joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063570
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x140063694
cmp r8d, 0xff
jne 0x1400635d1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x1400635bb
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x86350]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.14003f040
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.14003f040
cmp r8d, 0xfb
jne 0x1400635e3
lea r9, str.WILL
jmp 0x140063621
cmp r8d, 0xfc
jne 0x1400635f5
lea r9, str.WONT
jmp 0x140063621
cmp r8d, 0xfd
jne 0x140063607
lea r9, [0x140086d74]
jmp 0x140063621
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x14006367d
cmp r10d, 0x27
jg 0x140063654
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x86970]
test r8, r8
jne 0x140063664
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.14003f040
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x14006363b
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.14003f040
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.14003f040
add rsp, 0x38
ret

Function at 0x1400639e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140063a3f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14003eec0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140063570
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140063bf0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140063d98
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140063c55
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140063c55
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140063c55
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x140063c8c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140063ce2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140063ce2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140063ce2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140063ce2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140063ce2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400636a0
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140063d44
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14003eec0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140063a70
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140063d90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14003eec0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140065500
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140065595
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400655f6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14003eec0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140079ae0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400656b1
sub ecx, 1
je 0x140065724
sub ecx, 1
je 0x140065660
cmp ecx, 1
je 0x140065643
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400847d0]
call fcn.14003eec0
jmp 0x140065724
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140065230
test eax, eax
je 0x140065724
jmp 0x1400655ca
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140065724
sub rax, rsi
cmp rax, rbp
jae 0x140065724
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14003f040
jmp 0x140065724
cmp r8d, 4
jle 0x140065724
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140065724
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14003ede0
mov esi, eax
test eax, eax
je 0x140065703
mov edx, 5
mov rcx, rbx
call fcn.1400661f0
mov eax, esi
jmp 0x1400655ca
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14004ceb0
mov rcx, r14
call fcn.14004d190
test eax, eax
je 0x1400655c8
mov edx, 5
mov rcx, rbx
call fcn.1400661f0
mov eax, Ordinal_46
jmp 0x1400655ca
Function at 0x140079920
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x140079962
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400799a9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140079a02
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400799c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140079a43
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008bafa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008bafb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140079a10
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14007a7e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007a82e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007a82e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007a82e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007a82e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007a82e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007a830
xor al, al
add rsp, 0x28
ret
Function at 0x140001160
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0xfb8]
mov eax, 0x10b0
call fcn.1400132f0
sub rsp, rax
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rbp + 0xfa0], rax
mov rsi, rcx
lea rcx, [rsp + 0x34]
call fcn.140009378
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400011b3
lea ecx, [rax + 6]
jmp 0x1400012d1
call fcn.14000a9dc
mov rbx, rax
call fcn.14000b33c
mov qword [rsp + 0x28], rbx
mov ebx, 0x400
lea r8, [0x140038008]
lea rcx, [rbp + 0x7a0]
mov r9, rax
mov edx, ebx
mov dword [rsp + 0x20], 0x5c
call fcn.14000a99c
mov r9d, dword [rsp + 0x34]
lea r8, [0x140038018]
lea rcx, [rbp - 0x60]
mov edx, ebx
call fcn.14000a99c
lea rax, [0x140038048]
lea r11, str.JavaWSSplashScreen
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rsi
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x7a0]
xor esi, esi
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x60], rsi
call fcn.14000a79c
test eax, eax
jne 0x1400012cf
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov rcx, rdi
mov word [rbp - 0x80], si
mov dword [rsp + 0x30], reloc.WSOCK32.dll_recv
mov qword [rbp - 0x7e], rax
mov dword [rbp - 0x76], eax
mov word [rbp - 0x72], ax
call qword [sym.imp.WSOCK32.dll_accept]
cmp eax, 0xffffffff
jne 0x14000127e
lea ecx, [rsi + 6]
jmp 0x1400012d1
xor r9d, r9d
movsxd rbx, eax
lea rdx, [rbp - 0x70]
lea r8d, [r9 + 6]
mov rcx, rbx
call qword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x1400012a1
mov ecx, 7
jmp 0x1400012d1
lea rcx, [rbp - 0x70]
call fcn.1400132cc
mov dword [section..data], eax
test eax, eax
jg 0x1400012bb
mov ecx, 8
jmp 0x1400012d1
mov rcx, rbx
call fcn.14000a75c
mov rcx, rdi
call fcn.14000a75c
xor eax, eax
jmp 0x1400012d6
xor ecx, ecx
call fcn.14000c428
mov rcx, qword [rbp + 0xfa0]
xor rcx, rsp
call fcn.1400126a0
lea r11, [rsp + 0x10b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140008fd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1160]
mov eax, 0x1260
call fcn.1400132f0
sub rsp, rax
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov qword [rsp + 0x28], rcx
mov rdi, rcx
lea rax, [0x14003bb00]
mov rbx, rdx
lea rcx, [rbp + 0x150]
lea r9, [0x14003bb30]
or r8, 0xffffffffffffffff
mov edx, 0x1000
mov qword [rsp + 0x20], rax
call fcn.140014018
lea r11, [rsp + 0x30]
lea rdx, [rbp + 0x150]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000906a
xor eax, eax
jmp 0x140009103
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Path
xor r8d, r8d
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400090b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140009063
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x3c], 1
jne 0x140009063
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400090cc
call fcn.140013340
mov rcx, rdi
call fcn.140013380
lea rdx, [rbx + 0x10]
mov rcx, rax
mov qword [rbx + 8], rax
call fcn.1400087e4
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400090f1
call fcn.140013340
lea rcx, [rsp + 0x40]
call fcn.140013380
mov qword [rbx], rax
mov eax, 1
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1400126a0
lea r11, [rsp + 0x1260]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140009134
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r12, rcx
lea r8, str.FORCED_FX_ROOT
lea rcx, [rsp + 0x48]
xor ebx, ebx
xor edx, edx
xor edi, edi
and qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x1fe
call fcn.140013778
cmp qword [rsp + 0x48], rbx
je 0x1400091da
test eax, eax
jne 0x1400091da
lea edx, [rdi + 0x40]
lea ecx, [rdi + 1]
call fcn.140012c04
lea rcx, str.2.0
mov rbx, rax
call fcn.140013380
lea rdx, [rbx + 0x10]
mov rcx, rax
mov qword [rbx + 8], rax
call fcn.1400087e4
mov rcx, qword [rsp + 0x48]
call fcn.140013380
mov qword [rbx], rax
mov rcx, qword [rsp + 0x48]
call fcn.140013340
jmp 0x1400092bf
lea rax, [rsp + 0x50]
lea rdx, [0x14003bb80]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000920c
xor eax, eax
jmp 0x1400092c2
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x70]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test eax, eax
jne 0x1400092a2
test r12, r12
je 0x140009253
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.140008b34
jmp 0x140009258
mov eax, 1
test eax, eax
je 0x1400092a2
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x70]
call fcn.1400087e4
test rbx, rbx
je 0x140009286
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400088d4
test eax, eax
je 0x1400092a2
mov rdx, rbx
jmp 0x140009299
mov edx, 0x40
lea ecx, [rdx - 0x3f]
call fcn.140012c04
mov rbx, rax
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140008fd4
inc edi
mov dword [rsp + 0x40], 0x1fe
test esi, esi
je 0x14000920c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400126a0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140009378
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
mov rdi, rcx
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
mov word [rsp + 0x28], ax
mov qword [rsp + 0x2a], rax
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
call fcn.14000a67c
lea rcx, [0x14003bbb0]
mov ebx, 2
mov word [rsp + 0x28], bx
call qword [sym.imp.WSOCK32.dll_inet_addr]
lea edx, [rbx - 1]
xor r8d, r8d
mov ecx, ebx
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WSOCK32.dll_socket]
or rsi, 0xffffffffffffffff
mov rbx, rax
cmp rax, rsi
jne 0x1400093f5
mov rax, rsi
jmp 0x140009457
lea rdx, [rsp + 0x28]
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_bind]
mov rcx, rbx
cmp eax, esi
jne 0x140009417
call fcn.14000a75c
jmp 0x1400093f0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WSOCK32.dll_getsockname]
mov rcx, rbx
cmp eax, esi
je 0x140009410
mov edx, 0x7fffffff
call qword [sym.imp.WSOCK32.dll_listen]
cmp eax, esi
jne 0x140009442
mov rcx, rbx
jmp 0x140009410
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WSOCK32.dll_ntohs]
movzx r11d, ax
mov rax, rbx
mov dword [rdi], r11d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400126a0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009568
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov ebx, ecx
mov word [rsp + 0x20], ax
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call fcn.14000a67c
mov edi, 2
movzx ecx, bx
mov word [rsp + 0x20], di
call qword [sym.imp.WSOCK32.dll_htons]
lea rcx, [0x14003bbd0]
mov word [rsp + 0x22], ax
call qword [sym.imp.WSOCK32.dll_inet_addr]
lea edx, [rdi - 1]
xor r8d, r8d
mov ecx, edi
mov dword [rsp + 0x24], eax
call qword [sym.imp.WSOCK32.dll_socket]
or rdi, 0xffffffffffffffff
mov rbx, rax
cmp rax, rdi
jne 0x1400095e5
mov rax, rdi
jmp 0x14000960a
lea rdx, [rsp + 0x20]
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_connect]
cmp eax, edi
jne 0x140009607
mov rcx, rbx
call fcn.14000a75c
jmp 0x1400095e0
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400126a0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140009728
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov byte [rsp + 0x38], dl
lea rdx, [rsp + 0x38]
lea r8d, [r9 + 1]
call qword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140009758
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov r12, rcx
test rdx, rdx
jne 0x140009782
xor eax, eax
jmp 0x1400097f1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx + 4]
movsxd rdi, eax
lea rcx, [rdi + rdi]
call fcn.140013530
mov rbp, rax
test rax, rax
je 0x14000977e
lea r8, str._s_r_n
mov r9, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14000a99c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
xor r9d, r9d
mov rdx, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, r12
call qword [sym.imp.WSOCK32.dll_send]
mov rcx, rbp
cmp eax, 0xffffffff
setne bl
call fcn.140013340
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140009818
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
lea rbp, [0x14004df60]
xor r12d, r12d
mov rsi, rcx
mov rdi, rbp
mov ebx, r12d
movsxd rax, ebx
xor r9d, r9d
mov rcx, rsi
lea rdx, [rbp + rax*2]
lea r8d, [r9 + 2]
call qword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x140009897
test eax, eax
je 0x14000988c
cmp word [rdi], 0xa
je 0x14000988c
cmp word [rdi], 0xd
je 0x140009877
inc ebx
add rdi, 2
cmp ebx, 0x3ff
jl 0x140009844
mov word [0x14004e75e], r12w
mov rax, rbp
jmp 0x140009899
movsxd rcx, ebx
mov word [rbp + rcx*2], r12w
jmp 0x140009887
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14000a67c
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp dword [0x140053800], 0
jne 0x14000a734
lea rcx, str.ws2_32.dll
mov edi, 1
call fcn.14000d6a0
mov rbx, rax
test rax, rax
jne 0x14000a6e8
lea rcx, str.wsock32.dll
call fcn.14000d6a0
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14000a6e8
lea ecx, [rax + 0xd]
call fcn.14000c428
mov rcx, rax
call fcn.14000a5ac
int3
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x14000a70f
mov ecx, ntohs
call fcn.14000c428
mov rcx, rax
call fcn.14000a5ac
int3
test edi, edi
je 0x14000a72a
lea rdx, str.WSASendDisconnect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400537f8], rax
mov dword [0x140053800], 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400126a0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x14000a86c
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x858
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rsp + 0x840], rax
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareOracleJavaFX
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a907
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Disabled
xor r8d, r8d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a907
lea rdx, [rsp + 0x40]
lea rcx, str.true
call fcn.140014b44
test eax, eax
je 0x14000a90c
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400126a0
add rsp, 0x858
ret
Function at 0x14000ae7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xf60]
mov eax, 0x1060
call fcn.1400132f0
sub rsp, rax
mov rax, qword [0x14003f8c0]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov dword [rsp + 0x3c], edx
lea rax, [rsp + 0x30]
mov rdi, rcx
lea rdx, [0x14003dc00]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x400
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
jne 0x14000afc4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.CurrentVersion
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovne ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str.SoftwareJavaSoftJava_Runtime_Environment
test eax, eax
lea rax, [rsp + 0x50]
lea r8, [0x14003dce8]
lea rcx, [rbp + 0x750]
mov edx, 0x400
mov qword [rsp + 0x20], rax
cmovne ebx, esi
call fcn.140013ff4
lea r11, [rsp + 0x30]
lea rdx, [rbp + 0x750]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000afc4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003dc78]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovne ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
cmovne ebx, esi
mov eax, ebx
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.1400126a0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1060
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000b14c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
or dword [rsp + 0x68], 0xffffffff
lea rax, [rsp + 0x38]
mov rbx, r8
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b1b4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
add rsp, 0x40
pop rbx
ret