joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002860
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x200
movzx ebx, dx
mov rdi, rcx
lea rdx, [rsp + 0x60]
mov ecx, 0x202
mov rbp, r9
mov rsi, r8
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180002966
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
movzx eax, bx
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x11
mov dword [rsp + 0x34], eax
mov rax, qword [0x180057368]
test rax, rax
jne 0x1800028ec
xor ecx, ecx
call fcn.180003010
mov qword [0x180057368], rax
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call rax
mov ecx, eax
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x28]
test edi, edi
jne 0x18000293e
mov ecx, dword [rbx + 4]
cmp ecx, 2
je 0x18000291f
cmp ecx, 0x17
je 0x180002932
jmp 0x18000293e
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
mov dword [rsp + 0x20], ecx
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov rax, qword [rbx + 0x20]
movups xmm0, xmmword [rax + 8]
movups xmmword [rbp], xmm0
mov rax, qword [0x180057370]
test rax, rax
jne 0x180002959
lea ecx, [rax + 2]
call fcn.180003010
mov qword [0x180057370], rax
mov rcx, rbx
call rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180003010
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x270
cmp dword [0x180057360], 0
lea rax, [0x180002aa0]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x180002da0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.180002a50]
mov qword [rsp + 0x48], rax
jne 0x1800031ca
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800031c0
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x280], rsi
call fcn.180029d4c
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.180029db0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800030f2
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003152
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.180029d4c
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.180029db0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800031b8
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003152
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1800031b8
mov qword [rsp + 0x288], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1800031a7
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x180003161
mov rax, qword [rsp + 0x28]
mov qword [0x1800500d8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1800500e8], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1800500f8], rax
jmp 0x1800031b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov dword [0x180057360], 1
mov rbx, qword [rsp + 0x290]
movzx eax, bp
lea rcx, [0x1800500d0]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
add rsp, 0x270
pop rbp
ret
Function at 0x180003430
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
movzx ebp, r9w
mov qword [rdi], 0
mov r14d, r8d
mov r15d, edx
mov byte [r12], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x180003508
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x1800034cb
cmp word [rax + 0x12], 4
jne 0x1800034cb
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800034cb
nop word [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov edx, r14d
mov ecx, r15d
call fcn.180003390
mov qword [rdi], rax
test rax, rax
je 0x180003501
mov rcx, qword [rbx + 8]
add rbx, 8
lea rdi, [rax + 0x28]
test rcx, rcx
jne 0x1800034a0
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r12
lea edx, [r9 + 1]
call fcn.180029804
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, 8
jmp 0x1800034e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x18000351f
dec eax
je 0x18000352d
dec eax
je 0x180003526
dec eax
mov eax, 0x2af9
jmp 0x1800034e7
mov eax, 0x2afb
jmp 0x1800034e7
mov eax, 0x2afa
jmp 0x1800034e7
Function at 0x180004a40
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180057380]
xor ebx, ebx
call qword [rax + 0x2d8]
mov rdi, rax
test rax, rax
je 0x180004a6e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x180004a76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.180028d88
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180004af0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180057380]
xor edi, edi
call qword [rax + 0x2d8]
mov rbx, rax
test rax, rax
je 0x180004b3e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180004b31
test al, 1
je 0x180004b31
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180004b46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call fcn.180028d88
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x180004b70
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x10020
call fcn.18002a970
sub rsp, rax
mov rax, qword [0x180057380]
call qword [rax + 0x2d8]
mov rbx, rax
test rax, rax
je 0x180004bb4
lea rdx, [rsp + 0x20]
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
test eax, eax
jne 0x180004bbf
call fcn.180028d88
xor eax, eax
add rsp, 0x10020
pop rbx
ret
call fcn.180028d88
mov rax, qword [0x180057380]
lea rcx, [rsp + 0x20]
call qword [rax + 0x2e0]
add rsp, 0x10020
pop rbx
ret
Function at 0x180004d00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r13
push r14
mov eax, 0x10290
call fcn.18002a970
sub rsp, rax
mov r13, r8
mov rbx, rcx
mov r9, rcx
lea r8, [0x18003fc44]
lea rcx, [rsp + 0x280]
xor esi, esi
mov edx, 0x8000
mov edi, esi
call fcn.18002a9c0
lea edx, [rsi + 0x2a]
mov rcx, rbx
call fcn.18002abd0
test rax, rax
jne 0x180004d8d
lea r8, str._s
lea rcx, [rsp + 0x280]
mov r9, rbx
mov edx, 0x8000
call fcn.18002a9c0
mov rcx, rbx
call fcn.18002ab60
mov rdi, rax
test rax, rax
jne 0x180004db9
mov r14, qword [rsp + 0x102d8]
mov esi, 8
jmp 0x180004f1f
mov edx, 0x5c
mov rcx, rbx
call fcn.18002abd0
mov r14, rax
test rax, rax
je 0x180004db9
mov rcx, rbx
mov byte [rax], sil
call fcn.18002ab60
mov rdi, rax
test rax, rax
je 0x180004d7b
mov byte [r14], 0x5c
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x10288], r12
call fcn.180004b70
mov r12, rax
test rax, rax
jne 0x180004de6
mov r14, qword [rsp + 0x102d8]
lea esi, [rax + 8]
jmp 0x180004f17
mov rcx, rax
mov rax, qword [0x180057380]
call qword [rax + 0x2d8]
mov r14, rax
test rax, rax
jne 0x180004e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180004f17
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x102c0], rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
test rax, rax
jne 0x180004e36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180004f0f
mov qword [rsp + 0x10280], r15
nop
cmp rbp, 0xffffffffffffffff
je 0x180004eee
mov rax, qword [0x180057380]
lea rcx, [rsp + 0x5c]
call qword [rax + 0x2e0]
mov rdx, qword [0x180057380]
lea rcx, [rsp + 0x264]
mov rbx, rax
call qword [rdx + 0x2e0]
mov edx, 0x8000
lea rcx, [rsp + 0x8280]
mov r15, rax
test rdi, rdi
je 0x180004e9f
lea r8, str._s_s
mov r9, rdi
mov qword [rsp + 0x20], rbx
call fcn.18002a9c0
jmp 0x180004eae
lea r8, [0x18003fc44]
mov r9, rbx
call fcn.18002a9c0
lea r9, [rsp + 0x8280]
mov r8, r15
mov rdx, rbx
mov rcx, r13
call qword [rsp + 0x102c8]
mov rcx, rbx
call fcn.180028d88
mov rcx, r15
call fcn.180028d88
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180004e40
jmp 0x180004ef6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r12
call fcn.180028d88
mov r15, qword [rsp + 0x10280]
mov rbp, qword [rsp + 0x102c0]
mov r12, qword [rsp + 0x10288]
mov rcx, rdi
call fcn.180028d88
mov rcx, r14
call fcn.180028d88
mov eax, esi
add rsp, 0x10290
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004f50
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.18002a970
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180004f85
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x10020
pop rbx
ret
mov rax, qword [0x180057380]
lea rcx, [rsp + 0x20]
call qword [rax + 0x2e0]
mov qword [rbx], rax
test rax, rax
je 0x180004f76
xor eax, eax
add rsp, 0x10020
pop rbx
ret
Function at 0x180004fb0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180057380]
xor ebx, ebx
call qword [rax + 0x2d8]
mov rdi, rax
test rax, rax
je 0x180004fe0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180004fe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.180028d88
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005010
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180057380]
mov rbx, rdx
xor edi, edi
call qword [rax + 0x2d8]
mov rcx, rbx
mov rsi, rax
mov rax, qword [0x180057380]
call qword [rax + 0x2d8]
mov rbx, rax
test rsi, rsi
je 0x180005061
test rax, rax
je 0x180005061
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x180005069
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call fcn.180028d88
mov rcx, rbx
call fcn.180028d88
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x1800050a0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180057380]
mov rbx, rdx
xor edi, edi
call qword [rax + 0x2d8]
mov rcx, rbx
mov rsi, rax
mov rax, qword [0x180057380]
call qword [rax + 0x2d8]
mov rbx, rax
test rsi, rsi
je 0x1800050f4
test rax, rax
je 0x1800050f4
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1800050fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call fcn.180028d88
mov rcx, rbx
call fcn.180028d88
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180006a40
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x10280
call fcn.18002a970
sub rsp, rax
mov rax, qword [rdx]
mov r14, r8
mov rbp, rcx
mov r9, rcx
mov rdi, rdx
lea r8, [0x18003fc38]
lea rcx, [rsp + 0x280]
mov edx, 0x8000
mov qword [rsp + 0x20], rax
call fcn.18002af38
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180006b78
mov qword [rsp + 0x10290], rbx
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x5e]
cmp dx, word [0x18003fc30]
jne 0x180006acf
cmp cx, word [0x18003fc32]
je 0x180006b35
cmp dx, word [0x18003fbf8]
jne 0x180006aef
cmp cx, word [0x18003fbfa]
jne 0x180006aef
movzx eax, word [rsp + 0x60]
cmp ax, word [0x18003fbfc]
je 0x180006b35
test byte [rsp + 0x30], 0x10
jne 0x180006b35
mov rbx, qword [rsp + 0x44]
mov rcx, rbx
call fcn.180005a50
mov ecx, dword [rdi + 0x14]
cmp ecx, 0xffffffff
je 0x180006b0f
cmp ecx, eax
ja 0x180006b35
mov ecx, dword [rdi + 0x18]
cmp ecx, 0xffffffff
je 0x180006b1b
cmp ecx, eax
jb 0x180006b35
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rbx
call fcn.180005a90
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180006ab3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x10290]
xor eax, eax
lea r11, [rsp + 0x10280]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180006b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180006b5e
Function at 0x180006ba0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x2a0
xor esi, esi
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x30], esi
mov edi, esi
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x50], esi
call fcn.1800294f0
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], si
jne 0x180006be5
add rcx, 5
cmp dword [rsp + 0x2d8], 0x20
jg 0x180006dd6
cmp rcx, 0x8000
jae 0x180006dd6
mov edx, 2
call fcn.180028d44
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180006dd6
lea r8, str._s.
mov r9, rbx
mov edx, 0x8000
mov rcx, rax
call fcn.18002af38
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x180006db5
nop dword [rax + rax]
test byte [rsp + 0x50], 0x10
je 0x180006d54
cmp dword [rbp + 0x10], 0
je 0x180006d84
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
cmp cx, word [0x18003fc30]
jne 0x180006c95
cmp ax, word [0x18003fc32]
je 0x180006d84
cmp cx, word [0x18003fbf8]
jne 0x180006cbc
cmp ax, word [0x18003fbfa]
jne 0x180006cbc
movzx eax, word [rsp + 0x80]
cmp ax, word [0x18003fbfc]
je 0x180006d84
or rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x180006cc0
lea rdx, [rsp + 0x7c]
or rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x180006ce0
lea rsi, [rax + rcx]
mov edx, 2
lea rcx, [rsi + 0x20]
call fcn.180028d44
mov rdi, rax
test rax, rax
je 0x180006d7c
lea rax, [rsp + 0x7c]
lea r8, [0x18003fc38]
lea rdx, [rsi + 0x20]
mov r9, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18002af38
mov r9d, dword [rsp + 0x2d8]
mov r8, qword [rsp + 0x2d0]
inc r9d
mov rdx, rbp
mov rcx, rdi
call fcn.180006ba0
mov rcx, rdi
mov esi, eax
mov dword [rsp + 0x30], eax
call fcn.180028d88
jmp 0x180006d80
test edi, edi
jne 0x180006d84
mov r8, qword [rsp + 0x2d0]
mov rdx, rbp
mov rcx, rbx
call fcn.180006a40
mov edi, 1
mov esi, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], edi
jmp 0x180006d84
mov esi, dword [rsp + 0x30]
mov edi, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180006c60
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x40]
call fcn.180028d88
mov eax, esi
jmp 0x180006dd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180006dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rsp + 0x40]
call fcn.180028d88
mov eax, esi
jmp 0x180006dd8
xor eax, eax
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006ed0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rdi, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [rsp + 0x58]
mov ebx, 0x61
mov ebp, eax
xor r12d, r12d
nop dword [rax]
nop word [rax + rax]
movzx r9d, bx
lea ecx, [r9 - 0x61]
movzx edx, cl
bt ebp, edx
jae 0x180006f6e
xor eax, eax
lea r8, [0x180040008]
lea rcx, [rsp + 0x58]
lea edx, [rax + 3]
mov word [rsp + 0x58], r12w
mov dword [rsp + 0x5a], eax
call fcn.18002af38
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffd
cmp eax, 1
ja 0x180006f6e
lea rax, [rsp + 0x58]
mov r9, r14
mov r8, rdi
xor edx, edx
mov rcx, r15
mov qword [rdi + 8], rax
call fcn.180006e00
mov esi, eax
inc bx
cmp bx, 0x7a
jbe 0x180006f10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 8], r12
mov eax, esi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x180007040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov rcx, qword [rcx + 0x18]
mov rdi, rdx
xor eax, eax
lea rdx, [rsp + 0x20]
lea r8, [r11 + 0x18]
mov dword [r11 + 0x18], 0x80
mov word [r11 + 8], ax
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x180007083
mov eax, 0x507
add rsp, 0xa0
pop rdi
ret
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xb8], rbx
call fcn.180007110
mov rbx, rax
test rax, rax
jne 0x1800070b9
lea eax, [rbx + 0xe]
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
mov r8, rax
mov rax, qword [0x180057380]
mov edx, 0x105de
mov rcx, rdi
call qword [rax + 0x50]
mov rax, qword [0x180057380]
movzx r8d, word [rsp + 0xb0]
mov edx, 0x205df
mov rcx, rdi
call qword [rax + 0x58]
mov rcx, rbx
call fcn.180028d88
mov rbx, qword [rsp + 0xb8]
xor eax, eax
add rsp, 0xa0
pop rdi
ret
Function at 0x180007c80
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor eax, eax
mov r15, r9
movzx r13d, r8w
mov r12, rdx
mov edi, eax
mov ebx, eax
mov ebp, eax
test r9, r9
je 0x180007cbb
mov qword [r9], rax
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x180007ccb
mov qword [r14], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea edx, [r9 + 1]
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180007cf9
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180007d6f
mov eax, 2
movzx ecx, r13w
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, r12
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x34], eax
cmp eax, 0xffffffff
jne 0x180007d50
mov rcx, r12
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180007d3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180007d6f
mov rdx, qword [rax + 0x18]
movsx r8, word [rax + 0x12]
lea rcx, [rsp + 0x34]
mov rdx, qword [rdx]
call fcn.180028f70
lea rdx, [rsp + 0x30]
mov r8d, 0x10
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180007d7e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
je 0x180007e6b
jmp 0x180007e10
mov ecx, 0x28
call fcn.180028dc8
mov rdi, rax
test rax, rax
jne 0x180007d95
lea ebx, [rax + 8]
jmp 0x180007e10
xor eax, eax
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x18], rsi
xor ecx, ecx
mov qword [rdi], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [0x180007f40]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
lea rax, [0x180008050]
mov qword [rsp + 0x50], rax
mov rax, qword [0x180057380]
call qword [rax + 0x1f8]
mov rbp, rax
test rax, rax
jne 0x180007e22
mov rcx, rdi
lea ebx, [rax + 8]
call fcn.180007eb0
xor edi, edi
test rsi, rsi
je 0x180007e1e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor ebp, ebp
jmp 0x180007e6b
mov qword [rdi + 8], rax
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x180007e6b
mov rcx, qword [rdi + 0x18]
mov r8d, 0x21
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
mov rax, qword [0x180057380]
mov rcx, qword [rdi + 0x10]
lea r9, [0x180008090]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [rax + 0x2c0]
test r15, r15
je 0x180007e73
mov qword [r15], rbp
mov eax, ebx
test r14, r14
je 0x180007e7d
mov qword [r14], rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret