joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020b10
Capabilities:
Check for time delay via gettickcount
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x40000000
mov ebx, eax
mov dword [rdi + 0x90], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x180020bd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180020b82
cmp eax, 0xe7
jne 0x180020bda
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
ja 0x180020bef
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x40000000
mov dword [rdi + 0x90], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x180020b70
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, 0x5b4
jmp 0x180020bda

Function at 0x180020c00
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
lea edx, [rbp + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov r9d, 0xff
xor r8d, r8d
mov edx, 0x40000003
mov rcx, rbx
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rbp
mov dword [rsi + 0x90], 1
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsi + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x180020cc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x180020ca4
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x88], 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x180020ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x217
jne 0x180020cec
mov edi, ebp
jmp 0x180020ca4
cmp eax, 0x3e5
jne 0x180020c88
xor ecx, ecx
call fcn.180001000
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x68]
mov r9d, 0x3e8
mov qword [rsp + 0x40], rcx
lea ecx, [r8 + 2]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x180020d47
dec eax
je 0x180020ce8
cmp eax, 0x101
je 0x180020d3d
mov edi, 0x54f
jmp 0x180020c8c
mov edi, 0x5b4
jmp 0x180020c8c
mov edi, 0x4c7
jmp 0x180020c8c
Function at 0x1800239b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push r14
sub rsp, 0x478
mov rsi, rcx
xor r14d, r14d
mov rax, r8
mov qword [rsp + 0x40], r14
mov r10, rdx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov rcx, r10
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180023a0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x478
pop r14
pop rsi
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x4a8]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x260]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x28], r14
mov ebp, r14d
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x4a8], 0x200
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x180023bb1
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0x470], rdi
mov qword [rsp + 0x468], r12
mov qword [rsp + 0x460], r13
lea rcx, [0x18002e5c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x18002e5c0]
mov rcx, rsi
lea r8d, [rax + rax]
call fcn.180005da0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, dword [rsi]
mov r13d, eax
lea ecx, [rbx + 2]
movsxd rcx, ecx
add r13d, r13d
call fcn.1800251fc
mov r12d, r14d
mov rdi, rax
test rax, rax
je 0x180023ae2
mov r12d, ebx
mov word [rbx + rax], r14w
movsxd r8, dword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rax
call fcn.18002525c
mov r11d, dword [rsi]
mov rcx, rsi
lea edx, [r13 + r11]
call fcn.180005b40
test eax, eax
jne 0x180023b2c
mov rcx, qword [rsi + 8]
movsxd rbx, r12d
mov rdx, rdi
mov r8, rbx
call fcn.18002525c
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + rax]
movsxd r8, r13d
call fcn.18002525c
test rdi, rdi
je 0x180023b39
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x4a8]
inc ebp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x260]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x50], 0x200
mov dword [rsp + 0x4a8], 0x200
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x180023a90
mov r13, qword [rsp + 0x460]
mov r12, qword [rsp + 0x468]
mov rdi, qword [rsp + 0x470]
mov rbx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x498]
xor eax, eax
add rsp, 0x478
pop r14
pop rsi
ret
Function at 0x180024e40
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, rcx
mov ecx, 0x38
mov rbp, r9
mov r12, r8
mov rbx, rdx
call fcn.1800251fc
mov rdi, rax
test rax, rax
jne 0x180024e80
lea eax, [rdi + 8]
jmp 0x180024f19
lea rax, [rsp + 0x30]
lea r8, [0x180024fd0]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
jne 0x180024ec2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
jmp 0x180024f19
mov qword [rdi + 0x18], rsi
mov eax, dword [rsp + 0x30]
mov rcx, rsi
mov dword [rdi + 0x10], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x30], r12
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsi + 0x28]
mov rcx, rsi
mov qword [rdi], r11
mov rax, qword [r11 + 8]
mov qword [rdi + 8], rax
mov rax, qword [r11 + 8]
mov qword [rax], rdi
mov qword [r11 + 8], rdi
inc dword [r11 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180024ff8
Capabilities:
Create directory
Query environment variable
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rdi, rcx
lea rdx, [rbp - 0x70]
lea rcx, str._ALLUSERSPROFILE_
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, str.SxS
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp - 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str._bug.log
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rcx, [rbp - 0x70]
mov edx, 0x40000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002516c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x180025163
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x48]
movzx edx, word [rsp + 0x46]
movzx r11d, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4a]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._4.4d__2.2d__2.2d__2.2d:_2.2d:_2.2d:
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x7a8]
lea rdx, [rsp + 0x50]
lea r8d, [rax + rax]
mov rcx, rbx
mov dword [rbp + 0x7a8], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180025163
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x7b0]
lea r8d, [rax + rax]
mov rdx, rdi
mov rcx, rbx
mov dword [rbp + 0x7b0], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180025664
Capabilities:
Create thread
Get system information on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, qword [0x180037ca0]
xor esi, esi
mov r12, rcx
test rdi, rdi
jne 0x1800256e5
mov ecx, 0x118
call fcn.1800251fc
mov rdi, rax
test rax, rax
je 0x1800256db
lea rcx, [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [0x1800267c0]
mov qword [rdi], rsi
mov qword [rdi + 0xe0], rax
lea rax, [0x1800268a8]
mov qword [rdi + 0xd0], rsi
mov qword [rdi + 0xe8], rax
mov qword [0x180037ca0], rdi
jmp 0x1800256e5
mov rdi, rsi
mov qword [0x180037ca0], rsi
lea rcx, [rdi + 0xf0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x18003789c]
inc r11d
mov dword [0x18003789c], r11d
cmp r11d, 1
jg 0x18002580e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x50]
inc r11d
mov dword [rdi + 0xd8], r11d
cmp r11d, 4
jge 0x180025737
mov dword [rdi + 0xd8], 4
mov eax, dword [rdi + 0xd8]
mov ecx, SQLNumResultCols
cmp eax, ecx
lea edx, [rcx - 0xf]
cmovg eax, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rdi + 0xd8], eax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xd0], rax
test rax, rax
jne 0x180025775
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180025802
mov r9d, dword [rdi + 0xd8]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rdi], rax
test rax, rax
je 0x18002576a
mov ebp, esi
cmp dword [rdi + 0xd8], esi
jle 0x1800257ea
lea r13, [rdi + 0x50]
lea rax, [0x180026364]
lea r8, [0x180026574]
test ebp, ebp
cmove r8, rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13], rax
test rax, rax
je 0x18002576a
inc ebp
add r13, 8
cmp ebp, dword [rdi + 0xd8]
jl 0x1800257a1
mov ecx, 0x101
mov rdx, r12
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18002580e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov esi, eax
call fcn.1800261a8
jmp 0x180025821
mov eax, 0xfc00
mov dword [r12], 0xb2c0b2c
mov word [r12 + 4], ax
lea rcx, [rdi + 0xf0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18002813c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebp, 2
mov rsi, rdx
mov rdi, rcx
mov dword [rax - 0x18], 0x10
cmp word [rdx], bp
je 0x18002816c
lea eax, [rbp + 0x55]
jmp 0x1800281e4
lea rbx, [rcx + 0x4120]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rdi + 0x408c], 1
je 0x18002818c
mov edi, 0x139f
jmp 0x1800281ad
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rdi + 0x4078]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x1800281ba
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x1800281e4
mov rcx, qword [rdi + 0x4078]
lea rdx, [rdi + 0x409c]
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
mov rcx, rbx
mov dword [rdi + 0x408c], ebp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18002a360
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
movzx eax, word [rcx + 0x4094]
mov rbx, rcx
xor edi, edi
mov word [rcx + 0x1427c], ax
mov word [rcx + 0x14288], ax
mov eax, 0x7530
mov qword [rcx + 0x14270], rdi
mov dword [rcx + 0x14278], edi
mov dword [rcx + 0x1427e], edi
mov word [rcx + 0x14282], di
mov dword [rcx + 0x14284], edi
or ecx, 0xffffffff
mov dword [rbx + 0x14294], eax
mov dword [rbx + 0x14290], eax
mov dword [rbx + 0x14298], eax
mov dword [rbx + 0x1428c], ecx
mov dword [rbx + 0x182e0], ecx
mov dword [rbx + 0x182e4], ecx
mov eax, edi
lea rcx, [rbx + 0x142d8]
mov qword [rbx + 0x1429c], 1
mov qword [rbx + 0x142a4], 1
mov qword [rbx + 0x142ac], rdi
mov qword [rbx + 0x142b4], rdi
mov qword [rbx + 0x142bc], rdi
mov qword [rbx + 0x142c4], rdi
mov qword [rbx + 0x142cc], rdi
mov dword [rbx + 0x142d4], edi
mov byte [rbx + rax + 0x182e8], dil
inc rax
mov dword [rcx], edi
add rcx, 4
cmp rax, 0x1002
jl 0x18002a41d
cmp qword [0x180037ca8], rdi
movabs rbp, 0x20c49ba5e353f7cf
jne 0x18002a475
lea rcx, [0x180037ca8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x180037ca8]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x180037ca8], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xor edx, edx
div qword [0x180037ca8]
mov dword [rbx + 0x192ec], eax
cmp qword [0x180037ca8], rdi
jne 0x18002a4c9
lea rcx, [0x180037ca8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x180037ca8]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x180037ca8], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xor edx, edx
div qword [0x180037ca8]
mov dword [rbx + 0x192ec], eax
cmp qword [0x180037ca8], rdi
jne 0x18002a51d
lea rcx, [0x180037ca8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x180037ca8]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x180037ca8], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
xor edx, edx
div qword [0x180037ca8]
mov dword [rbx + 0x192ec], eax
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x18002a5b8
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
xor ecx, ecx
mov r13d, r9d
mov r12, r8
mov rsi, rdx
call fcn.180025410
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.180025d44
xor ebx, ebx
test eax, eax
jne 0x18002a78c
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x18002a625
mov qword [rdi + 0x4080], rax
mov rax, qword [rax + 0x40e0]
mov qword [rdi + 0x40e0], rax
jmp 0x18002a78a
xor r9d, r9d
mov ecx, r13d
mov dword [rsp + 0x28], 1
lea edx, [r9 + 2]
lea r8d, [r9 + 0x11]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov qword [rdi + 0x4078], rax
cmp rax, 0xffffffffffffffff
jne 0x18002a65d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18002a78c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x14]
mov r14d, 4
lea r8, [rbp - 0x1c]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r9d, r14d
mov edx, 0x9800000c
mov dword [rbp - 0x1c], ebx
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x18], ebx
mov dword [rbp - 0x20], 0x400000
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rdi + 0x4078]
mov r13d, 0xffff
lea r9, [rbp - 0x20]
mov r8d, 0x1001
mov edx, r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
lea r9, [rbp - 0x20]
mov r8d, 0x1002
mov edx, r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
lea r9, [rbp - 0x1c]
lea r8d, [r14 + 0xa]
xor edx, edx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
xor r9d, r9d
mov r8, rdi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x18002a756
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov ebx, eax
call fcn.180025410
mov edx, dword [rsi]
mov rcx, rax
call fcn.180026124
mov rcx, qword [rdi + 0x4078]
call qword [sym.imp.WS2_32.dll_closesocket]
or qword [rdi + 0x4078], 0xffffffffffffffff
mov eax, ebx
jmp 0x18002a78c
mov rcx, qword [rdi + 0x4078]
lea rdx, [rdi + 0x409c]
lea r8, [rbp - 0x10]
mov dword [rbp - SQLNumResultCols], 0x10
call qword [sym.imp.WS2_32.dll_getsockname]
mov qword [rdi + 0x40e0], r12
cmp eax, 0xffffffff
setne bl
inc ebx
mov dword [rdi + 0x408c], ebx
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x18002ab6c
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
xor edi, edi
mov r13, r9
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
test rdx, rdx
je 0x18002ac5b
test r8d, r8d
jle 0x18002ac5b
test r9, r9
je 0x18002ac5b
add rcx, 0x4120
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsi + 0x408c]
lea r8d, [rdi + 1]
cmp r11d, r8d
je 0x18002ac47
cmp r11d, 7
je 0x18002ac47
cmp r11d, 6
je 0x18002ac47
mov rax, qword [rsi + 0x4080]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x50], ebp
test rax, rax
je 0x18002abf4
mov rcx, qword [rax + 0x4078]
jmp 0x18002abfb
mov rcx, qword [rsi + 0x4078]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], SQLNumResultCols
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x18002ac36
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea rcx, [rsi + 0x4120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x18002ac60
lea rcx, [rsi + 0x4120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x139f
jmp 0x18002ac60
mov eax, 0x57
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18002aef8
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
cmp qword [rcx + 0x4080], 0
mov rbx, rcx
jne 0x18002afe9
and qword [rcx + 0x20], 0
and dword [rcx + 0x18], 0
and dword [rcx + 0x1c], 0
cmp word [rbx + 0x409c], 2
mov eax, SQLFreeHandle
lea rdi, [rcx + 0x4c]
mov qword [rcx + 0x30], rcx
lea ecx, [rax - 0xc]
lea rbp, [rbx + 0x28]
cmove eax, ecx
and dword [rbx + 0x38], 0
and dword [rbp], 0
mov dword [rdi], eax
lea rax, [rbx + 0x50]
lea r12, [rbx + 8]
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x50], 0x4000
lea r13, [rbx + 0x3c]
and qword [rsp + 0x40], 0
mov rcx, qword [rbx + 0x4078]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
lea r9, [rbx + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x18002afcb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x18002af6f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x18002afcb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18002afeb
movzx ebx, word [rbx + 0x4088]
xor ecx, ecx
call fcn.180025410
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call fcn.180025ef0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x4159c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415b4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword [0x005f7598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415a25
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415a34
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415a53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415a63
cmp rbx, 0x1000
jae 0x415a2b
jmp 0x415acd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415a75
xor edx, edx
jmp 0x415ac4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword [0x005f7598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415a59
jmp 0x415a48
call fcn.004635c0
xorps xmm15, xmm15
mov r14, qword [0x005f7598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004372e0
lea rax, [0x004e0d12]
mov ebx, 0x18
nop dword [rax]
call fcn.00437b60
mov rax, qword [rsp + 0x38]
call fcn.004378a0
lea rax, [0x004e10ab]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437b60
mov rax, qword [rsp + 0x30]
call fcn.004378a0
call fcn.00437520
call fcn.00437340
lea rax, [0x004e2fd7]
mov ebx, 0x21
call fcn.00435940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ff00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004159c0