joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800182f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1458
call fcn.180050b20
sub rsp, rax
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x1440], rax
lea rax, [rsp + 0x1468]
mov qword [rsp + 0x28], rax
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x1460]
lea rcx, [rsp + 0x440]
call fcn.180018810
mov qword [rsp + 0x28], 0
cmp qword [0x1800a3a90], 0
jne 0x1800183ec
lea rcx, [0x180082688]
call fcn.1800618b4
mov qword [rsp + 0x30], rax
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180052bc0
mov r8, qword [rsp + 0x30]
lea rdx, str._s_log_twainds.log
lea rcx, [rsp + 0x40]
call fcn.1800046e0
nop
lea rdx, [0x1800826ac]
lea rcx, [rsp + 0x40]
call fcn.180061db4
mov qword [0x1800a3a90], rax
cmp qword [0x1800a3a90], 0
jne 0x1800183dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 5
jne 0x1800183db
lea rcx, str.Access_to_Logfile_is_denied._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x18001842a
lea rcx, str.LOGFILE_REOPENED.
call fcn.1800182f0
nop
jmp 0x1800183ec
cmp qword [0x1800a3a90], 0
je 0x18001842a
lea rdx, [rsp + 0x440]
mov rcx, qword [0x1800a3a90]
call fcn.1800188a0
lea rdx, [0x1800826e4]
mov rcx, qword [0x1800a3a90]
call fcn.1800188a0
mov rcx, qword [0x1800a3a90]
call fcn.180061c90
nop
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x1458
ret

Function at 0x18001a080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 1
mov r8d, 0xa
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180052bc0
mov r8d, 0xa
lea rdx, [rsp + 0x28]
lea rcx, [0x180082768]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x18001a10c
lea rcx, [rsp + 0x28]
call fcn.18005ac1c
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jg 0x18001a10c
xor ecx, ecx
call fcn.18001a1f0
mov ecx, eax
call fcn.180061e44
call fcn.180061e18
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
mov ecx, recv
idiv ecx
mov eax, edx
mov dword [rsp + 0x20], eax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x48
ret
Function at 0x18001c5e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x70]
add rax, 0x168
lea r8, [0x18008294c]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180061dc0
cmp qword [rsp + 0x30], 0
jne 0x18001c640
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov dx, socket
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x168]
mov eax, 1
jmp 0x18001c780
mov qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.18001c4b0
cwde
test eax, eax
je 0x18001c67e
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov dx, 2
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x168]
mov eax, 1
jmp 0x18001c780
mov rcx, qword [rsp + 0x38]
call fcn.1800219e0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18001c6c0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov dx, 2
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x168]
mov rcx, qword [rsp + 0x38]
call fcn.1800219a0
mov eax, 1
jmp 0x18001c780
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
lea rax, [rax*4 + 0x36]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x14]
lea rax, [rcx + rax*4 + 0x28]
mov dword [rsp + 0x20], eax
mov r8d, recv
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180052bc0
mov eax, 0x4d42
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x52], eax
movsxd rax, dword [rsp + 0x20]
add rax, 0xe
mov dword [rsp + 0x4a], eax
mov r9, qword [rsp + 0x30]
mov r8d, recv
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.18006211c
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x30]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.18006211c
mov rcx, qword [rsp + 0x30]
call fcn.180061940
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x38]
call fcn.180021a20
mov rcx, qword [rsp + 0x38]
call fcn.1800219a0
mov eax, 6
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x68
ret
Function at 0x180021700
Capabilities:
Get common file path

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, 1
mov word [rsp + 0x30], ax
cmp qword [0x1800a3abc], 0
jne 0x1800218a2
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180052bc0
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x180021796
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x104
jae 0x180021787
jmp 0x18002178c
call fcn.180050970
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.180059c20
movsx eax, byte [rsp + rax + 0x3f]
cmp eax, 0x5c
je 0x1800217c0
lea r8, [0x180083430]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1800622d4
lea r8, str.TWAIN_32.dll
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1800622d4
cmp qword [0x1800a3ab0], 0
jne 0x180021846
lea rcx, [rsp + 0x40]
call fcn.1800215c0
movzx eax, al
test eax, eax
jne 0x180021846
lea rdx, str.Could_not_load_the_DSM
lea rcx, [0x1800a3df0]
call fcn.180007940
lea rdx, [0x180008400]
mov rcx, rax
call fcn.180009250
movzx eax, word [rsp + 0x190]
movzx ecx, word [rsp + 0x188]
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x180]
lea rcx, str.DSM_Entry_ERROR:__DG:__i___DAT:__i___MSG:__i_called___Could_not_load_the_DSM
call fcn.1800182f0
mov eax, 1
jmp 0x1800218ed
cmp qword [0x1800a3abc], 0
jne 0x1800218a2
lea rdx, str.No_Entry_Point_for_DSM_Entry
lea rcx, [0x1800a3df0]
call fcn.180007940
lea rdx, [0x180008400]
mov rcx, rax
call fcn.180009250
movzx eax, word [rsp + 0x190]
movzx ecx, word [rsp + 0x188]
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x180]
lea rcx, str.DSM_Entry_ERROR:__DG:__i___DAT:__i___MSG:__i_called___No_Entry_Point_for_DSM_Entry
call fcn.1800182f0
mov eax, 1
jmp 0x1800218ed
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x28], rax
movzx eax, word [rsp + 0x190]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x188]
mov r8d, dword [rsp + 0x180]
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
call qword [0x1800a3abc]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x168
ret
Function at 0x180021df0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x58]
mov dword [rax], 0
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x180021e54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WinHttpReadData____GetLastError__:__i
call fcn.1800182f0
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180041950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x40]
lea r8, [0x180041410]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x90], rax
add rsp, 0x38
ret

Function at 0x180041a80
Capabilities:
Resume thread

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
lea rax, [rsp + 0x40]
mov rdi, rax
mov rsi, qword [rsp + 0x88]
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
movzx r9d, byte [rsp + 0x98]
movzx r8d, byte [rsp + 0x90]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.18004c2e0
mov word [rsp + 0x20], ax
movsx eax, word [rsp + 0x20]
test eax, eax
je 0x180041aed
movzx eax, word [rsp + 0x20]
jmp 0x180041bc9
movzx eax, byte [rsp + 0x90]
test eax, eax
je 0x180041b09
mov eax, 1
mov rcx, qword [rsp + 0x88]
mov word [rcx], ax
mov rax, qword [rsp + 0x88]
movzx eax, word [rax]
test eax, eax
jne 0x180041b2b
movzx eax, byte [rsp + 0x98]
test eax, eax
jne 0x180041b2b
xor eax, eax
jmp 0x180041bc9
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x48], 0
jne 0x180041bc7
mov ecx, 0x98
call fcn.1800506c0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180041b8a
lea rax, [rsp + 0x50]
mov rdi, rax
mov rsi, qword [rsp + 0x88]
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call fcn.1800421c0
mov qword [rsp + 0x30], rax
jmp 0x180041b93
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x48], rcx
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x48]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180041ee0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x14f8
call fcn.180050b20
sub rsp, rax
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x14e0], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.180052bc0
mov dword [rsp + 0x70], WSAGetLastError
mov r8d, 0x18
xor edx, edx
mov rcx, qword [rsp + 0x1508]
call fcn.180052bc0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea r8, str.ROWERIP_ROOT
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.18006188c
test eax, eax
jne 0x180042074
cmp qword [rsp + 0x50], 0
je 0x180042074
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.180052bc0
mov rax, qword [rsp + 0x1500]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
lea r8, str._s_user_application_twain.exe__session_id__s
mov edx, 0x400
lea rcx, [rsp + 0xe0]
call fcn.180018210
lea rdx, [rsp + 0xe0]
lea rcx, str.Start_GUI_COMMAND:__s
call fcn.1800182f0
lea rcx, [rsp + 0xe0]
call fcn.180059c20
inc rax
mov r8, rax
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x4e0]
call fcn.180062978
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x1508]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180042068
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed__s
call fcn.1800182f0
xor eax, eax
jmp 0x180042089
mov rcx, qword [rsp + 0x50]
call fcn.18005ae9c
jmp 0x180042084
lea rcx, str.Failed_to_get_ENV_ROWERIP_ROOT_
call fcn.1800182f0
xor eax, eax
jmp 0x180042089
mov eax, 1
mov rcx, qword [rsp + 0x14e0]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x14f8
ret
Function at 0x180042350
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x228
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x230]
mov qword [rax], 0xffffffffffffffff
lea rdx, [rsp + 0x70]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800423c7
mov edx, dword [rsp + 0x20]
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.1800182f0
mov eax, 1
jmp 0x180042540
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.180052bc0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 6
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.10001
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x18004243a
mov edx, dword [rsp + 0x20]
lea rcx, str.getaddrinfo_failed_with_error:__d_n
call fcn.1800182f0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x180042540
cmp qword [rsp + 0x30], 0
je 0x180042517
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + 0xc]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 8]
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x230]
mov qword [rcx], rax
mov rax, qword [rsp + 0x230]
cmp qword [rax], 0xffffffffffffffff
jne 0x1800424b7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_failed_with_error:__d_n
call fcn.1800182f0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 1
jmp 0x180042540
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + 0x10]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x20]
mov rax, qword [rsp + 0x230]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x180042517
mov rax, qword [rsp + 0x230]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rsp + 0x230]
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 1
jmp 0x180042540
mov rax, qword [rsp + 0x230]
cmp qword [rax], 0xffffffffffffffff
jne 0x18004253e
lea rcx, str.Unable_to_connect_to_server__n
call fcn.1800182f0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x180042540
xor eax, eax
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x228
ret
Function at 0x180042560
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rdx, qword [rsp + 0x40]
lea rcx, str.socketSendOnce:__s_n
call fcn.1800182f0
mov edx, 5
lea rcx, [rsp + 0x28]
call fcn.180042350
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800425a6
lea rcx, [0x1800889f8]
call fcn.1800182f0
mov eax, dword [rsp + 0x20]
jmp 0x180042609
mov rcx, qword [rsp + 0x40]
call fcn.180059c20
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1800425fd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x180088a18]
call fcn.1800182f0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x180042609
lea rcx, [rsp + 0x28]
call fcn.180042770
xor eax, eax
add rsp, 0x38
ret

Function at 0x180042620
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x48]
call fcn.180059c20
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18004268b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.send_failed_with_error:__d_n
call fcn.1800182f0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x18004268d
xor eax, eax
add rsp, 0x38
ret

Function at 0x1800426a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0x200
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x18004270c
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
add eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
xor eax, eax
jmp 0x180042762
cmp dword [rsp + 0x20], 0
jne 0x180042721
lea rcx, str.Socket_Connection_closed_n
call fcn.1800182f0
jmp 0x180042760
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x274c
jne 0x18004273b
xor eax, eax
jmp 0x180042762
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_recv_failed_with_error:__d_n
call fcn.1800182f0
mov rcx, qword [rsp + 0x40]
call fcn.180042770
mov eax, 1
jmp 0x180042762
xor eax, eax
add rsp, 0x38
ret
Function at 0x18004c030
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x488
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x490]
lea rcx, vtable.CTWAIN_UI.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x490]
add rax, 0x20
mov rcx, rax
call fcn.180003470
nop
mov rax, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x498]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x490]
mov byte [rax + 0x1c], 0
mov rax, qword [rsp + 0x490]
add rax, 0x10
mov r8d, recv
xor edx, edx
mov rcx, rax
call fcn.180052bc0
mov rax, qword [rsp + 0x490]
add rax, 0x20
lea rdx, [0x180088da1]
mov rcx, rax
call fcn.18000e530
lea rdx, [rsp + 0x360]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9d, 1
mov r8d, 0x8023
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x18004c106
jmp 0x18004c2b5
lea rcx, [rsp + 0x30]
call fcn.180059c20
movsx eax, byte [rsp + rax + 0x2f]
cmp eax, 0x2f
je 0x18004c130
lea r8, [0x180088da4]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800622d4
lea r8, str.TWAIN_Working_Group_Sample2_
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800622d4
lea rcx, [rsp + 0x30]
call fcn.180059c20
movsx eax, byte [rsp + rax + 0x2f]
cmp eax, 0x2f
je 0x18004c170
lea r8, [0x180088dc8]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800622d4
lea r8, str.A4FAF845_1383_4036_AEDC_17C3968188B4
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800622d4
lea rcx, [rsp + 0x30]
call fcn.180059c20
movsx eax, byte [rsp + rax + 0x2f]
cmp eax, 0x2f
je 0x18004c1b0
lea r8, [0x180088dcc]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800622d4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x18004c28d
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.1800621a0
lea rax, [rsp + 0x250]
mov qword [rsp + 0x28], rax
mov edx, 0x2f
mov rcx, qword [rsp + 0x28]
call fcn.18004da60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18004c28d
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
mov r8, qword [rsp + 0x28]
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.1800621a0
lea r8, [0x180088df8]
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.1800622d4
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x18004c27b
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18004c267
jmp 0x18004c2b5
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x18004c27b
jmp 0x18004c2b5
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18004c1e7
mov rax, qword [rsp + 0x490]
add rax, 0x20
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180003840
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
mov rax, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0x488
ret
Function at 0x18004d2c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x1800a2228]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xd0]
add rax, 0x20
mov r8, qword [rsp + 0xd8]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180002970
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea r8, [0x180088e10]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.180002910
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xd8]
call fcn.1800037e0
lea rcx, [rsp + 0x70]
call fcn.180003710
nop
lea rcx, [rsp + 0x90]
call fcn.180003710
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0xd8]
call fcn.1800043b0
lea r8, [0x180088e18]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180061dc0
cmp qword [rsp + 0x28], 0
jne 0x18004d3a9
mov byte [rsp + 0x21], 0
mov rcx, qword [rsp + 0xd8]
call fcn.180003710
movzx eax, byte [rsp + 0x21]
jmp 0x18004d511
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.180062eec
mov rcx, qword [rsp + 0x28]
call fcn.180063444
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x28]
call fcn.1800636a4
mov byte [rsp + 0x20], 1
cmp dword [rsp + 0x24], 0
jne 0x18004d405
mov rcx, qword [rsp + 0x28]
call fcn.180061940
mov byte [rsp + 0x22], 0
mov rcx, qword [rsp + 0xd8]
call fcn.180003710
movzx eax, byte [rsp + 0x22]
jmp 0x18004d511
mov qword [rsp + 0x40], 0
mov ecx, dword [rsp + 0x24]
call fcn.180021960
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18004d46a
mov rcx, qword [rsp + 0x30]
call fcn.1800219e0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18004d463
mov eax, dword [rsp + 0x24]
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x40]
call fcn.180062c14
cmp rax, 1
je 0x18004d461
mov byte [rsp + 0x20], 0
jmp 0x18004d468
mov byte [rsp + 0x20], 0
jmp 0x18004d46f
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x28]
call fcn.180061940
cmp qword [rsp + 0x30], 0
je 0x18004d4f6
mov rcx, qword [rsp + 0x30]
call fcn.180021a20
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x18004d4ec
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x64], rax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x60]
call qword [rax + 0x1a0]
cwde
test eax, eax
jne 0x18004d4db
mov dword [rsp + 0x38], 1
jmp 0x18004d4e3
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x30]
call fcn.1800219a0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x23], al
mov rcx, qword [rsp + 0xd8]
call fcn.180003710
movzx eax, byte [rsp + 0x23]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800507a0
add rsp, 0xc8
ret

Function at 0x180071048
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180071068
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180064ba4
or eax, 0xffffffff
jmp 0x18007106a
xor eax, eax
add rsp, 0x28
ret