joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d320
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0x148
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rax - 0x78]
call sub.msvcrt.dll_memset
mov dword [rsp + 0xd0], WSAGetLastError
mov rax, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ebp, ebp
cmp qword [rbx + 0x10], rbp
jne 0x50d37b
mov rcx, rbp
jmp 0x50d386
mov rcx, qword [rbx + 8]
test rcx, rcx
cmove rcx, rax
cmp qword [rdi + 0x10], rbp
jne 0x50d391
mov rdx, rbp
jmp 0x50d39c
mov rdx, qword [rdi + 8]
test rdx, rdx
cmove rdx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x50d437
mov rdi, qword [rdi + 8]
mov rax, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test rdi, rdi
cmove rdi, rax
mov rbx, qword [rbx + 8]
test rbx, rbx
cmove rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8, rbx
lea rdx, str.Run:__s__s__x
lea rcx, [rsp + 0xb0]
call fcn.0050e0a0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::runtime_error::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rdx, [0x00727f10]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll__CxxThrowException
nop
mov dword [rsp + 0x50], ebp
test sil, sil
je 0x50d460
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
add rsp, 0x148
ret
Function at 0x50d6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rax, r8
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov rbp, rcx
mov r8, r9
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
mov byte [rsp + 0x20], cl
lea r9, [rsp + 0x20]
mov rdx, rdi
mov r8d, eax
mov rcx, rbp
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__unsigned_long_long_unsigned___int64___class_std::allocator_char__const____ptr64____ptr64]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x50dc50
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0x158
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov r14, r8
mov r12, rdx
xor r15d, r15d
mov dword [rsp + 0x4c], r15d
call fcn.0050d9d0
mov dword [rsp + 0x4c], 1
lea ecx, [r15 + 8]
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x50dd18
mov rcx, qword [r12 + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
mov rcx, rsi
call fcn.0050a500
test al, al
jne 0x50dd1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x44], eax
lea rdx, [0x00727f68]
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll__CxxThrowException
mov rsi, r15
test rsi, rsi
setne r13b
mov byte [rsp + 0x80], r13b
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x5c], r14
mov dword [rsp + 0x64], 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsi]
mov edx, ebx
mov rcx, rdi
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x50dda1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rdx, [0x00727f68]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll__CxxThrowException
nop
test r13b, r13b
je 0x50ddb7
mov rcx, rsi
call fcn.0050a510
mov rcx, rsi
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
nop
mov rax, r12
mov rbx, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
mov r12, qword [rsp + 0x140]
mov r13, qword [rsp + 0x138]
mov r14, qword [rsp + 0x130]
mov r15, qword [rsp + 0x128]
add rsp, 0x158
ret

Function at 0x50f5a0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, 0x11c
mov rbx, rcx
call sub.msvcrt.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [rbx + 0x120]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x512b20
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x88
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov rsi, rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [r11 - 0x30], r12
lea rax, [r11 - 0x30]
mov qword [r11 - 0x68], rax
lea r9, [0x006dc470]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x006dc540]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x512b87
mov ecx, eax
call fcn.00692560
mov rbx, qword [rsp + 0x58]
test rbx, rbx
jne 0x512ba0
mov ecx, 0x80004003
call fcn.00692560
mov rbx, qword [rsp + 0x58]
mov ecx, Ordinal_27
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x512be3
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x006a87e8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x512be6
mov ecx, 0x8007000e
call fcn.00692560
jmp 0x512be6
mov rdi, r12
mov qword [rsp + 0x50], rdi
test rdi, rdi
jne 0x512bfb
mov ecx, 0x8007000e
call fcn.00692560
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x512c09
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rsi], r12
test rdi, rdi
je 0x512c16
mov rdx, qword [rdi]
jmp 0x512c19
mov rdx, r12
mov rax, qword [rbx]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [rax + Ordinal_26]
mov ebx, eax
test eax, eax
sets bpl
test rdi, rdi
je 0x512c80
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
jne 0x512c80
mov rcx, qword [rdi]
test rcx, rcx
je 0x512c6a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x512c78
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
mov rcx, rdi
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
test bpl, bpl
je 0x512c8c
mov ecx, ebx
call fcn.00692560
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x512cc5
mov ecx, eax
call fcn.00692560
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x512cdb
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, rsi
jmp 0x512cde
mov rax, rsi
mov rbx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
add rsp, 0x88
ret
Function at 0x5145c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40e8], 0
mov rbx, rcx
je 0x51467f
xor r11d, r11d
cmp dword [rcx + 0xbc], r11d
jbe 0x51467f
lea r10, [rcx + 0xe0]
nop
movzx ecx, byte [r10]
mov r8, qword [rbx + 0x40f8]
mov r9d, dword [rbx + 0x40f4]
mov edx, dword [rbx + 0x40ec]
and r9d, 0xfffd
inc r11d
xor cl, dl
shr edx, 8
or r9d, 2
movzx eax, cl
inc r10
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0x40f4]
mov dword [rbx + 0x40ec], ecx
movzx ecx, cl
add ecx, dword [rbx + 0x40f0]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [rbx + 0x40f0], ecx
shr ecx, 0x18
xor cl, dl
shr edx, 8
movzx eax, cl
mov eax, dword [r8 + rax*4]
xor eax, edx
mov dword [rbx + 0x40f4], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor byte [r10 - 1], al
cmp r11d, dword [rbx + 0xbc]
jb 0x5145f0
mov r9d, dword [rbx + 0xbc]
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
lea r8, [rbx + 0xe0]
call qword [rbx + reloc.WS2_32.dll_recv]
xor ecx, ecx
mov edx, 0xffffffff
cmp eax, dword [rbx + 0xbc]
mov dword [rbx + 0xbc], 0
cmovne ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x5203f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x44]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov rbp, rcx
nop
nop
mov edx, dword [rbp + 0x94]
mov ebx, dword [rbp + 0x58]
mov eax, dword [rbp + 0x44]
sub ebx, dword [rbp + 0x9c]
lea ecx, [rdi + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x5204bc
mov rcx, qword [rbp + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call sub.msvcrt.dll_memcpy
mov r8d, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
sub dword [rbp + 0x98], edi
sub dword [rbp + 0x94], edi
sub dword [rbp + 0x84], edi
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, edi
jb 0x520480
sub eax, edi
jmp 0x520482
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x520470
mov rax, qword [rbp + 0x60]
mov edx, edi
lea rcx, [rax + rdi*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, edi
jb 0x5204b0
sub eax, edi
jmp 0x5204b2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x5204a0
add ebx, edi
mov rsi, qword [rbp]
cmp dword [rsi + 8], 0
je 0x52059a
mov eax, dword [rbp + 0x94]
mov r13d, dword [rbp + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rbp + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x520542
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x520514
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.00522490
mov dword [rsi + 0x4c], eax
jmp 0x52052a
cmp ecx, 2
jne 0x52052a
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.00522250
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.msvcrt.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rbp + 0x9c], r12d
mov r9d, dword [rbp + 0x9c]
cmp r9d, 3
jb 0x520583
mov eax, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbp + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbp + 0x7c]
mov dword [rbp + 0x70], r8d
cmp r9d, 0x106
jae 0x52059a
mov rax, qword [rbp]
cmp dword [rax + 8], 0
jne 0x520420
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x527c10
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x007731a0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00773298]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x527c91
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00773298]
jmp 0x527cad
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00773298], r11
mov qword [0x00773238], rax
mov rax, qword [0x0072f1d0]
mov qword [0x00773110], r11
mov qword [0x00773220], rdi
mov dword [0x00773100], 0xc0000409
mov dword [0x00773104], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x0072f1c8]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x006ac9e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x0072f1d0]
jne 0x693ba9
rol rcx, 0x10
test cx, 0xffff
jne 0x693ba5
ret
ror rcx, 0x10
jmp 0x527c10

Function at 0x529310
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rdi
mov rsi, rdx
cmp dword [rcx + 8], 2
mov rdi, r8
jne 0x529365
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x529352
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
mov rdi, rax
jmp 0x5293b9
cmp qword [rbx + 0x10], 0
jne 0x5293a1
mov rcx, qword [rcx + 0x10]
lea rdx, [0x006a76e8]
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov qword [rbx + 0x10], rax
jne 0x5293a1
mov rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fread]
mov rdi, rax
test rdi, rdi
jne 0x5293da
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x5293d1
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
Function at 0x52a570
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x00773670]
mov ebx, ecx
mov edx, eax
inc eax
test edx, edx
mov dword [0x00773670], eax
jne 0x52a666
test cl, 1
mov rax, qword [sym.imp.msvcrt.dll_malloc]
mov qword [sub.msvcrt.dll_malloc], rax
mov rax, qword [sym.imp.msvcrt.dll_free]
mov qword [sub.msvcrt.dll_free], rax
mov rax, qword [sym.imp.msvcrt.dll_realloc]
mov qword [0x0072f1f0], rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
mov qword [0x0072f1f8], rax
mov rax, qword [sym.imp.msvcrt.dll_calloc]
mov qword [sub.msvcrt.dll_calloc], rax
je 0x52a5f6
call fcn.0052da10
test eax, eax
je 0x52a625
test bl, 2
je 0x52a640
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x52a625
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x52a61f
shr ax, 8
cmp al, 2
je 0x52a640
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
call fcn.00693b90
add rsp, 0x1d0
pop rbx
ret
call fcn.0052ff00
test eax, eax
jne 0x52a625
mov eax, dword [0x00773684]
test bl, 4
mov ecx, 1
cmovne eax, ecx
mov dword [0x00773674], ebx
mov dword [0x00773684], eax
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
call fcn.00693b90
add rsp, 0x1d0
pop rbx
ret

Function at 0x52a780
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x1d0], rax
cmp dword [0x00773670], 0
jne 0x52a850
mov rax, qword [sym.imp.msvcrt.dll_malloc]
mov dword [0x00773670], 1
mov qword [sub.msvcrt.dll_malloc], rax
mov rax, qword [sym.imp.msvcrt.dll_free]
mov qword [sub.msvcrt.dll_free], rax
mov rax, qword [sym.imp.msvcrt.dll_realloc]
mov qword [0x0072f1f0], rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
mov qword [0x0072f1f8], rax
mov rax, qword [sym.imp.msvcrt.dll_calloc]
mov qword [sub.msvcrt.dll_calloc], rax
call fcn.0052da10
test eax, eax
je 0x52a826
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x52a826
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x52a820
shr ax, 8
cmp al, 2
je 0x52a83d
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
call fcn.00693b90
add rsp, 0x1e8
ret
call fcn.0052ff00
test eax, eax
jne 0x52a826
mov dword [0x00773674], 3
lea rcx, [rsp + 0x20]
call fcn.00531a30
mov rcx, qword [rsp + 0x20]
xor edx, edx
test eax, eax
cmovne rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x1d0]
call fcn.00693b90
add rsp, 0x1e8
ret
Function at 0x52e650
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], r12
mov rsi, r8
mov ebx, 0x5a
mov r12, rdx
jne 0x52e689
xor eax, eax
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
test rdx, rdx
je 0x52e76b
test r8, r8
je 0x52e76b
lea rdx, [0x006a76e8]
mov qword [rsp + 0x58], rdi
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov rdi, rax
je 0x52e750
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x52e747
mov rcx, rdi
mov qword [rsp + 0x48], rbp
call qword [sym.imp.msvcrt.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x52e742
cmp esi, ebp
jne 0x52e742
mov rcx, rsi
call qword [sub.msvcrt.dll_malloc]
test rax, rax
mov rbp, rax
je 0x52e742
mov r9, rdi
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fread]
cmp eax, 1
jne 0x52e739
mov r9d, eax
mov r8, rsi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll_memcmp
xor ecx, ecx
test eax, eax
cmove ebx, ecx
mov rcx, rbp
call qword [sub.msvcrt.dll_free]
mov rbp, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_fclose]
mov eax, ebx
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x52e970
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x52e9ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, reloc.WS2_32.dll_getservbyport
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x52ebe0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xd0], rax
cmp dword [rcx + 0x448], 0
mov rax, qword [rsp + 0x140]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rbp, r9
lea r13, [0x006adfb8]
mov r12, r8
movsxd rsi, edx
mov rbx, rcx
je 0x52ecf6
test rax, rax
je 0x52ecf6
mov rdx, qword [rax + 0xc0]
test rdx, rdx
je 0x52ecf6
mov ecx, esi
lea r9, str.Data
dec ecx
je 0x52ec80
dec ecx
je 0x52ec70
dec ecx
je 0x52ec87
dec ecx
je 0x52ec77
jmp 0x52ecf6
lea r9, str.Header
lea rax, [0x006a3b14]
jmp 0x52ec8e
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
lea rcx, [rsp + 0x30]
mov edx, 0xa0
mov qword [rsp + 0x20], rax
call fcn.0052c8e0
mov r10, qword [rbx + 0x268]
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x52ed1d
mov rax, qword [rbx + 0x1b8]
lea r9, [rcx - 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x52ed94
mov rdi, qword [rbx + 0x268]
test rdi, rdi
je 0x52ed53
mov rax, qword [rbx + 0x1b8]
mov r9, rbp
mov r8, r12
mov edx, esi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call rdi
jmp 0x52ed94
mov r9, qword [rbx + 0x1b0]
mov edx, 2
mov rcx, r13
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x1b0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
jmp 0x52ecf6
test esi, esi
js 0x52ed92
cmp esi, 2
jg 0x52ed92
mov r9, qword [rbx + 0x1b0]
mov edx, 2
lea rcx, [rsi + rsi*2]
lea r8d, [rdx - 1]
add rcx, r13
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x1b0]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.msvcrt.dll_fwrite]
xor eax, eax
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xd0]
call fcn.00693b90
add rsp, 0x118
ret