joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e60
xor al, al
add rsp, 0x28
ret
Function at 0x140007510
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.140006000
mov ebx, eax
test eax, eax
jne 0x140007627
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140007601
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140007510
mov ebx, eax
test eax, eax
jne 0x140007627
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400075b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007616
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call int.140004520
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007637
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140018f80
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x140007660
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400076d4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400076ef
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400076ef
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400076ef
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
imul byte [rsi + rbx*2]
iretd
Function at 0x403cb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x0042e070], 0
je 0x403d68
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.00409830
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x0042a098]
call fcn.00409830
mov rcx, rsi
mov rdx, qword [0x0042a098]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.00409830
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x403d7b
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x407790
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.00407a50
mov esi, eax
test sil, sil
jne 0x407945
test ebx, ebx
je 0x407945
xor edi, edi
test r13d, r13d
jle 0x407871
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x407855
cmp ebx, 0xffffffff
je 0x407803
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x407803
xor esi, esi
jmp 0x407945
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x407855
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x407843
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x407843
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x407945
lea rcx, [rbp + 0x3c]
call fcn.00407660
sub r13d, 1
test r13d, r13d
jg 0x4077ea
nop
cmp ebx, 0xffffffff
je 0x407871
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x40786f
xor esi, esi
jmp 0x407945
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x4077ad
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x407871
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.004079c0
xor ecx, ecx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x0042e968]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x4078d4
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jae 0x4078d2
sub ebx, eax
jmp 0x4078d4
xor ebx, ebx
test sil, sil
je 0x407906
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x407903
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x4078d9
mov dil, 1
nop
jmp 0x407923
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x407906
mov dil, 1
test dil, dil
je 0x407894
nop
test sil, sil
je 0x407945
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x408dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x0042e070], 0
je 0x408e5a
cmp word [0x0042e380], 0xd7b2
jne 0x408df3
cmp dword [0x0042e388], 0
jbe 0x408df3
lea rcx, [0x0042e378]
call qword [0x0042e3a0]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x0042b454]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00408e90]
call fcn.0040a160
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x408e7b
cmp byte [0x0042a02a], 0
jne 0x408e7b
xor ecx, ecx
lea rdx, [0x0042b454]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40b9a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x00432eb8]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x00432ee0], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x00432eb0], al
cmp byte [0x00432eb0], 0
je 0x40ba3f
lea rcx, [0x0040ba44]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040ba5e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00432e98], rax
lea rcx, [0x0040ba44]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040ba7c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00432ea0], rax
lea rcx, [0x0040ba44]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040ba9a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00432ea8], rax
add rsp, 0x28
ret

Function at 0x40d060
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x40d080
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x40d0a4
cmp eax, 1
jae 0x40d0a9
cmp ecx, 5
jbe 0x40d0b5
mov dword [0x0042e9f8], 0x7f
jmp 0x40d0bf
mov dword [0x0042e9f8], 0x409
add rsp, 0x28
ret

Function at 0x40d370
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0040d360
mov ebx, eax
test ebx, ebx
je 0x40d3b9
cmp dword [0x0042bc18], 0xffffffff
jne 0x40d393
mov ecx, 0xe2
call fcn.00409050
mov ecx, ebx
call fcn.0040d340
test rax, rax
jne 0x40d3ab
mov ecx, 0xe2
call fcn.00409050
jmp 0x40d3b9
mov ecx, dword [0x0042bc18]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x40d400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x214]
test rax, rax
je 0x40d43f
cmp dword [0x0042bc18], 0xffffffff
je 0x40d43f
mov ecx, dword [0x0042bc18]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x40d43f
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x0042bc18]
xor edx, edx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret
Function at 0x40d480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00434188], 0
je 0x40d4bb
mov ecx, dword [0x0042bc18]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d4ce
call fcn.0040d370
mov ecx, dword [0x0042bc18]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d4ce
mov rax, qword [0x004341c8]
jmp 0x40d4ce
mov rax, qword gs:[0x58]
mov ecx, dword [0x0042bc18]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x40f3a0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbp
push rbx
sub rsp, 0x1f8
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rdx
nop
mov rcx, qword [rbp + 0x210]
call fcn.00409180
mov cx, 0x101
lea rdx, [rbp + 0x50]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x40f3f2
call sub.wsock32.dll_WSACleanup
jmp 0x40f4c5
mov rcx, qword [rbp + 0x218]
call fcn.0040a160
mov rcx, rax
call sub.wsock32.dll_gethostbyname
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0
jne 0x40f421
call sub.wsock32.dll_WSACleanup
jmp 0x40f4c5
xor eax, eax
mov rcx, qword [rbp + 0x1e8]
movsx rbx, word [rcx + 0x12]
sub ebx, 1
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], ebx
jg 0x40f487
sub ebx, eax
add ebx, 1
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x1e8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
movsxd rdx, dword [rbp + 0x4c]
movzx rdx, byte [rax + rdx]
call fcn.0040f100
lea rcx, [rbp + 0x28]
lea rdx, [0x0040f524]
call fcn.0040a820
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
call fcn.0040a820
add dword [rbp + 0x4c], 1
sub ebx, 1
test ebx, ebx
jne 0x40f43f
nop
mov dword [rbp + 0x38], 0
cmp qword [rbp + 0x40], 0
je 0x40f4a0
mov rax, qword [rbp + 0x40]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
lea rcx, [rbp + 0x40]
mov edx, dword [rbp + 0x38]
sub edx, 1
call fcn.0040a740
mov rcx, qword [rbp + 0x210]
mov rdx, qword [rbp + 0x40]
call fcn.00409690
call sub.wsock32.dll_WSACleanup
nop
lea rcx, [rbp + 0x28]
call fcn.00409180
lea rcx, [rbp + 0x40]
call fcn.00409180
mov rax, qword [rbp + 0x210]
lea rsp, [rbp + 0x1f8]
pop rbx
pop rbp
ret
Function at 0x40fd60
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov rcx, qword [rbp + 0x50]
call fcn.00409310
mov rcx, qword [rbp + 0x58]
call fcn.00409310
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x58]
call fcn.0040f530
mov byte [rbp + 0x2f], al
mov rcx, qword [rbp + 0x38]
call sub.wsock32.dll_closesocket
mov rcx, qword [rbp + 0x30]
call sub.kernel32.dll_CloseHandle
cmp byte [rbp + 0x2f], 0
jne 0x40fdbf
mov rcx, qword [rbp + 0x58]
call fcn.0040a4d0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.00409260
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x411b00
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push rbp
sub rsp, 0x2d0
mov rbp, rsp
mov qword [rbp + 0x2e0], rcx
mov cx, 0x101
lea rdx, [rbp + 0x138]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x411b3b
mov rcx, qword [rbp + 0x2e0]
lea rdx, [0x00411bbc]
call fcn.00409690
jmp 0x411b98
lea rcx, [rbp + 0x2c]
mov edx, pe_nt_image_headers64
call sub.wsock32.dll_gethostname
cmp eax, 0xffffffff
je 0x411b9d
lea rcx, [rbp + 0x2c]
call sub.wsock32.dll_gethostbyname
mov qword [rbp + 0x130], rax
cmp qword [rbp + 0x130], 0
je 0x411b9d
mov rax, qword [rbp + 0x130]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rbp + 0x12c], eax
mov ecx, dword [rbp + 0x12c]
call sub.wsock32.dll_inet_ntoa
mov rcx, qword [rbp + 0x2e0]
mov rdx, rax
call fcn.0040a540
call sub.wsock32.dll_WSACleanup
mov rax, qword [rbp + 0x2e0]
lea rsp, [rbp + 0x2d0]
pop rbp
ret

Function at 0x411cf0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x240
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x250], rcx
nop
mov ecx, 0x105
lea rdx, [rbp + 0x36]
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0x36]
call fcn.0040a570
mov rcx, rbp
lea rdx, [rbp + 0x28]
mov r8, qword [rbp + 0x20]
call fcn.00411cb0
mov rcx, qword [rbp + 0x250]
mov rdx, qword [rbp + 0x28]
call fcn.00409690
nop
lea rcx, [rbp + 0x20]
mov edx, 2
call fcn.00409260
mov rax, qword [rbp + 0x250]
lea rsp, [rbp + 0x240]
pop rbp
ret

Function at 0x411eb0
Capabilities:
Get socket status

Disassembly:
push rbp
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x260], rcx
mov dword [rbp + 0x268], edx
mov ecx, 0x3e8
mov eax, dword [rbp + 0x268]
cdq
idiv ecx
mov dword [rbp + 0x38], eax
mov ecx, 0x3e8
mov eax, dword [rbp + 0x268]
cdq
idiv ecx
imul edx, edx, 0x3e8
mov dword [rbp + 0x3c], edx
mov dword [rbp + 0x40], 0
cmp dword [rbp + 0x40], 0x40
jge 0x411f11
movsxd rax, dword [rbp + 0x40]
mov rcx, qword [rbp + 0x260]
mov qword [rbp + rax*8 + 0x48], rcx
add dword [rbp + 0x40], 1
xor ecx, ecx
lea rdx, [rbp + 0x40]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call sub.wsock32.dll_select
mov dword [rbp + 0x24c], eax
mov eax, dword [rbp + 0x24c]
lea rsp, [rbp + 0x250]
pop rbp
ret
Function at 0x411fd0
Capabilities:
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x520
mov rbp, rsp
mov rax, rcx
mov rsi, r9
lea rdi, [rbp + 0x137]
mov ecx, 0x7d
rep movsq qword [rdi], qword [rsi]
movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x540], rax
mov dword [rbp + 0x548], edx
mov qword [rbp + 0x550], r8
mov eax, dword [rbp + 0x560]
mov dword [rbp + 0x560], eax
mov dword [rbp + 0x110], 0x32
mov dword [rbp + 0x10c], 0
mov ecx, 2
mov edx, 2
mov r8d, 0x11
call sub.wsock32.dll_socket
mov dword [rbp + 0x11c], eax
movsxd rax, dword [rbp + 0x11c]
cmp rax, 0xffffffffffffffff
je 0x412171
lea rcx, [rbp + 0x124]
mov edx, 0x10
xor r8, r8
call fcn.00405c10
mov word [rbp + 0x124], 2
movzx rcx, word [rbp + 0x548]
call sub.wsock32.dll_htons
mov word [rbp + 0x126], ax
mov rcx, qword [rbp + 0x550]
call fcn.0040a160
mov rcx, rax
call sub.wsock32.dll_inet_addr
mov dword [rbp + 0x128], eax
mov dword [rbp + 0x120], 0x10
mov dword [rbp + 0x114], 1
movsxd rcx, dword [rbp + 0x11c]
lea rdx, [rbp + 0x137]
mov r8d, dword [rbp + 0x560]
xor r9, r9
lea rax, [rbp + 0x124]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0x120]
mov dword [rsp + 0x28], eax
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
jne 0x4120f8
movsxd rcx, dword [rbp + 0x11c]
call sub.wsock32.dll_closesocket
jmp 0x412171
movsxd rcx, dword [rbp + 0x11c]
mov edx, 0x1d4c0
call fcn.00411eb0
test eax, eax
jle 0x41214f
lea rcx, [rbp + 0x43]
mov edx, 0xc9
xor r8, r8
call fcn.00405c10
movsxd rcx, dword [rbp + 0x11c]
lea rdx, [rbp + 0x43]
mov r8d, 0xc9
xor r9, r9
lea rax, [rbp + 0x124]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x28], rax
call sub.wsock32.dll_recvfrom
mov rcx, qword [rbp + 0x540]
lea rdx, [rbp + 0x43]
mov r8d, 0xc9
call fcn.0040a5a0
movsxd rcx, dword [rbp + 0x11c]
call sub.wsock32.dll_closesocket
mov rax, qword [rbp + 0x540]
lea rsp, [rbp + 0x520]
pop rsi
pop rdi
pop rbp
ret
Function at 0x4123a0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x640
mov rbp, rsp
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x650], rcx
mov dword [rbp + 0x658], edx
mov qword [rbp + 0x660], r8
mov qword [rbp + 0x668], r9
mov rcx, qword [rbp + 0x660]
call fcn.00409310
mov rcx, qword [rbp + 0x668]
call fcn.00409310
nop
cmp qword [rbp + 0x660], 0
je 0x41265e
cmp qword [rbp + 0x668], 0
jne 0x412451
lea rcx, [rbp + 0x668]
lea rdx, [0x00412704]
call fcn.00409710
cmp byte [0x00434230], 0
je 0x41246f
lea rcx, [rbp + 0x4a0]
lea rdx, [0x00412718]
call fcn.00409710
jmp 0x4124cc
call fcn.00411de0
lea rcx, [rbp + 0x98]
mov edx, eax
call fcn.00411d90
call sub.kernel32.dll_GetTickCount
lea rcx, [rbp + 0x90]
mov r8d, 0xea60
xor edx, edx
div r8d
mov rdx, rax
call fcn.00411d90
lea rcx, [rbp + 0x4a0]
mov edx, 3
mov r8, qword [rbp + 0x98]
lea r9, [0x0041272c]
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
call fcn.0040aa20
lea rcx, [rbp + 0x88]
call fcn.00411a30
lea rcx, [0x00434210]
mov rdx, qword [rbp + 0x88]
call fcn.00409690
call fcn.00405370
mov ecx, 0xfd
call fcn.004053d0
add al, 1
mov byte [rbp + 0xaf], al
lea rcx, [rbp + 0x80]
call fcn.0040fe00
lea rcx, [rbp + 0x78]
call fcn.00411b00
lea rcx, [rbp + 0x668]
mov edx, 0xc
lea r8, [0x0041273c]
mov r9, qword [rbp + 0x80]
mov rax, qword [rbp + 0x668]
mov qword [rsp + 0x20], rax
lea rax, [0x0041274c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x0042be30]
mov qword [rsp + 0x30], rax
lea rax, [0x0041274c]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x4a0]
mov qword [rsp + 0x40], rax
lea rax, [0x0041274c]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [0x0041274c]
mov qword [rsp + 0x58], rax
mov rax, qword [0x00434210]
mov qword [rsp + 0x60], rax
lea rax, [0x0041274c]
mov qword [rsp + 0x68], rax
call fcn.0040aa20
mov dword [rbp + 0xa8], 0
cmp qword [rbp + 0x668], 0
je 0x4125d0
mov rax, qword [rbp + 0x668]
mov eax, dword [rax - 4]
mov dword [rbp + 0xa8], eax
mov eax, dword [rbp + 0xa8]
add eax, eax
mov dword [rbp + 0xb0], eax
lea rcx, [rbp + 0xb7]
mov rdx, qword [rbp + 0x668]
movzx r8, byte [rbp + 0xaf]
mov r9d, dword [rbp + 0xb0]
call fcn.00412220
mov cx, 0x101
lea rdx, [rbp + 0x4a8]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x41261b
call sub.wsock32.dll_WSACleanup
jmp 0x41265e
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x660]
xor r8, r8
call fcn.0040a350
mov rcx, qword [rbp + 0x650]
mov edx, dword [rbp + 0x658]
mov r8, qword [rbp + 0x70]
lea r9, [rbp + 0xb7]
mov eax, dword [rbp + 0xb0]
add eax, 4
mov dword [rsp + 0x20], eax
call fcn.00411fd0
call sub.wsock32.dll_WSACleanup
nop
lea rcx, [rbp + 0x70]
call fcn.004091d0
lea rcx, [rbp + 0x78]
mov edx, 5
call fcn.00409260
lea rcx, [rbp + 0x4a0]
call fcn.00409180
lea rcx, [rbp + 0x660]
mov edx, 2
call fcn.00409260
mov rax, qword [rbp + 0x650]
lea rsp, [rbp + 0x640]
pop rbp
ret
Function at 0x413450
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x230
mov rbp, rsp
mov qword [rbp + 0x240], rcx
lea rcx, [rbp + 0x26]
mov edx, 0x105
xor r8, r8
call fcn.00405c10
mov ecx, 0x104
lea rdx, [rbp + 0x26]
call sub.kernel32.dll_GetTempPathW
mov rcx, qword [rbp + 0x240]
lea rdx, [rbp + 0x26]
mov r8d, 0x105
xor r9, r9
call fcn.00409bc0
mov dword [rbp + 0x20], 0
mov rax, qword [rbp + 0x240]
cmp qword [rax], 0
je 0x4134be
mov rax, qword [rbp + 0x240]
mov rax, qword [rax]
mov eax, dword [rax - 4]
mov dword [rbp + 0x20], eax
mov rax, qword [rbp + 0x240]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x20]
cmp byte [rax + rcx - 1], 0x5c
je 0x4134e6
mov rcx, qword [rbp + 0x240]
lea rdx, [0x00413504]
call fcn.00409c60
mov rax, qword [rbp + 0x240]
lea rsp, [rbp + 0x230]
pop rbp
ret
Function at 0x4149d0
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
mov r11d, r8d
shr ecx, 0x10
mov r10, rdx
test rdx, rdx
jne 0x4149e6
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x414b23
nop
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jl 0x414add
mov r8d, edx
shr r8, 4
mov eax, r8d
neg eax
shl eax, 4
add edx, eax
nop dword [rax]
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r8, 1
jne 0x414a20
test edx, edx
je 0x414af4
movzx eax, byte [r10]
dec edx
add r9d, eax
inc r10
add ecx, r9d
test edx, edx
jg 0x414ae1
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r11d, r11d
jne 0x4149f0
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret