joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000defc
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], r8
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rbx, rcx
lea rbp, [0x1000236a0]
lea r8d, [r12 + 0x50]
xor edx, edx
mov rcx, rbp
mov rdi, r9
mov esi, r12d
mov dword [rax + 0x18], r12d
mov word [0x100022d90], r12w
mov word [0x100023070], r12w
call sub.msvcrt.dll_memset
lea rax, [0x10000c87c]
mov rcx, rbp
mov qword [0x1000236c8], rbx
mov qword [0x1000236d0], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x100027010]
lea rax, [0x10000c88c]
lea r8, [0x100023280]
mov r9d, 0x104
mov edx, 0x191
mov qword [rdi], rbp
mov dword [0x100023768], r12d
mov qword [0x100023488], rax
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x10000e081
mov rcx, qword [0x100027010]
lea r9d, [r12 + 0x64]
lea r8, [0x100022fa0]
mov edx, 0x105
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x10000e081
call fcn.10000f26c
mov qword [0x1000236d8], rax
cmp rax, r12
je 0x10000e081
lea ecx, [r12 + 0x28]
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
cmp rax, r12
je 0x10000e005
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.10000f234
mov esi, dword [rsp + 0x60]
jmp 0x10000e008
mov rax, r12
mov qword [0x100022968], rax
cmp rax, r12
je 0x10000e081
cmp esi, r12d
jne 0x10000e081
xor r9d, r9d
lea rax, [0x100023070]
xor r8d, r8d
lea edx, [r9 + 0x10]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, r12d
jl 0x10000e081
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x100022b78], rax
cmp rax, r12
je 0x10000e081
call fcn.100014494
mov qword [0x100023740], rax
cmp rax, r12
je 0x10000e081
call fcn.10000e158
cmp eax, r12d
je 0x10000e106
mov dword [0x100023768], 1
lea rdx, [0x100003fc8]
lea rcx, [rsp + 0x60]
call fcn.1000184c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov r9d, eax
mov edx, 2
mov r8d, 0xc0ff2005
call fcn.100018518
mov rcx, qword [0x1000236d8]
cmp rcx, r12
je 0x10000e0c1
call fcn.10000f310
mov rbx, qword [0x100022968]
cmp rbx, r12
je 0x10000e0de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
mov rcx, qword [0x100022b78]
cmp rcx, r12
je 0x10000e12b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x100022b78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x102
jmp 0x10000e127
mov eax, 1
jmp 0x10000e13d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x100022b78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x10000e10d
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x10000e13b
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x10000e158
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
lea rax, [0x100023278]
mov r9d, 0x20019
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10000e18f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10000e2b2
mov rcx, qword [0x100023278]
lea rax, [rsp + 0x60]
lea rdx, [0x100003f98]
mov qword [rsp + 0x40], rax
lea rax, [0x100023068]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10000e184
mov rcx, qword [0x100023278]
lea rax, [0x100023748]
lea rdx, [0x100003f18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
xor ecx, ecx
call fcn.10000e9f4
lea rcx, [0x100003e00]
call fcn.10000f4fc
mov qword [0x1000236e0], rax
test rax, rax
je 0x10000e247
mov rcx, qword [0x1000236d8]
mov rdx, rax
call fcn.10000f3b4
test eax, eax
jne 0x10000e247
mov rcx, qword [0x1000236e0]
call fcn.10000f1a0
and qword [0x1000236e0], 0
lea rcx, [0x100003e0c]
call fcn.10000f4fc
mov qword [0x1000236e8], rax
test rax, rax
je 0x10000e290
mov rcx, qword [0x1000236d8]
mov rdx, rax
call fcn.10000f3b4
test eax, eax
jne 0x10000e289
mov rcx, qword [0x1000236e8]
call fcn.10000f1a0
xor eax, eax
mov qword [0x1000236e8], rax
jmp 0x10000e290
mov rax, qword [0x1000236e8]
cmp qword [0x1000236e0], 0
jne 0x10000e2b0
test rax, rax
jne 0x10000e2b0
lea rcx, [0x100003fe0]
call sub.ntdll.dll_DbgPrint
or eax, 0xffffffff
jmp 0x10000e2b2
xor eax, eax
add rsp, 0x58
ret

Function at 0x10000e46c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [0x100023748]
lea rax, [r11 - 0x18]
mov rdi, r9
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x14]
mov esi, r8d
xor r9d, r9d
xor r8d, r8d
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10000e4c2
cmp esi, dword [rdi]
je 0x10000e4be
mov dword [rdi], esi
lea eax, [rbx + 1]
jmp 0x10000e4e3
xor eax, eax
jmp 0x10000e4e3
cmp dword [rsp + 0x34], ebx
je 0x10000e4d5
cmp dword [rdi], ebx
jne 0x10000e4e1
mov ebx, 1
mov dword [rdi], ebx
jmp 0x10000e4e1
cmp dword [rdi], ebx
je 0x10000e4e1
and dword [rdi], 0
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x10000f4fc
Capabilities:
Initialize winsock library
Print debug messages
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rsi, rcx
xor edi, edi
lea rdx, [rsp + 0x50]
lea ecx, [rdi + 2]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10000f619
lea r8, [0x100004038]
lea ecx, [rdi + 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x10000f57a
and qword [rsp + 0x20], rdi
lea edx, [rdi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000f58e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100004070]
mov edx, eax
call sub.ntdll.dll_DbgPrint
mov rbx, rdi
test rdi, rdi
je 0x10000f5e4
lea rdx, [0x100003e0c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10000f5b1
lea rbx, [rdi + 0x274]
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
or r8d, 0xffffffff
or edx, r8d
or ecx, r8d
mov r9, rbx
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp rbx, 0xffffffffffffffff
jne 0x10000f6c5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [0x100004098]
mov edx, eax
call sub.ntdll.dll_DbgPrint
xor r8d, r8d
lea edx, [r8 + 1]
lea edi, [rdx + 0x19]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x10000f640
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.100019220
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
and dword [rsp + 0x32], 0
lea rax, [rsp + 0x36]
mov word [rsp + 0x30], di
sub rsi, rax
mov edx, 0x19
lea rcx, [rsp + 0x36]
lea rax, [rdx + 0x7fffffe5]
test rax, rax
je 0x10000f67a
mov al, byte [rsi + rcx]
test al, al
je 0x10000f67a
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x10000f65c
test rdx, rdx
jne 0x10000f682
dec rcx
mov byte [rcx], 0
lea rdx, [rsp + 0x30]
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10000f6b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x10000f619
mov edx, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x10000f69e
mov rcx, rbx
call fcn.10000fd28
mov rdi, rax
test rax, rax
jne 0x10000f6de
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rdi
jmp 0x10000f61b
Function at 0x10000f6ec
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 0x1a
lea r9, [0x100003e00]
mov dword [rsp + 0x22], edx
lea ebx, [rax - 1]
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x26]
mov rdi, rcx
mov dword [rcx + 0x54], 1
lea rdx, [rsp + 0x26]
sub r9, rax
mov r8, rbx
lea rax, [r8 + 0x7fffffe5]
test rax, rax
je 0x10000f756
mov al, byte [r9 + rdx]
test al, al
je 0x10000f756
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x10000f737
test r8, r8
jne 0x10000f75e
dec rdx
mov rcx, qword [rcx + 0x58]
mov byte [rdx], 0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x10000f77e
xor eax, eax
jmp 0x10000f7da
lea rdx, [0x100003e0c]
lea rax, [rsp + 0x26]
lea rcx, [rsp + 0x26]
sub rdx, rax
lea rax, [rbx + 0x7fffffe5]
test rax, rax
je 0x10000f7b0
mov al, byte [rdx + rcx]
test al, al
je 0x10000f7b0
mov byte [rcx], al
inc rcx
sub rbx, 1
jne 0x10000f792
test rbx, rbx
jne 0x10000f7b8
dec rcx
mov byte [rcx], 0
mov rcx, qword [rdi + 0x58]
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10000f77a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.100019220
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x10000fbe8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 0x58]
mov r8d, edx
mov rbx, rcx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
cmp edx, 0xffffffff
jne 0x10000fc82
and dword [rsp + 0x264], 0
lea rax, [rsp + 0x260]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x260], 5
call qword [sym.imp.WS2_32.dll_select]
cmp dword [rbx + 0x48], 0
jne 0x10000fc78
test eax, eax
je 0x10000fc11
mov rcx, qword [rbx + 0x58]
lea rdx, [rbx + 0x290]
xor r9d, r9d
mov r8d, 0xff40
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10000fce2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10000fd05
mov eax, 0x3e3
jmp 0x10000fd05
mov eax, 0x10624dd3
xor r9d, r9d
xor ecx, ecx
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
lea rax, [rsp + 0x260]
mov dword [rsp + 0x260], edx
mov qword [rsp + 0x20], rax
imul edx, edx, 0x3e8
sub r8d, edx
lea rdx, [rsp + 0x30]
imul r8d, r8d, 0x3e8
mov dword [rsp + 0x264], r8d
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x10000fc4e
mov eax, 0x5b4
jmp 0x10000fd05
test eax, eax
jne 0x10000fced
mov eax, 0x2746
jmp 0x10000fd05
mov rcx, qword [rbx + 0x10aa0]
lea rdx, [rbx + 0x290]
mov r8d, eax
call fcn.100011814
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x10000fd28
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ecx, 0x10ae8
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov rbx, rax
test rax, rax
je 0x10000fd8d
and qword [rax + 0x70], 0
and qword [rbx + 8], 0
and dword [rbx + 0x38], 0
and dword [rbx + 0x78], 0
and dword [rbx + 0x48], 0
and dword [rbx + 0x4c], 0
and dword [rbx + 0x10a98], 0
and qword [rbx + 0x60], 0
mov dword [rax + 0x68], 1
or rax, 0xffffffffffffffff
and qword [rbx + 0x10a88], 0
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x10a60], rax
jmp 0x10000fd8f
xor ebx, ebx
test rbx, rbx
jne 0x10000fd98
xor eax, eax
jmp 0x10000fe02
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
call fcn.100010428
test eax, eax
jne 0x10000fdc8
mov edx, 1
mov rcx, rbx
call fcn.10000f0f4
jmp 0x10000fd94
lea rax, [rsp + 0x48]
lea r8, [0x10000fd1c]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov edx, 0x13880
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x10000fdb9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x10000ffcc
Capabilities:
Check if file exists
Create thread
Get file attributes
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, qword [rcx + 0x60]
xor ebp, ebp
mov rdi, r9
mov r15d, edx
mov rsi, rcx
mov r14d, ebp
mov r13d, ebp
mov r12, rbp
cmp word [rbx], bp
je 0x1000100b6
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x10001005f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100010094
and eax, 0x10
je 0x100010094
mov rcx, rbx
call fcn.100011548
mov r11d, eax
add r12, r11
inc r13d
jmp 0x10001007c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbp
inc r14d
mov r11d, eax
add r12, r11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ebp, ebp
cdqe
lea rbx, [rbx + rax*2]
jmp 0x10000fffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, 0xc0ff2009
mov r8d, eax
call fcn.10000feb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
mov ebx, eax
jmp 0x1000100b8
mov ebx, ebp
cmp ebx, ebp
je 0x1000100c4
mov dword [rdi], 2
jmp 0x100010142
cmp r14d, ebp
jne 0x1000100d2
cmp r13d, ebp
je 0x100010175
mov edx, r15d
mov rcx, rsi
call fcn.10000f6ec
mov ebx, eax
cmp eax, ebp
jne 0x1000100f4
mov rdx, r12
mov rcx, rsi
call fcn.100011c08
mov ebx, eax
cmp eax, ebp
je 0x1000100fc
mov dword [rdi], 1
jmp 0x100010142
mov eax, r12d
lea r8, [0x10000ffb4]
mov r9, rsi
mov qword [rsi + 0x10a70], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rbp
jne 0x100010139
mov dword [rdi], ebp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100010142
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, ebp
je 0x100010175
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [rsi + 0x68], 0xffffffff
lea rcx, [rsi + 0x10]
jne 0x10001016f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 1
mov rcx, rsi
call fcn.10000f0f4
jmp 0x100010175
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100010428
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12d, r8d
mov r13, rdx
mov rbx, rcx
mov dword [rax + 0x18], 0x1f4
mov rax, qword [rsp + 0x98]
mov qword [rcx + 0x40], rax
mov dword [rcx + 0x7c], r9d
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test r12d, r12d
je 0x1000104e5
test r13, r13
je 0x1000104e5
mov dword [rbx + 0x50], 1
mov r14, r12
mov eax, 2
mul r12
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x1000104c6
lea rax, [0x1000040c8]
mov qword [rsp + 0x30], rax
lea rdx, [0x10001cfb0]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__CxxThrowException
nop
lea r8, [r14 + r14]
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x1000104f2
and dword [rbx + 0x50], 0
and qword [rbx + 0x60], 0
or r12, 0xffffffffffffffff
and dword [rbx + 0x10a68], 0
cmp dword [rsp + 0x90], 0
je 0x100010546
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 0x19]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x1000105a6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x80]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x10001054a
mov qword [rbx + 0x58], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x1000105a6
and dword [rbx + 0x54], 0
mov dword [rbx + 0x10230], 0x45454545
xor eax, eax
mov qword [rbx + 0x10aa0], rax
mov qword [rbx + 0x10aa8], rax
and dword [rbx + 0x10aa8], eax
mov ecx, 0xff40
call fcn.1000117d8
mov qword [rbx + 0x10aa0], rax
test rax, rax
je 0x1000105a6
mov eax, 1
jmp 0x1000105e2
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x1000105b9
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
and qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0x58]
cmp rcx, r12
je 0x1000105cc
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x58], r12
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1000105e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x70], 0
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop r13
pop r12
ret
Function at 0x10001077c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor ebx, ebx
cmp qword [rcx + 0x10a60], 0xffffffffffffffff
mov r12d, r9d
mov rbp, rdx
mov rdi, rcx
movzx esi, r8w
jne 0x1000107ae
mov eax, 0x3f3
jmp 0x100010819
test esi, esi
je 0x1000107f8
mov rcx, qword [rdi + 0x10a60]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000107f0
mov eax, dword [rsp + 0x60]
add qword [rdi + 0x10a78], rax
add qword [rdi + 0x10a88], rax
add rbp, rax
sub esi, dword [rsp + 0x60]
jne 0x1000107b2
jmp 0x1000107f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r12d, r12d
je 0x100010817
mov edx, 1
mov rcx, rdi
test ebx, ebx
jne 0x100010812
call fcn.100010a00
mov ebx, eax
jmp 0x100010817
call fcn.100010a00
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x100010834
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbx, rcx
lea r8, [rcx + 0x10238]
mov edi, 0x208
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.10000b75c
lea rcx, [rbx + 0x10448]
lea rdx, [rsp + 0x270]
mov r8d, 0x104
call fcn.100011400
lea r8, [rsp + 0x270]
lea rcx, [rsp + 0x60]
mov r9d, 1
mov edx, 0x104
call fcn.100011448
lea rcx, [rbx + 0x10650]
lea r8, [rsp + 0x60]
mov rdx, rdi
call fcn.10000b75c
lea rdx, [rsp + 0x270]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x60]
lea rdx, [0x1000040f0]
lea rcx, [rsp + 0x270]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbx + 0x10858]
lea r8, [rsp + 0x60]
mov rdx, rdi
call fcn.10000b75c
xor edi, edi
cmp word [0x100023490], di
jne 0x10001090e
call fcn.10000e5b0
lea r8, [0x100023490]
lea rcx, [rsp + 0x480]
mov edx, 0x104
call fcn.100005be8
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
or dword [rsp + 0x54], 0xffffffff
lea r8, [rsp + 0x40]
movsxd rcx, eax
mov rax, qword [rbx + 8]
xor r9d, r9d
lea rdx, [rbx + rcx*2 + 0x10650]
mov rcx, qword [0x100023708]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x48], rdx
mov edx, 0x800b
mov dword [rsp + 0x50], edi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x54]
cmp eax, edi
jne 0x1000109d7
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x10a60], rax
cmp rax, 0xffffffffffffffff
jne 0x1000109d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x60]
mov ecx, 0xc0ff2009
mov r8d, eax
call fcn.10000feb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000109d7
xor eax, eax
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.100019220
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret
Function at 0x100010a00
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
cmp dword [rcx + 0x10440], 0xffffffff
mov edi, edx
mov r12d, r13d
mov rbx, rcx
jne 0x100010a35
cmp dword [rcx + 0x10444], 0xffffffff
je 0x100010a54
mov rcx, qword [rcx + 0x10a60]
cmp rcx, 0xffffffffffffffff
je 0x100010a54
lea r9, [rbx + 0x10440]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [rbx + 0x10a60]
cmp rcx, 0xffffffffffffffff
je 0x100010a6f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x10a60], 0xffffffffffffffff
cmp edi, r13d
lea rdi, [rbx + 0x10858]
mov rcx, rdi
je 0x100010ab5
inc dword [rbx + 0x10234]
lea rdx, [rbx + 0x10650]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r13d
jne 0x100010abb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rbx + 0x10650]
mov ecx, 0xc0ff200a
mov r8d, eax
mov r12d, eax
call fcn.10000feb8
jmp 0x100010abb
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 0x10a80], r13
mov qword [rbx + 0x10a88], r13
or dword [rbx + 0x10440], 0xffffffff
or dword [rbx + 0x10444], 0xffffffff
mov word [rbx + 0x10448], r13w
mov word [rbx + 0x10650], r13w
mov rbx, qword [rsp + 0x40]
mov word [rdi], r13w
mov eax, r12d
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x100010b10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rsi, rcx
mov rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov edi, ebp
mov word [rsp + 0x260], bp
call sub.msvcrt.dll_memset
cmp word [0x100023490], bp
jne 0x100010b66
call fcn.10000e5b0
lea r8, [0x100023490]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.100005be8
cmp rbx, rbp
je 0x100010bf2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebp
jle 0x100010bf2
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x260]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, ebp
je 0x100010bf2
cmp eax, 0x104
jae 0x100010bf2
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_wcsncmp]
lea rbx, [rsi + 0x10238]
mov edx, 0x208
mov rcx, rbx
cmp eax, ebp
jne 0x100010c01
lea r8, [rsp + 0x260]
jmp 0x100010c06
lea rbx, [rsi + 0x10238]
mov edx, 0x208
mov rcx, rbx
lea r8, [rsp + 0x50]
call fcn.10000b75c
movzx ecx, word [rbx]
mov rax, rbx
cmp cx, bp
je 0x100010c2b
add rax, 2
movzx edx, cx
mov cx, word [rax]
cmp cx, bp
jne 0x100010c16
cmp dx, 0x5c
je 0x100010c3f
lea r8, [0x1000026ec]
mov edx, 0x208
mov rcx, rbx
call fcn.100006714
cmp dword [rsi + 0x4c], ebp
je 0x100010c9b
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
or dword [rsp + 0x34], 0xffffffff
lea r8, [rsp + 0x20]
movsxd rcx, eax
mov rax, qword [rsi + 8]
xor r9d, r9d
lea rdx, [rsi + rcx*2 + 0x10238]
mov rcx, qword [0x100023708]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x28], rdx
mov edx, 0x800b
mov dword [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [rsp + 0x34]
cmp edi, ebp
jne 0x100010ccc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100010cae
and eax, 0x10
jne 0x100010ccc
mov rcx, rbx
call fcn.1000111fc
mov edi, eax
cmp eax, ebp
je 0x100010ccc
mov r8d, eax
mov rdx, rbx
mov ecx, 0xc0ff200b
call fcn.10000feb8
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.100019220
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret