joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fc30
Capabilities:
Encrypt data using rc4 prga
Identify system language via api

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp word [0x14024c514], 0
mov edi, edx
mov rsi, rcx
mov r14d, 0x3ff
je 0x14001fd13
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], rax
lea r9, [0x14001fbf0]
mov eax, edx
xor ebx, ebx
shr eax, 4
xor ecx, ecx
inc ax
mov dword [rsp + 0x30], ebx
movzx r8d, ax
lea rax, [rsp + 0x30]
lea edx, [rbx + 6]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14001fd13
movzx r9d, word [0x14024c514]
lea rdx, [rsp + 0x40]
mov r8d, eax
nop dword [rax + rax]
movzx ecx, word [rdx]
cmp r9w, cx
jne 0x14001fcde
movzx ebx, cx
jmp 0x14001fcf2
test bx, bx
jne 0x14001fcf2
movzx eax, cx
xor ax, r9w
test r14w, ax
cmove bx, cx
add rdx, 2
sub r8, 1
jne 0x14001fcd0
test bx, bx
je 0x14001fd13
movzx r8d, bx
mov edx, edi
mov rcx, rsi
call fcn.14001fdc0
test al, al
jne 0x14001fd90
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, word [0x14024c514]
movzx ebx, ax
mov ebp, 0x400
je 0x14001fd57
movzx r8d, ax
mov edx, edi
mov rcx, rsi
call fcn.14001fdc0
test al, al
jne 0x14001fd90
cmp bx, bp
jb 0x14001fd57
and bx, r14w
mov edx, edi
movzx r8d, bx
mov rcx, rsi
call fcn.14001fdc0
test al, al
jne 0x14001fd90
mov r8d, ebp
mov edx, edi
mov rcx, rsi
call fcn.14001fdc0
test al, al
jne 0x14001fd90
mov r8d, 0x800
mov edx, edi
mov rcx, rsi
call fcn.14001fdc0
test al, al
jne 0x14001fd90
mov r8d, 0x409
mov edx, edi
mov rcx, rsi
call fcn.14001fdc0
test al, al
je 0x14001fd92
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006b1a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001fdc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
movzx r9d, r8w
shr edx, 4
mov rdi, rcx
inc dx
xor ecx, ecx
movzx r8d, dx
and ebx, 0xf
mov edx, 6
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14001fe4d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001fe4d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14001fe4d
test ebx, ebx
je 0x14001fe30
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + rcx*2]
lea rax, [rax + 2]
add ebx, 0xffffffff
jne 0x14001fe20
movzx r8d, word [rax]
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.1400229b0
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140021640
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [0x1400a0928]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14002165b
add rsp, 0x58
ret
lea rdx, str.IsWow64Process2
mov qword [rsp + 0x50], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400216ac
xor eax, eax
mov word [rsp + 0x68], ax
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
call rbx
test eax, eax
je 0x1400216ac
movzx eax, word [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x20]
test ecx, ecx
je 0x140021702
cmp ecx, 5
je 0x1400216f3
cmp ecx, 9
je 0x1400216e4
mov rbx, qword [rsp + 0x50]
cmp ecx, 0xc
mov eax, 0xaa64
mov edx, 0x8664
cmovne eax, edx
add rsp, 0x58
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0x8664
add rsp, 0x58
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0x1c4
add rsp, 0x58
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0x14c
add rsp, 0x58
ret
Function at 0x1400217d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, r9d
mov r14, r8
mov rbp, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov word [rsp + 0x50], r15w
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140021d20
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140021844
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140021bb0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140021969
mov edx, edi
mov ecx, 0x20019
call fcn.140021720
mov rsi, rax
test rax, rax
je 0x140021969
xor bl, bl
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140021960
cmp dword [rsp + 0x34], 1
jne 0x140021960
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140021960
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14006b850
mov rdi, rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002194d
mov eax, dword [rsp + 0x30]
shr rax, 1
mov word [rdi + rax*2], r15w
mov r8, rdi
mov rdx, qword [r14]
mov rcx, rbp
call fcn.140021dc0
test rax, rax
jne 0x14002194b
cmp word [rdi], ax
je 0x14002194b
mov rcx, rdi
call fcn.140021e80
inc rax
mov qword [r14], rax
jmp 0x14002194d
mov bl, 1
mov rcx, rdi
call fcn.14006b080
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002196b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002197b
call fcn.140021e70
nop
movzx eax, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x268
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400219a0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
mov word [rbp + 0x150], r14w
mov r8, rcx
mov edx, 0x100
lea rcx, [rbp + 0x150]
call fcn.140021d20
mov qword [rbp + 0x140], rax
test rax, rax
jne 0x140021a26
lea rdx, [rbp + 0x140]
mov rcx, rdi
call fcn.140021bb0
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x140]
test rax, rax
je 0x140021b0d
mov edx, esi
mov ecx, 0x20006
call fcn.140021720
mov rdi, rax
test rax, rax
je 0x140021b0d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov word [rsp + 0x40], r14w
mov r8, rbx
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.140021d20
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140021a87
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140021bb0
mov qword [rsp + 0x38], rax
jmp 0x140021a8c
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x148]
test rax, rax
cmovne rdx, rax
mov eax, dword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140021afb
call fcn.140021e70
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov word [rsp + 0x40], r14w
jmp 0x140021b0f
xor bl, bl
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x140021b21
call fcn.140021e70
nop
movzx eax, bl
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400225c0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x14002261f
test edx, edx
je 0x14002261f
mov byte [rcx], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14002261f
mov edx, edi
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.140021dc0
mov al, 1
jmp 0x140022621
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006b1a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140022650
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movzx edi, cl
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14002271f
lea rdx, str.GetPhysicallyInstalledSystemMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], 0
test rax, rax
je 0x1400226c2
lea rcx, [rsp + 0x20]
call rax
test eax, eax
je 0x1400226c2
mov rax, qword [rsp + 0x20]
shl rax, 0xa
jmp 0x14002277d
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x64], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x6c], ecx
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
test rax, rax
je 0x14002271f
lea rcx, [rsp + 0x30]
call rax
test eax, eax
je 0x14002271f
test dil, dil
je 0x140022718
mov rcx, qword [rsp + 0x38]
call fcn.1400228a0
jmp 0x14002277d
mov rax, qword [rsp + 0x38]
jmp 0x14002277d
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x38
xor eax, eax
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0xa4], eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, 0xffffffff
movabs rcx, 0x100000001
cmp qword [rsp + 0x78], rdx
cmovne rcx, qword [rsp + 0x78]
test dil, dil
je 0x14002277a
call fcn.1400228a0
mov rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14006b1a0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret

Function at 0x1400227a0
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x100f0
call fcn.14006b200
sub rsp, rax
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x100e0], rax
mov r8, rcx
mov edx, 0x8000
lea rcx, [rsp + 0xe0]
call fcn.140021d20
xorps xmm0, xmm0
mov dword [rsp + 0x70], WSAGetLastError
xor eax, eax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x140022874
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x100e0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x100f0
pop rbx
ret
Function at 0x140022a20
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov qword [0x14024c570], rcx
mov qword [rsp + 0x20], 8
mov dword [rsp + 0x24], 0xff
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [rsp + 0x24], 4
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x14024c578], eax
mov dword [rsp + 0x24], 0x8000
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x14024c57c], eax
lea rcx, [rbp + 0x40]
call fcn.140015030
xor r15d, r15d
mov dword [rsp + 0x28], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14d, r15d
lea esi, [r15 + 1]
test rax, rax
je 0x140022b6f
lea rdi, [rax + 8]
cmp esi, dword [rsp + 0x28]
jge 0x140022b6f
mov rbx, qword [rdi]
cmp word [rbx], 0
je 0x140022b6f
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x40], 0
mov r8, rbx
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.140021dc0
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140022b34
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140021c60
mov qword [rsp + 0x38], rax
jmp 0x140022b39
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
test rax, rax
cmovne rcx, rax
lea r8, [rbp + 0x40]
mov edx, r14d
call fcn.140004210
mov r14d, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140022b64
call fcn.140021e70
nop
inc esi
add rdi, 8
jmp 0x140022ae2
lea rcx, [rbp + 0x40]
call fcn.140002780
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.140015250
mov eax, ebx
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.14006b1a0
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140024a20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp dword [rcx + 8], 3
jne 0x140024a6a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x140024a5a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x140024ab6
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x140024aa3
mov rcx, qword [rcx + 0x10]
lea rdx, [0x14009cedc]
call fcn.140078df8
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140024aa3
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rax
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.140072320
mov rdi, rax
test rax, rax
jne 0x140024ad9
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140024ad0
call fcn.140071ea8
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140024b30
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
cmp dword [0x14024c580], 0
jne 0x140024c03
lea rax, [fcn.140072c30]
mov dword [0x14024c580], 1
mov qword [str.0__a_], rax
lea rax, [fcn.140072c1c]
mov qword [fcn.140072c1c], rax
lea rax, [fcn.140077d60]
mov qword [str.__a_], rax
lea rax, case.0x14002d759.0
mov qword [case.0x14002d759.0], rax
lea rax, [case.0x14002d759.1]
mov qword [case.0x14002d759.1], rax
lea rax, [case.0x14002d759.2]
mov qword [case.0x14002d759.2], rax
call fcn.14002fb20
test eax, eax
je 0x140024c11
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140024c11
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140024c2b
shr ax, 8
cmp al, 2
jne 0x140024c2b
call fcn.14002da70
test eax, eax
jne 0x140024c11
call fcn.140012b30
test eax, eax
jne 0x140024c11
mov dword [0x14024c584], 3
call fcn.14003adc0
lea rcx, [rsp + 0x20]
call fcn.140031930
test eax, eax
je 0x140024c33
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x1e8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140024c11
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x1e8
ret
Function at 0x140024da0
Capabilities:
Initialize winsock library

Disassembly:
mov dl, 1
jmp 0x140024ff0
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x14024c580]
mov ebx, ecx
mov r8d, eax
inc eax
mov dword [0x14024c580], eax
test r8d, r8d
jne 0x1400250ff
test dl, dl
je 0x14002507f
lea rax, [fcn.140072c30]
mov qword [str.0__a_], rax
lea rax, [fcn.140072c1c]
mov qword [fcn.140072c1c], rax
lea rax, [fcn.140077d60]
mov qword [str.__a_], rax
lea rax, case.0x14002d759.0
mov qword [case.0x14002d759.0], rax
lea rax, [case.0x14002d759.1]
mov qword [case.0x14002d759.1], rax
lea rax, [case.0x14002d759.2]
mov qword [case.0x14002d759.2], rax
test bl, 1
je 0x14002508d
call fcn.14002fb20
test eax, eax
je 0x1400250c9
test bl, 2
je 0x1400250c0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400250c9
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1400250d0
shr ax, 8
cmp al, 2
jne 0x1400250d0
call fcn.14002da70
test eax, eax
jne 0x1400250c9
call fcn.140012b30
test eax, eax
je 0x1400250dd
mov eax, 2
jmp 0x140025101
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140025101
mov eax, dword [0x14024c5e8]
test bl, 4
mov ecx, 1
mov dword [0x14024c584], ebx
cmovne eax, ecx
mov dword [0x14024c5e8], eax
call fcn.14003adc0
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x1d0
pop rbx
ret

Function at 0x140024ff0
Capabilities:
Initialize winsock library

Disassembly:
mov dl, 1
jmp 0x140024ff0
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x14024c580]
mov ebx, ecx
mov r8d, eax
inc eax
mov dword [0x14024c580], eax
test r8d, r8d
jne 0x1400250ff
test dl, dl
je 0x14002507f
lea rax, [fcn.140072c30]
mov qword [str.0__a_], rax
lea rax, [fcn.140072c1c]
mov qword [fcn.140072c1c], rax
lea rax, [fcn.140077d60]
mov qword [str.__a_], rax
lea rax, case.0x14002d759.0
mov qword [case.0x14002d759.0], rax
lea rax, [case.0x14002d759.1]
mov qword [case.0x14002d759.1], rax
lea rax, [case.0x14002d759.2]
mov qword [case.0x14002d759.2], rax
test bl, 1
je 0x14002508d
call fcn.14002fb20
test eax, eax
je 0x1400250c9
test bl, 2
je 0x1400250c0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400250c9
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1400250d0
shr ax, 8
cmp al, 2
jne 0x1400250d0
call fcn.14002da70
test eax, eax
jne 0x1400250c9
call fcn.140012b30
test eax, eax
je 0x1400250dd
mov eax, 2
jmp 0x140025101
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140025101
mov eax, dword [0x14024c5e8]
test bl, 4
mov ecx, 1
mov dword [0x14024c584], ebx
cmovne eax, ecx
mov dword [0x14024c5e8], eax
call fcn.14003adc0
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0x1d0
pop rbx
ret
Function at 0x140026820
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1400c8718]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x5d8], 0
mov r14, r9
mov rax, qword [rsp + 0x130]
mov rbp, r8
mov esi, edx
mov rdi, rcx
je 0x140026952
test rax, rax
je 0x140026952
mov rdx, qword [rax + 0xd8]
test rdx, rdx
je 0x140026952
mov ecx, esi
lea r9, str.Data
sub ecx, 1
je 0x1400268ab
sub ecx, 1
je 0x14002689b
sub ecx, 1
je 0x1400268b2
cmp ecx, 1
je 0x1400268a2
jmp 0x140026952
lea r9, str.Header
lea rax, [0x1400a2ec8]
jmp 0x1400268b9
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
mov edx, 0xa0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.1400277e0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400268e5
mov r10, qword [rdi + 0x310]
test r10, r10
je 0x14002691c
mov rax, qword [rdi + 0x260]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call r10
test eax, eax
je 0x140026952
jmp 0x140026962
mov r9, qword [rdi + 0x258]
lea rcx, [0x1400a2df0]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14007799c
mov r9, qword [rdi + 0x258]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.14007799c
mov r9, r14
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.1400272f0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14006b1a0
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140026c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140026cab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140027020
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r15, r8
mov rcx, qword [rcx + 0x240]
mov eax, 0x238
cmp rdx, rcx
mov r8d, 0x240
mov ebx, 0x280
mov r14, r9
cmove eax, r8d
mov rbp, qword [rax + rdi]
mov eax, 0x2a0
cmove ebx, eax
mov rax, qword [rdi + 0x598]
add rbx, rdi
xor r12d, r12d
mov rsi, qword [rbx + 8]
sub rsi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140027136
cmp rdx, rcx
mov eax, 0x260
mov r8d, 0x268
lea rcx, [0x140026cf0]
cmove eax, r8d
cmp qword [rax + rdi], rcx
jne 0x140027136
cmp qword [rbx], r12
je 0x1400270bd
test rsi, rsi
je 0x140027136
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.140038ff0
cmp eax, 0xffffffff
je 0x140027136
test al, 1
je 0x140027136
mov rax, qword [rbx]
test rax, rax
jne 0x14002710f
mov rax, qword [rdi]
mov ecx, dword [rax + 0x598]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [str.0__a_]
mov rsi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
test rax, rax
je 0x140027132
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140027136
add qword [rbx + 0x10], rcx
jmp 0x140027136
mov qword [rbx + 8], r12
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
jne 0x140027199
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14002716d
mov rcx, qword [rsp + 0x60]
lea eax, [rsi + 0x52]
mov qword [rcx], r12
jmp 0x1400271a4
mov edx, ebx
mov rcx, rdi
call fcn.140025a80
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140026980
mov rax, qword [rdi]
mov dword [rax + 0x4b1c], ebx
mov eax, 0x37
jmp 0x14002719c
mov eax, r12d
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400272f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r11, qword [rcx + 0x310]
mov rdi, r9
movsxd r10, edx
mov rsi, r8
mov rbx, rcx
mov edx, r10d
test r11, r11
je 0x140027339
mov rax, qword [rcx + 0x260]
mov qword [rsp + 0x20], rax
call r11
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test r10d, r10d
je 0x140027348
sub edx, 1
je 0x140027348
cmp edx, 1
jne 0x140027383
mov r9, qword [rbx + 0x258]
lea rcx, [r10 + r10*2]
mov edx, 2
lea rax, [0x1400a2df0]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.14007799c
mov r9, qword [rbx + 0x258]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.14007799c
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret