joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov dword [r8], ebx
mov rdi, r8
lea r8, [0x1400cdcb0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r9, qword [rsp + 0x20]
test r9, r9
je 0x140033844
lea edx, [rbx + 1]
lea r8d, [rbx + 2]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 2
jne 0x140033844
movzx eax, word [rsp + 0x50]
cmp al, 0xff
jne 0x1400337e8
cmp byte [rsp + 0x51], 0xfe
jne 0x140033800
mov ebx, 2
mov dword [rdi], ebx
jmp 0x140033844
cmp al, 0xfe
jne 0x140033800
cmp byte [rsp + 0x51], 0xff
jne 0x140033800
mov ebx, 3
mov dword [rdi], 2
jmp 0x140033844
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x58]
mov edx, 1
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 3
jne 0x140033844
cmp byte [rsp + 0x58], 0xef
jne 0x140033844
cmp byte [rsp + 0x59], 0xbb
jne 0x140033844
cmp byte [rsp + 0x5a], 0xbf
jne 0x140033844
lea ebx, [rax - 2]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400347b0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov edx, ntohs
lea rcx, [rsp + 0x20]
mov r9, rbx
lea r8d, [rdx - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x14003480c
movzx ecx, word [rsp + 0x20]
cmp cx, word [0x1400d2698]
jne 0x14003480c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x40
pop rbx
ret

Function at 0x140034830
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r9, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp eax, 2
jne 0x140034872
mov ecx, 0xd8ff
cmp word [rsp + 0x38], cx
jne 0x140034872
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140034880
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r9, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp eax, 3
jne 0x1400348d1
movzx ecx, word [rsp + 0x38]
cmp cx, word [0x1400d26a4]
jne 0x1400348d1
movzx ecx, byte [rsp + 0x3a]
cmp cl, byte [0x1400d26a6]
jne 0x1400348d1
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400348e0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rbx
lea r8d, [rdx + 7]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call fcn.140089d60
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x30
pop rbx
ret

Function at 0x140036070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, [rcx + 0x90]
add rcx, 0x68
call fcn.1400a1fc0
cmp eax, 1
je 0x1400360fb
nop word [rax + rax]
mov edx, 0x1000
lea rcx, [rdi + 0x68]
call fcn.1400a1eb0
mov qword [rdi + 0x88], rax
test rax, rax
je 0x140036110
mov r9, qword [rdi + 0x38]
mov edx, 1
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
je 0x140036110
mov edx, eax
lea rcx, [rdi + 0x68]
call fcn.1400a2170
test eax, eax
jne 0x140036110
lea rdx, [rdi + 0x90]
lea rcx, [rdi + 0x68]
call fcn.1400a1fc0
cmp eax, 1
jne 0x1400360a0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400365a0
Capabilities:
Get file size

Disassembly:
mov r8d, edx
mov r9d, 0xffffffff
mov rdx, qword [rcx + 0x48]
jmp fcn.1400361b0

Function at 0x1400365c0
Capabilities:
Create thread
Get file size

Disassembly:
mov r8d, dword [rcx + 0x50]
mov r9d, edx
mov rdx, qword [rcx + 0x48]
jmp fcn.1400361b0
Function at 0x140039b50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
call fcn.140037730
mov qword [rdi + 0x28], rbx
lea r8, [0x140039be0]
xor ebx, ebx
mov r9, rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003ae70
Capabilities:
Send data

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbp
mov r14, rdx
mov rbp, rcx
mov rax, qword [0x140104018]
mov qword [rsp + 0x70], rax
mov r8, qword [rcx + 0x50]
lea rdx, [0x1400d37e0]
lea rcx, [rsp + 0x70]
call fcn.1400086c0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
xor esi, esi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140031120
lea rdi, [rsi - 1]
test rax, rax
je 0x14003af42
mov dword [rsp + 0x60], esi
mov r8, rdi

Function at 0x14003aee8
Capabilities:
Send data

Disassembly:
inc r8
cmp byte [rax + r8], 0
jne 0x14003aee5
lea r9, [rsp + 0x60]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x14003af42
mov eax, dword [rsp + 0x60]
add dword [rbp + 0x5c], eax
mov eax, dword [rbp + 0x5c]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
mulss xmm1, dword [0x1400d230c]
mov eax, dword [rbp + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
divss xmm1, xmm0
cvttss2si edx, xmm1
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call fcn.1400022e0
mov esi, 1
lea rcx, [rsp + 0x28]
call fcn.1400018c0
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140104010]
je 0x14003af68
lock xadd dword [rcx], edi
sub edi, 1
jg 0x14003af68
call fcn.1400bf5e4
mov eax, esi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140045780
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, r9d
mov r14d, r8d
mov esi, edx
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rbx
lea rdi, [rcx + 0x58]
xor r12d, r12d
mov qword [rdi], r12
xor edx, edx
mov rcx, rbx
call fcn.140001c10
mov rdx, rax
lea r8, [0x1400d0aec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r9, qword [rdi]
test r9, r9
jne 0x14004581c
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x140045815
mov eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140045815
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
xor eax, eax
jmp 0x140045912
mov eax, 0x4d42
mov word [rsp + 0x30], ax
mov dword [rsp + 0x36], r12d
mov ecx, 3
mov r15d, 1
test ebp, ebp
cmovne ecx, r15d
imul ecx, esi
mov eax, ecx
and eax, 0x80000003
jge 0x14004584f
dec eax
or eax, 0xfffffffc
inc eax
add eax, ecx
imul eax, r14d
add eax, 0x36
mov dword [rsp + 0x32], eax
mov dword [rsp + 0x3a], getservbyport
mov dword [rsp + 0x40], 0x28
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], r14d
mov word [rsp + 0x4c], r15w
mov eax, 0x18
mov ecx, 8
test ebp, ebp
cmovne ax, cx
mov word [rsp + 0x4e], ax
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], 0xec4
mov qword [rsp + 0x5c], 0xec4
mov dword [rsp + 0x64], r12d
mov r8, r15
lea edx, [rcx + 6]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, r15
jne 0x1400457eb
mov r9, qword [rdi]
mov r8, r15
mov edx, 0x28
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rax, r15
jne 0x1400457f2
cmp rcx, qword [0x140104010]
je 0x14004590f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14004590f
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
mov eax, r15d
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140046880
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rdi, r9
mov ebx, r8d
mov dword [rax - 0x3c], ebx
mov dword [rax - 0x40], edx
mov qword [rax - 0x38], r9
lea rdx, [rax - 0x40]
lea rcx, [0x140046640]
call qword [sym.imp.USER32.dll_EnumWindows]
test ebx, ebx
jne 0x140046a19
mov rax, qword [0x140104018]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov rbp, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rbp
sar r8, 5
lea esi, [rbx - 1]
test r8, r8
je 0x1400469f9
lea rdx, [rbp + 0x18]
nop word [rax + rax]
test dword [rdx + 4], 0x40000
je 0x140046921
test dword [rdx], 0xc00000
setne cl
bt dword [rdx], 0x13
setb al
test al, cl
jne 0x1400469c1
inc rbx
add rdx, 0x20
cmp rbx, r8
jb 0x140046900
test r8, r8
je 0x1400469f9
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.1400063d0
movups xmm0, xmmword [rbp + 8]
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp + 0x1c]
mov dword [rsp + 0x54], eax
movups xmmword [rsp + 0x40], xmm0
mov rbp, qword [rdi + 8]
mov rbx, qword [rdi]
cmp rbx, rbp
je 0x1400469a3
nop word [rax + rax]
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x140046997
mov eax, esi
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140046997
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
add rbx, 0x20
cmp rbx, rbp
jne 0x140046970
mov rbx, qword [rdi]
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
je 0x1400469e8
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400452a0
add qword [rdi + 8], 0x20
jmp 0x1400469f9
shl rbx, 5
add rbx, rbp
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400063d0
movups xmm0, xmmword [rbx + 8]
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x50], eax
mov eax, dword [rbx + 0x1c]
jmp 0x140046951
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rdi
call fcn.140044cb0
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x140046a19
lock xadd dword [rcx], esi
sub esi, 1
jg 0x140046a19
call fcn.1400bf5e4
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14004ad10
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1e0
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x140104018]
lea rdx, [rsp + 0x30]
mov qword [rbx], rcx
mov rcx, qword [0x140104018]
mov qword [rbx + 0x10], rcx
mov rcx, qword [0x140104018]
mov qword [rbx + 0x18], rcx
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
mov dword [rbx + 8], 0x19
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x1e0
pop rbx
ret
Function at 0x14004b420
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, r8
mov rbx, rdx
mov qword [r11 - 0x50], rdx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [r11 - 0x60], 0
mov rcx, qword [rdx]
call fcn.140051590
movsxd rsi, eax
test eax, eax
jns 0x14004b4b9
lea rcx, [rsp + 0x38]
call fcn.1400018c0
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14004b4af
mov eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14004b4af
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
mov eax, 1
jmp 0x14004b609
mov rcx, rsi
call fcn.1400bf5ec
mov rdi, rax
mov qword [rsp + 0x30], 0
lea r8, [0x1400cdcb0]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r9, qword [rsp + 0x30]
test r9, r9
je 0x14004b5c6
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x14004b5c6
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [0x1400d154c]
mov qword [rsp + 0x20], rax
mov r9d, 0x4c
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400495e0
mov rdx, rax
mov rcx, r14
call fcn.14004af20
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14004b584
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b57f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b57f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bf5e4
mov rcx, rdi
call fcn.1400bf5e4
nop
lea rcx, [rsp + 0x38]
call fcn.1400018c0
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14004b5c2
mov eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14004b5c2
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
xor eax, eax
jmp 0x14004b609
mov rcx, rdi
call fcn.1400bf5e4
nop
lea rcx, [rsp + 0x38]
call fcn.1400018c0
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14004b604
mov eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14004b604
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1400bf5e4
mov eax, 2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400bf680
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14004c690
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 0x28], r8
xor ebx, ebx
mov qword [rcx + 0x20], rdx
lea r8, [0x14004f720]
mov r9, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140050230
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x140105880], 0
lea rax, [0x14004fbf0]
mov qword [rsp + 0x28], rax
lea rbx, [0x1400d4d78]
lea rax, [0x1400d4d88]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
movzx ebp, cx
lea rax, [0x14004fff0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400d4d98]
mov qword [rsp + 0x40], rax
lea rax, [fcn.14004fb90]
mov qword [rsp + 0x48], rax
jne 0x140050409
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400503ff
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [0x1400d4da8]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140050326
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140050388
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [0x1400d4db0]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400503f7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140050388
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400503f7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop word [rax + rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1400503e6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x1400503a0
mov rax, qword [rsp + 0x28]
mov qword [0x140104098], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1401040a8], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.14004fb90], rax
jmp 0x1400503ef
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x140105880], 1
movzx eax, bp
lea rcx, str.xM_r_
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400bf680
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140050440
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r12, qword [rsp + 0x8c8]
mov rbx, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x401
mov qword [rsp + 0x30], rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x20], r9w
mov r15d, ebp
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x450]
mov r8d, 0x401
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x400
lea rcx, [rsp + 0x40]
mov r8, rbx
lea r13, [rsp + 0x40]
lea rsi, [rsp + 0x450]
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rcx, rbx
mov qword [r12], rbp
mov rdi, r12
mov byte [rsi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x140050603
cmp word [rax + 0x10], 2
jne 0x140050557
cmp word [rax + 0x12], 4
jne 0x140050557
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140050552
nop word [rax + rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.140050670
mov qword [rdi], rax
test rax, rax
je 0x1400505ce
add rbx, 8
lea rdi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x140050520
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rsi
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
cmp qword [r12], rbp
jne 0x1400505d5
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rsi + rax], bpl
jne 0x140050580
test rax, rax
je 0x14005061d
mov r8, rsi
mov rax, r13
sub r8, r13
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400505b3
inc rax
test ecx, ecx
jne 0x1400505a0
test edx, edx
je 0x14005061d
inc r15d
cmp r15d, 0x10
je 0x14005061d
mov rax, r13
mov r13, rsi
mov rsi, rax
jmp 0x1400504e1
mov ebp, 8
jmp 0x140050630
cmp dword [rsp + 0x8c0], ebp
je 0x140050630
mov rcx, rsi
call fcn.140050710
mov rcx, rax
mov rax, qword [r12]
mov qword [rax + 0x18], rcx
mov ecx, 8
mov rax, qword [r12]
cmp qword [rax + 0x18], rbp
cmove ebp, ecx
jmp 0x140050630
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x14005062b
sub ecx, 1
je 0x140050624
sub ecx, 1
jne 0x14005062b
mov ebp, 0x2afb
jmp 0x140050630
mov ebp, 0x2afa
jmp 0x140050630
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400bf680
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400517a0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x868
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x30], 0
movzx eax, word [0x1400cd920]
mov word [rsp + 0x50], ax
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x50]
lea r8, [0x1400cd920]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, qword [0x140104018]
mov qword [r14], rax
lea rax, [rsp + 0x50]
shr rax, 0x10
test ax, ax
jne 0x14005188a
lea rax, [rsp + 0x50]
movzx edx, ax
mov rcx, r14
call fcn.140001ff0
mov dword [rsp + 0x30], 1
lea r8, [0x1400d4f24]
lea rdx, [0x1400d5c14]
mov rcx, r14
call fcn.14004b8d0
mov rax, r14
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400bf680
add rsp, 0x868
pop r14
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
je 0x14005184c
mov edx, ebx
mov rcx, r14
call fcn.140001970
test eax, eax
je 0x14005184c
mov r9, rbx
add r9, r9
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
lea r8, [rsp + 0x50]
mov rcx, qword [r14]
call fcn.140018960
test eax, eax
je 0x14005184c
cmp eax, 0xc
je 0x1400518f9
cmp eax, 0x16
je 0x1400518e3
cmp eax, 0x22
je 0x1400518e3
cmp eax, 0x50
jne 0x1400518ee
jmp 0x14005184c
mov ecx, 0x80070057
call fcn.140001ac0
int3
mov ecx, 0x80004005
call fcn.140001ac0
int3
mov ecx, 0x8007000e
call fcn.140001ac0
int3
Function at 0x140052880
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov rax, qword [0x140104018]
mov qword [rcx], rax
lea rbx, [rcx + 0x20]
mov qword [rsp + 0x78], rbx
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov rcx, rbx
call fcn.14000d810
mov qword [rbx], rax
mov qword [rdi + 0x18], rsi
mov qword [rdi + 8], rsi
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x10], eax
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140052a00
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov r9d, edx
mov rdi, rcx
mov eax, r9d
xor edx, edx
div dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add r8d, edx
mov esi, edx
mov qword [rsp + 0x20], r8
sub r9d, edx
xor r8d, r8d
lea edx, [r8 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
add rsi, rax
mov rbp, rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x50], rsi
mov rbx, rax
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x140052a8b
cmp qword [rcx + 0x20], rsi
jae 0x140052a60
mov rcx, qword [rcx + 0x10]
jmp 0x140052a66
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140052a54
cmp rbx, rax
je 0x140052a8b
cmp rsi, qword [rbx + 0x20]
jb 0x140052a8b
mov qword [rbx + 0x28], rbp
mov rax, rsi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x68]
lea rdx, [0x1400d5c88]
lea rcx, [rdi + 0x20]
call fcn.1400524b0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
lea rcx, [rdi + 0x20]
lea r9, [rax + 0x20]
call fcn.140052500
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [rax + 0x28], rbp
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret