joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140106f10
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x140106f56
lea rdx, str.WSAStartup_failed___d_
mov r8d, eax
mov rcx, rbx
call fcn.1400fe410
jmp 0x140106f85
call qword [sym.imp.WSOCK32.dll_WSACleanup]
movzx r11d, word [rsp + 0x20]
cmp r11b, 2
jne 0x140106f76
shr r11w, 8
test r11b, r11b
jne 0x140106f76
xor eax, eax
jmp 0x140106f8a
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.1400fe410
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x1d0
pop rbx
ret

Function at 0x140107180
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x120]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x11], dl
mov byte [rax + 0x12], r8b
lea r8d, [r9 + 3]
lea rdx, [rax + 0x10]
mov byte [rax + 0x10], 0xff
call qword [sym.imp.WSOCK32.dll_send]
test eax, eax
jns 0x1401071de
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400fe410
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140107040
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140107210
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
movsxd r11, edx
mov rbx, rcx
mov r9, qword [rax + 0x87c0]
cmp r8d, 1
jne 0x140107283
mov r10d, dword [r9 + r11*4 + 0xc08]
test r10d, r10d
je 0x140107265
sub r10d, 2
je 0x140107297
dec r10d
jne 0x1401072cd
cmp dword [r9 + r11*4 + 0x1008], 0
jne 0x1401072cd
mov dword [r9 + r11*4 + 0x1008], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfd
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 2
add rsp, 0x20
pop rbx
jmp fcn.140107180
mov ecx, dword [r9 + r11*4 + 0xc08]
dec ecx
je 0x1401072b1
dec ecx
je 0x140107248
dec ecx
jne 0x1401072cd
mov ecx, dword [r9 + r11*4 + 0x1008]
dec ecx
jne 0x1401072cd
mov dword [r9 + r11*4 + 0x1008], ecx
add rsp, 0x20
pop rbx
ret
mov edx, 0xfe
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 3
call fcn.140107180
add rsp, 0x20
pop rbx
ret
Function at 0x1401072e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x87c0]
mov r10d, dword [r8 + r9*4 + 0xc08]
test r10d, r10d
je 0x140107394
sub r10d, 2
je 0x14010734a
dec r10d
jne 0x14010737e
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140107339
dec ecx
jne 0x14010737e
mov dword [r8 + r9*4 + 0xc08], 1
mov dword [r8 + r9*4 + 0x1008], ecx
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140107383
dec ecx
jne 0x14010737e
mov dword [r8 + r9*4 + 0x1008], ecx
mov dword [r8 + r9*4 + 0xc08], 3
mov rcx, r11
mov r8d, edx
mov edx, 0xfe
call fcn.140107180
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x1408], 1
jne 0x140107371
mov dword [r8 + r9*4 + 0xc08], 1
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140107180

Function at 0x1401073c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x87c0]
mov r10d, dword [r8 + r9*4 + 0xc08]
dec r10d
je 0x14010745f
dec r10d
je 0x140107438
dec r10d
jne 0x140107476
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140107429
dec ecx
jne 0x140107476
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140107180
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140107429
dec ecx
jne 0x140107476
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.140107180
add rsp, 0x28
ret

Function at 0x140107480
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
movsxd r11, edx
mov rbx, rcx
mov r9, qword [rax + 0x87c0]
cmp r8d, 1
jne 0x1401074e9
mov r10d, dword [r9 + r11*4 + 8]
test r10d, r10d
je 0x1401074ce
sub r10d, 2
je 0x1401074fa
dec r10d
jne 0x14010752d
cmp dword [r9 + r11*4 + 0x408], 0
jne 0x14010752d
mov dword [r9 + r11*4 + 0x408], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfb
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 2
add rsp, 0x20
pop rbx
jmp fcn.140107180
mov ecx, dword [r9 + r11*4 + 8]
dec ecx
je 0x140107514
dec ecx
je 0x1401074b1
dec ecx
jne 0x14010752d
mov ecx, dword [r9 + r11*4 + 0x408]
dec ecx
jne 0x14010752d
mov dword [r9 + r11*4 + 0x408], ecx
add rsp, 0x20
pop rbx
ret
mov edx, 0xfc
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 3
call fcn.140107180
add rsp, 0x20
pop rbx
ret
Function at 0x140107540
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x87c0]
mov r10d, dword [r8 + r9*4 + 8]
test r10d, r10d
je 0x1401075e5
sub r10d, 2
je 0x1401075a1
dec r10d
jne 0x1401075d2
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x140107593
dec ecx
jne 0x1401075d2
mov dword [r8 + r9*4 + 8], 1
mov dword [r8 + r9*4 + 0x408], ecx
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 8], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x1401075d7
dec ecx
jne 0x1401075d2
mov dword [r8 + r9*4 + 0x1008], ecx
mov dword [r8 + r9*4 + 8], 3
mov rcx, r11
mov r8d, edx
mov edx, 0xfc
call fcn.140107180
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 8], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x808], 1
jne 0x1401075c5
mov dword [r8 + r9*4 + 8], 1
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.140107180

Function at 0x140107610
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x87c0]
mov r10d, dword [r8 + r9*4 + 8]
dec r10d
je 0x14010769f
dec r10d
je 0x14010767b
dec r10d
jne 0x1401076b3
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x14010766f
dec ecx
jne 0x1401076b3
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.140107180
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x14010766f
dec ecx
jne 0x1401076b3
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.140107180
add rsp, 0x28
ret
Function at 0x140108b30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x128]
mov r8b, 1
xor edx, edx
mov rbp, rcx
call fcn.1400fe8d0
test eax, eax
jns 0x140108b82
lea rdx, str.Timed_out_before_server_could_connect_to_us
mov rcx, rbx
call fcn.1400fe410
mov eax, Ordinal_30
jmp 0x140108c43
mov qword [rsp + 0x58], rdi
or rdi, 0xffffffffffffffff
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
call fcn.140110680
cmp eax, edi
je 0x140108c2a
test eax, eax
je 0x140108c21
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
call qword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x140108be2
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
call qword [sym.imp.WSOCK32.dll_accept]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.WSOCK32.dll_closesocket]
mov rcx, rbx
cmp rdi, 0xffffffffffffffff
jne 0x140108bfd
lea rdx, str.Error_accept__ing_server_connect
jmp 0x140108c34
lea rdx, str.Connection_accepted_from_server_n
call fcn.1400fe360
mov edx, 1
mov rcx, rdi
mov qword [rbp + 0x128], rdi
call fcn.140114f10
xor eax, eax
jmp 0x140108c3e
lea rdx, str.Timeout_while_waiting_for_server_connect
jmp 0x140108c31
lea rdx, str.Error_while_waiting_for_server_connect
mov rcx, rbx
call fcn.1400fe410
mov eax, reloc.WLDAP32.dll_Ordinal_30
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025db20
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x14010b190
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x474]
mov rdi, rcx
cmp edx, 0xc8
je 0x14010b20e
test ebx, ebx
jne 0x14010b1cc
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.1400fe360
mov byte [rdi + 0x1f9], bl
inc ebx
cmp ebx, 2
jne 0x14010b1f5
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.1400fe410
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14010a0e0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.1400fe360
xor edx, edx
mov rcx, rdi
call fcn.140109200
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14010b240
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x14010b292
lea rdx, str.Couldnt_set_desired_mode
call fcn.1400fe410
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x14010b2a7
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.1400fe360
cmp edi, 0x13
jne 0x14010b2b6
mov rcx, rsi
call fcn.14010a870
jmp 0x14010b2e1
cmp edi, 0x14
jne 0x14010b2c5
mov rcx, rsi
call fcn.14010a8c0
jmp 0x14010b2e1
cmp edi, 0x15
jne 0x14010b2d4
mov rcx, rsi
call fcn.140109240
jmp 0x14010b2e1
cmp edi, 0x16
jne 0x14010b2e3
mov rcx, rsi
call fcn.140109250
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010b8f0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test dl, dl
mov edi, 0x49
mov eax, 0x41
cmovne edi, eax
mov esi, r8d
mov rbx, rcx
cmp byte [rcx + 0x458], dil
jne 0x14010b93e
mov edx, r8d
call fcn.140109200
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14010b240
lea rdx, str.TYPE__c
movsx r8d, dil
call fcn.140109840
test eax, eax
jne 0x14010b963
mov edx, esi
mov rcx, rbx
call fcn.140109200
mov byte [rbx + 0x458], dil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14010b980
Capabilities:
Check http status code

Disassembly:
sub rsp, 0x28
mov r10, qword [rcx]
mov r9, rcx
cmp byte [r10 + 0x386], 0
je 0x14010b9d7
cmp qword [rcx + 0x428], 0
je 0x14010b9d7
movzx edx, byte [r10 + 0x37b]
call fcn.1401096b0
test eax, eax
je 0x14010b9d7
mov rax, qword [r10 + 0x87c0]
mov r8d, reloc.WSOCK32.dll_send
mov rcx, r9
mov dword [rax + 0x18], 1
movzx edx, byte [r10 + 0x37b]
add rsp, 0x28
jmp fcn.14010b8f0
mov rcx, r9
add rsp, 0x28
jmp fcn.14010a870
Function at 0x140110680
Capabilities:
Get socket status

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x598]
sub rsp, 0x698
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor edi, edi
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x30], rdi
mov r13d, edi
cmp rcx, 0xffffffffffffffff
jne 0x1401106d5
cmp rdx, rcx
jne 0x1401106d5
mov ecx, r8d
call fcn.140110650
jmp 0x1401108c3
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x690], r12
test r8d, r8d
jle 0x1401106f7
mov r13d, r8d
call fcn.140112410
mov rbx, rax
jmp 0x1401106fc
mov rbx, qword [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, edi
mov dword [rbp + 0x160], edi
lea eax, [r8 + 2]
mov dword [rsp + 0x50], edx
cmp r14, r8
je 0x140110730
mov qword [rbp + 0x168], r14
mov dword [rbp + 0x160], eax
mov qword [rsp + 0x58], r14
mov edx, eax
mov dword [rsp + 0x50], eax
mov r8, r14
mov dword [rbp + 0x370], edi
cmp rsi, 0xffffffffffffffff
je 0x14011077c
mov dword [rbp + 0x370], eax
mov qword [rbp + 0x378], rsi
mov eax, edi
test edx, edx
je 0x140110763
lea rcx, [rsp + 0x58]
cmp qword [rcx], rsi
je 0x140110763
inc eax
add rcx, 8
cmp eax, edx
jb 0x140110754
cmp eax, edx
jne 0x140110775
cmp edx, 0x40
jae 0x140110775
mov qword [rsp + rax*8 + 0x58], rsi
inc dword [rsp + 0x50]
cmp rsi, r8
cmova r8, rsi
lea rcx, [rsp + 0x30]
test r15d, r15d
lea r10d, [r8 + 1]
cmovs rcx, rdi
mov dword [rsp + 0x38], r10d
mov qword [rsp + 0x40], rcx
test r15d, r15d
jle 0x1401107c8
mov eax, 0x10624dd3
imul r13d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r13d
mov dword [rsp + 0x30], edx
imul edx, edx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x34], eax
jmp 0x1401107cf
jne 0x1401107cf
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x370]
lea rdx, [rbp + 0x160]
mov ecx, r10d
call qword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x14011083f
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
test eax, eax
je 0x140110806
cmp eax, 0x2714
jne 0x140110843
mov rcx, qword [rsp + 0x40]
mov r10d, dword [rsp + 0x38]
test r15d, r15d
jle 0x1401107c8
call fcn.140112410
mov rdx, rbx
mov rcx, rax
call fcn.140112450
mov r13d, r15d
sub r13d, eax
test r13d, r13d
jle 0x140110843
mov rcx, qword [rsp + 0x40]
mov r10d, dword [rsp + 0x38]
jmp 0x140110796
test eax, eax
jns 0x140110848
or eax, 0xffffffff
jmp 0x1401108b3
jne 0x14011084e
xor eax, eax
jmp 0x1401108b3
cmp r14, 0xffffffffffffffff
je 0x140110881
lea rdx, [rbp + 0x160]
mov rcx, r14
call sub.WSOCK32.dll___WSAFDIsSet
lea rdx, [rsp + 0x50]
mov rcx, r14
test eax, eax
mov eax, 1
cmovne edi, eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x140110881
or edi, 4
cmp rsi, 0xffffffffffffffff
je 0x1401108b1
lea rdx, [rbp + 0x370]
mov rcx, rsi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x14011089d
or edi, 2
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x1401108b1
or edi, 4
mov eax, edi
mov rbx, qword [rsp + 0x6e8]
mov r12, qword [rsp + 0x690]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x698
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401124e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1402640a4
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140112546
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140112546
lea rcx, [rsp + 0x20]
call qword [case.0x1400fca78.1]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x148
ret
jmp 0x1401124e0

Function at 0x140112560
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1402640a4
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140112546
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140112546
lea rcx, [rsp + 0x20]
call qword [case.0x1400fca78.1]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x148
ret
jmp 0x1401124e0
Function at 0x140115680
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rbp, r8
cmp dword [rcx + 8], 2
mov rdi, rdx
sete sil
test sil, sil
je 0x1401156be
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rdi
call qword [rbx + Ordinal_26]
jmp 0x1401156f8
cmp qword [rbx + 0x10], 0
jne 0x1401156e4
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140332754]
call fcn.140263598
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401156e4
or rax, 0xffffffffffffffff
jmp 0x140115727
mov r9, qword [rbx + 0x10]
mov r8, rbp
mov edx, 1
mov rcx, rdi
call fcn.140262d64
mov rdi, rax
test rax, rax
je 0x140115705
cmp rax, rbp
jbe 0x140115724
test sil, sil
jne 0x14011571b
mov rcx, qword [rbx + 0x10]
call fcn.14025d970
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140116890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, r8d
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1401168d5
xor eax, eax
lea edx, [rsi + 2]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.140119960
xor al, al
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x48], rbp
call fcn.140116730
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
mov qword [rdi + 8], 0xffffffffffffffff
call fcn.140262e9c
mov rcx, rsi
call fcn.140265684
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call fcn.140262e9c
test ebp, ebp
jg 0x14011692f
xor eax, eax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 0xc]
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140119960
xor al, al
jmp 0x1401169df
lea eax, [rbp + 1]
mov qword [rsp + 0x40], rbx
movsxd rcx, eax
call fcn.14011bc08
mov r9, rsi
mov r8d, 1
mov rcx, rax
mov rdx, rbp
mov rbx, rax
mov byte [rax], 0
call fcn.140262d64
mov rcx, rbx
cmp rax, 1
je 0x140116982
call fcn.14011bc00
xor eax, eax
xor r9d, r9d
lea edx, [rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140119960
xor al, al
jmp 0x1401169da
mov byte [rbx + rbp], 0
cmp byte [rbx], 0
mov rax, rbx
je 0x1401169b5
nop
movzx edx, byte [rax]
cmp dl, 0xd
jne 0x1401169a8
mov byte [rcx], 0xa
inc rax
inc rcx
cmp byte [rax], 0xa
jne 0x1401169b0
jmp 0x1401169ad
mov byte [rcx], dl
inc rcx
inc rax
cmp byte [rax], 0
jne 0x140116990
mov byte [rcx], 0
mov rax, qword [rdi]
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, rbx
call fcn.14011bc00
xor eax, eax
cmp byte [rdi + 0x70], al
sete al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14011de98
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xc8], 0
jne 0x14011ded6
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14011df8a
call fcn.14011c934
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14011def5
mov ecx, 0x80004005
call fcn.14008ec20
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + pe_nt_image_headers64]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1402662b8
test eax, eax
je 0x14011df5d
cmp eax, 0xc
je 0x14011df57
cmp eax, 0x16
je 0x14011df51
cmp eax, 0x22
je 0x14011df51
cmp eax, 0x50
je 0x14011df5d
call fcn.14011bd58
int3
call fcn.14011bd58
int3
call fcn.14011bd10
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14011df88
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14011fa90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14011eba0
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14011faec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.14011f520
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14011fb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CSettingsTab.1.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14011fbbf
cmp dword [rcx + 0xd8], 0
jne 0x14011fbbf
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14011eba0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14011fb24
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140120774
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14014067c
mov rsi, rax
test rax, rax
je 0x1401207f0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x1401207eb
cmp dword [rbx], 0x40
jb 0x1401207eb
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1401207eb
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1401207f4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140128620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140128688
call fcn.14011eba0
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140128688
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1401286aa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14012800c
mov esi, eax
test rdi, rdi
je 0x1401286a8
test rbx, rbx
je 0x1401286a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret