98
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x64
jle 0x180020a8b
jmp 0x180020a98
mov ecx, WSAAsyncSelect
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180020a6f
mov dword [rsp + 0x20], 0
cmp dword [0x1800fc208], 0
jne 0x180020ac9
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x32
jle 0x180020abc
jmp 0x180020ac9
mov ecx, WSAAsyncSelect
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180020aa0
mov ecx, WSAAsyncSelect
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1800fbdf4], 2
movzx eax, byte [0x1800fbded]
test eax, eax
je 0x180020b0e
mov dword [rsp + 0x24], 0x96
lea rcx, [rsp + 0x38]
call fcn.180007220
nop
lea rcx, [rsp + 0x60]
call fcn.180019c50
mov eax, dword [rsp + 0x24]
jmp 0x180020b48
mov eax, dword [0x1800fbdf0]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x38]
call fcn.180007220
nop
lea rcx, [rsp + 0x60]
call fcn.180019c50
mov eax, dword [rsp + 0x28]
jmp 0x180020b48
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18007e510
add rsp, 0x278
ret
Function at 0x180035970
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800f8370]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x20], 0
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [0x1800cb6a8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18002dd50
nop
lea rdx, [0x1800cb6a2]
lea rcx, [rsp + 0x30]
call fcn.180016720
movzx eax, al
test eax, eax
je 0x1800359f6
lea rdx, [0x1800cb6a4]
lea rcx, [rsp + 0x30]
call fcn.18000e3f0
jmp 0x180035a20
lea rcx, [rsp + 0x30]
call fcn.18000ab90
mov rcx, rax
call fcn.18003fb10
movzx eax, al
test eax, eax
jne 0x180035a20
lea rdx, [0x1800cb6b8]
lea rcx, [rsp + 0x30]
call fcn.18000e3f0
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180035190
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x2a0]
call fcn.1800066e0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.180007220
nop
lea rcx, [rsp + 0x30]
call fcn.180007220
mov rax, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18007e510
add rsp, 0x298
ret
Function at 0x18003f790
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0xa0]
call fcn.1800748b0
test rax, rax
je 0x18003f7e9
mov rcx, qword [rsp + 0xa8]
call fcn.1800748b0
test rax, rax
jne 0x18003f7ee
jmp 0x18003f98d
mov rcx, qword [rsp + 0xa8]
call fcn.18000ab90
lea rdx, [rsp + 0x54]
mov rcx, rax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x18003f818
jmp 0x18003f98d
mov eax, dword [rsp + 0x48]
lea rdx, [0x1800fcaec]
mov ecx, eax
call fcn.18007f2d8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18003f846
jmp 0x18003f98d
mov rcx, qword [rsp + 0xa8]
call fcn.18000ab90
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x54]
mov rcx, rax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x18003f872
jmp 0x18003f98d
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rsp + 0x38]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x18003f896
jmp 0x18003f98d
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
and rax, 0xffff
movzx eax, ax
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rdx + rcx]
and rcx, 0xffff
movzx ecx, cx
and rcx, 0xffff
movzx ecx, cx
shl ecx, 0x10
or eax, ecx
mov dword [rsp + 0x4c], eax
cmp qword [rsp + 0x38], 0
jne 0x18003f8f8
jmp 0x18003f98d
lea rdx, [0x1800fcaec]
mov ecx, 0x80
call fcn.18007f2d8
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18003f922
jmp 0x18003f98d
mov rcx, qword [rsp + 0xa0]
call fcn.18000ab90
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x4c]
lea r8, str.StringFileInfo_08lx_s
mov edx, 0x80
mov rcx, qword [rsp + 0x40]
call fcn.18007d94c
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18003f97e
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
call fcn.18000e3f0
mov byte [rsp + 0x30], 1
xor eax, eax
test eax, eax
jne 0x18003f7c5
cmp qword [rsp + 0x38], 0
je 0x18003f9b2
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.18007dc68
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x40], 0
je 0x18003f9dd
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.18007dc68
mov qword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x30]
add rsp, 0x98
ret
Function at 0x18003fb10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18003fb33
xor al, al
jmp 0x18003fb44
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x18003fb42
mov al, 1
jmp 0x18003fb44
xor al, al
add rsp, 0x38
ret
Function at 0x18004ac00
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800f8370]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x98]
call fcn.180032620
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
call fcn.18000ab90
mov rcx, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18004ad05
mov dword [rsp + 0x24], 0
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x18]
cmp qword [rcx + rax*8], 0
je 0x18004ad03
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.18007cf80
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.1800067b0
nop
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
call fcn.180034370
nop
lea rcx, [rsp + 0x38]
call fcn.180007220
mov byte [rsp + 0x20], 1
mov r8d, reloc.WS2_32.dll_sendto
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18007d500
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x18004ac6a
jmp 0x18004ad0a
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
mov rcx, qword [rsp + 0x90]
call fcn.180007220
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18007e510
add rsp, 0x88
ret

Function at 0x18004b520
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x18004b540
mov dword [rsp + 0x30], 1
jmp 0x18004b548
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
add rsp, 0x48
ret
Function at 0x180050670
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1800f8370]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0xa0]
call fcn.1800197e0
nop
mov rax, qword [rsp + 0x170]
movzx eax, byte [rax + 0x44]
test eax, eax
je 0x1800506cf
mov dword [rsp + 0x54], 1
jmp 0x1800506d7
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 1
mov edx, 6
mov rax, qword [rsp + 0x170]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x170]
cmp dword [rax + 0x58], 0
je 0x180050748
mov rax, qword [rsp + 0x170]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x170]
mov eax, dword [rax + 0x5c]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], 1
jmp 0x180050769
mov dword [rsp + 0x8c], 0x124f80
mov dword [rsp + 0x90], 0x7d0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_inet_ntoa
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x88]
mov edx, 0x98000004
mov rax, qword [rsp + 0x170]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0xffffffff
jne 0x180050884
mov byte [rsp + 0xa0], 0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [rsp + 0x130]
call fcn.18001db00
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, [0x1800cdb40]
lea rcx, [rsp + 0x110]
call fcn.18000df20
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xa8]
call fcn.18000e300
lea rcx, [rsp + 0x110]
call fcn.180007220
nop
lea rcx, [rsp + 0x130]
call fcn.180007220
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x178]
call fcn.180019730
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0xa0]
call fcn.180019c50
mov rax, qword [rsp + 0x178]
jmp 0x1800508d5
mov byte [rsp + 0xa0], 1
lea rdx, [0x1800cdac9]
lea rcx, [rsp + 0xa8]
call fcn.18000e3f0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x178]
call fcn.180019730
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0xa0]
call fcn.180019c50
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18007e510
add rsp, 0x168
ret
Function at 0x18005b330
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x10325476
ret

Function at 0x1800610a0
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1800f8370]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180061192
mov dword [rsp + 0x48], 1
mov eax, reloc.WS2_32.dll_inet_ntoa
imul rax, rax, 0
lea rax, [rsp + rax + 0x4c]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp dword [rsp + 0x78], 0
je 0x18006111e
mov dword [rsp + 0x34], 2
jmp 0x180061126
mov dword [rsp + 0x34], 0
mov eax, reloc.WS2_32.dll_inet_ntoa
imul rax, rax, 0
mov ecx, dword [rsp + 0x34]
mov dword [rsp + rax + 0x54], ecx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180061175
mov dword [rsp + 0x38], 1
jmp 0x18006117d
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180061196
xor eax, eax
jmp 0x18006119a
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007e510
add rsp, 0x68
ret