joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9f60
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x4d9fb8
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.004b8d80
test eax, eax
jne 0x4da0b2
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rsi + 0x10]
movdqu xmm2, xmmword [rsi + 0x20]
movdqu xmm3, xmmword [rsi + 0x30]
movdqu xmm4, xmmword [rsi + 0x40]
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
movdqu xmm0, xmmword [rsi + 0x60]
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rsp + 0x78], xmm2
movdqu xmm2, xmmword [rbx]
movups xmmword [rsp + 0x88], xmm3
movdqu xmm3, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x98], xmm4
movdqu xmm4, xmmword [rbx + 0x20]
movups xmmword [rsp + 0xa8], xmm5
movdqu xmm5, xmmword [rbx + 0x30]
movups xmmword [rsp + 0xb8], xmm0
movdqu xmm0, xmmword [rbx + 0x40]
movups xmmword [rsp + 0xc8], xmm1
movdqu xmm1, xmmword [rbx + 0x50]
movups xmmword [rsp + 0xd8], xmm2
movdqu xmm2, xmmword [rbx + 0x60]
movups xmmword [rsp + 0xe8], xmm3
movdqu xmm3, xmmword [rbx + 0x70]
movups xmmword [rsp + 0xf8], xmm4
movups xmmword [rsp + 0x108], xmm5
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm1
movups xmmword [rsp + 0x138], xmm2
movups xmmword [rsp + 0x148], xmm3
cmp ebp, 1
je 0x4da0e0
test ebp, ebp
jne 0x4da0e8
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x4da0c8
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.004bb150
jmp 0x4da0b2
mov r8d, 0x2d
jmp 0x4da08c
mov eax, 0xfffff019
jmp 0x4da0b2
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x4dad38
mov rdx, qword [0x0072c6b0]
mov r9d, 4
mov r8d, 0x1c
call fcn.004d9be0
test eax, eax
jne 0x4dad20
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x4d9f60
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.004bb150
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x4dab80
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rbx, rcx
mov rdi, rdx
mov r13, r8
mov esi, r9d
cmp eax, 0x2000
je 0x4dac50
mov rdx, qword [0x0072c6b0]
mov r9d, 4
mov r8d, 0x1c
call fcn.004d9be0
mov r12d, eax
test eax, eax
jne 0x4dac70
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test r13, r13
je 0x4dac07
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, r13
call fcn.004b8d80
test eax, eax
jne 0x4dac50
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [rdi + 8]
movaps xmmword [rsp + 0x30], xmm0
test esi, esi
je 0x4dac68
mov r8d, 0xc
cmp esi, 1
jne 0x4dac50
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4dac90
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r12d, 0xfffff019
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0xd
jmp 0x4dac20
mov ecx, eax
call fcn.004bb150
mov r12d, eax
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.004bb150
mov r12d, eax
jmp 0x4dac41
Function at 0x4dacb0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x4d9fb8
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.004b8d80
test eax, eax
jne 0x4da0b2
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rsi + 0x10]
movdqu xmm2, xmmword [rsi + 0x20]
movdqu xmm3, xmmword [rsi + 0x30]
movdqu xmm4, xmmword [rsi + 0x40]
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
movdqu xmm0, xmmword [rsi + 0x60]
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rsp + 0x78], xmm2
movdqu xmm2, xmmword [rbx]
movups xmmword [rsp + 0x88], xmm3
movdqu xmm3, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x98], xmm4
movdqu xmm4, xmmword [rbx + 0x20]
movups xmmword [rsp + 0xa8], xmm5
movdqu xmm5, xmmword [rbx + 0x30]
movups xmmword [rsp + 0xb8], xmm0
movdqu xmm0, xmmword [rbx + 0x40]
movups xmmword [rsp + 0xc8], xmm1
movdqu xmm1, xmmword [rbx + 0x50]
movups xmmword [rsp + 0xd8], xmm2
movdqu xmm2, xmmword [rbx + 0x60]
movups xmmword [rsp + 0xe8], xmm3
movdqu xmm3, xmmword [rbx + 0x70]
movups xmmword [rsp + 0xf8], xmm4
movups xmmword [rsp + 0x108], xmm5
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm1
movups xmmword [rsp + 0x138], xmm2
movups xmmword [rsp + 0x148], xmm3
cmp ebp, 1
je 0x4da0e0
test ebp, ebp
jne 0x4da0e8
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x4da0c8
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.004bb150
jmp 0x4da0b2
mov r8d, 0x2d
jmp 0x4da08c
mov eax, 0xfffff019
jmp 0x4da0b2
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x4dad38
mov rdx, qword [0x0072c6b0]
mov r9d, 4
mov r8d, 0x1c
call fcn.004d9be0
test eax, eax
jne 0x4dad20
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x4d9f60
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.004bb150
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x4db630
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebp, dword [rsp + 0xd8]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x4db684
cmp ebp, 0x10
je 0x4db890
cmp ebp, 0x1c
jne 0x4db8b0
mov rdx, qword [0x0072c6b0]
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
call fcn.004d9be0
test eax, eax
jne 0x4db7fe
mov rdi, qword [rbx + 8]
mov dword [rsp + 0x30], ebp
lea r9, [rsp + 0x6c]
mov r8d, r13d
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x40], 0
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x78], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x4db760
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4db7f0
mov edx, r13d
mov rcx, r12
call fcn.004b9300
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x4db818
mov eax, dword [rbx + 0x58]
test al, 4
je 0x4db840
add dword [rdi + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x4db714
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x4db860
test r8d, r8d
jg 0x4db7b6
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ba
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rdi + 0x48]
add dword [rdi + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x4db8a0
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rdi + 0x48], rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4db752
mov ecx, eax
call fcn.004bb150
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edx, edx
jg 0x4db74c
mov r8d, 0x1c2
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4db74c
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x4db74c
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x4db74c
test dl, 4
jne 0x4db7b6
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x4db7b6
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x4db7b6
mov rdx, qword [0x0072c6a0]
jmp 0x4db66e
mov qword [rsi + 0x68], rsi
mov qword [rdi + 0x48], rsi
jmp 0x4db752
mov eax, 0xfffff019
jmp 0x4db752
Function at 0x4db8c0
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov edi, dword [rsp + 0x130]
mov rbx, rcx
mov r13, rdx
mov esi, r8d
mov r12, r9
test r8d, r8d
je 0x4db9c0
test r12, r12
je 0x4db904
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.004df140
test eax, eax
jne 0x4db989
cmp qword [rbx + 0x68], 0
jne 0x4db9f3
test byte [rbx + 0x59], 0x20
jne 0x4db940
cmp edi, 0x10
je 0x4db9e0
cmp edi, 0x1c
jne 0x4db9ec
mov rdx, qword [0x0072c6b0]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.004d9be0
test eax, eax
jne 0x4db9a6
lea rax, [rsp + 0x60]
mov r8d, esi
mov dword [rsp + 0x30], edi
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov rdx, r13
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov r8d, eax
mov eax, dword [rsp + 0x5c]
test r8d, r8d
jne 0x4db9a0
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.004bb150
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0x47b
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4db8ea
mov rdx, qword [0x0072c6a0]
jmp 0x4db92e
mov eax, 0xfffff019
jmp 0x4db989
mov eax, 0xfffff008
jmp 0x4db989

Function at 0x4dbd50
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x4dbea0
test rdx, rdx
je 0x4dbea0
lea rdi, [rsp + 0x40]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4dbe58
cmp eax, 0x104
ja 0x4dbea7
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x40], cx
lea edx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x4dbe78
xor edx, edx
mov r9d, 0xffffffff
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x4dbe58
mov rdx, qword [rbx]
mov ecx, edx
cmp edx, eax
jl 0x4dbeae
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, rdi
mov qword [rsp + 0x38], 0
cmova ecx, eax
mov qword [rsp + 0x20], rsi
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x4dbe58
sub eax, 1
cdqe
mov qword [rbx], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004bb150
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
je 0x4dbe90
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x4dbdb1
cmp word [rsp + 0x42], 0x3a
jne 0x4dbe7d
jmp 0x4dbdb1
mov eax, 0xfffff019
jmp 0x4dbe48
mov eax, 0xfffff01a
jmp 0x4dbe48
cdqe
mov qword [rbx], rax
mov eax, 0xfffff024
jmp 0x4dbe48

Function at 0x4dc050
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x4dc080
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x28]
add rsp, 0x68
ret

Function at 0x4dc0d0
Capabilities:
Enumerate processes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x158
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov ebx, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov r12, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4dc127
jmp 0x4dc150
mov rdx, rsi
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4dc150
cmp dword [rsp + 0x28], ebx
jne 0x4dc118
mov r13d, dword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
add rsp, 0x158
pop rbx
pop rsi
pop r12
pop r13
ret
mov r13d, 0xffffffff
jmp 0x4dc132
Function at 0x4dd5d0
Capabilities:
Get common file path
Get session user name

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x468
mov rbx, rcx
test rcx, rcx
je 0x4dd75a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4dd6e8
lea r12, [rsp + 0x34]
lea r13, [rsp + 0x250]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov r8, r12
mov rdx, r13
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x4dd670
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 0x7a
je 0x4dd750
mov ecx, r12d
call fcn.004bb150
add rsp, 0x468
pop rbx
pop r12
pop r13
pop r14
ret
lea r14, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4dd708
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, r13
call fcn.004dcf20
test eax, eax
jne 0x4dd65b
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, r14
call fcn.004dcf20
test eax, eax
jne 0x4dd730
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x4dd65b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004bb150
add rsp, 0x468
pop rbx
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x7a
je 0x4dd750
call fcn.004bb150
add rsp, 0x468
pop rbx
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.004b75f0
mov eax, dword [rsp + 0x2c]
jmp 0x4dd65b
mov eax, 0xfffff027
jmp 0x4dd65b
mov eax, 0xfffff019
jmp 0x4dd65b
Function at 0x4dd920
Capabilities:
Query environment variable

Disassembly:
push r12
mov eax, 0x10050
push rbp
push rdi
push rsi
push rbx
call fcn.00522bc0
sub rsp, rax
test rdx, rdx
mov rsi, rdx
mov rbx, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x4ddab0
test rcx, rcx
je 0x4ddab0
cmp qword [r8], 0
je 0x4ddab0
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.004dd4f0
mov r12d, eax
test eax, eax
je 0x4dd990
mov eax, r12d
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rbp, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
mov r8d, 0x7fff
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call fcn.004b75f0
cmp rdi, 0x7ffe
ja 0x4dda88
test rdi, rdi
jne 0x4dd9dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4dda76
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbp
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x4dda70
mov rdx, qword [rbx]
mov eax, eax
cmp rax, rdx
ja 0x4ddabb
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov r8, rbp
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call rdi
test eax, eax
je 0x4dda70
sub eax, 1
mov qword [rbx], rax
jmp 0x4dd976
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004bb150
mov r12d, eax
jmp 0x4dd976
mov r8d, 0x5c6
lea rdx, str.src_win_util.c
lea rcx, str.len___MAX_ENV_VAR_LENGTH
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4dd9dd
mov r12d, 0xfffff019
jmp 0x4dd976
mov qword [rbx], rax
mov r12d, 0xfffff024
jmp 0x4dd976
Function at 0x4ddcb0
Capabilities:
Get hostname

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov rbx, rcx
mov rbp, rdx
test rcx, rcx
je 0x4dde08
test rdx, rdx
je 0x4dde08
cmp qword [rdx], 0
je 0x4dde08
call fcn.004ba070
lea rsi, [rsp + 0x20]
mov edx, 0x100
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4dddd0
mov byte [rsp + 0x11f], 0
mov rdx, rsi
mov r8d, dword [rdx]
add rdx, 4
lea ecx, [r8 - 0x1010101]
not r8d
and ecx, r8d
and ecx, 0x80808080
je 0x4ddd08
mov r8d, ecx
shr r8d, 0x10
test ecx, 0x8080
cmove ecx, r8d
lea r8, [rdx + 2]
cmove rdx, r8
mov edi, ecx
add dil, cl
sbb rdx, 3
sub rdx, rsi
cmp qword [rbp], rdx
jbe 0x4dde18
lea r8, [rdx + 1]
cmp r8d, 8
jb 0x4ddda0
mov rcx, qword [rsp + 0x20]
lea rdi, [rbx + 8]
and rdi, 0xfffffffffffffff8
mov qword [rbx], rcx
mov ecx, r8d
mov r9, qword [rsi + rcx - 8]
mov qword [rbx + rcx - 8], r9
sub rbx, rdi
lea ecx, [r8 + rbx]
sub rsi, rbx
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
mov qword [rbp], rdx
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
ret
test r8b, 4
jne 0x4dddf0
test r8d, r8d
je 0x4ddd8a
movzx ecx, byte [rsi]
mov byte [rbx], cl
test r8b, 2
je 0x4ddd8a
mov r8d, r8d
movzx ecx, word [rsi + r8 - 2]
mov word [rbx + r8 - 2], cx
jmp 0x4ddd8a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.004bb150
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, dword [rsi]
mov r8d, r8d
mov dword [rbx], ecx
mov ecx, dword [rsi + r8 - 4]
mov dword [rbx + r8 - 4], ecx
jmp 0x4ddd8a
mov eax, 0xfffff019
jmp 0x4ddd8e
add rdx, 1
mov eax, 0xfffff024
mov qword [rbp], rdx
jmp 0x4ddd8e
Function at 0x4de4c0
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.ntdll.dll
call rsi
mov r12, rax
test rax, rax
je 0x4de691
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetVersion
mov rcx, rax
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, r12
mov qword [0x00a8b630], rax
call rbx
mov qword [0x00a8b608], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtDeviceIoControlFile
mov rcx, r12
call rbx
mov qword [0x00a8b648], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtQueryInformationFile
mov rcx, r12
call rbx
mov qword [0x00a8b620], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtSetInformationFile
mov rcx, r12
call rbx
mov qword [0x00a8b618], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, r12
call rbx
mov qword [0x00a8b628], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtQueryDirectoryFile
mov rcx, r12
call rbx
cmp qword [0x00a8b628], 0
mov qword [0x00a8b640], rax
je 0x4de67d
lea rdx, str.NtQuerySystemInformation
mov rcx, r12
call rbx
mov qword [0x00a8b5f0], rax
test rax, rax
je 0x4de67d
lea rdx, str.NtQueryInformationProcess
mov rcx, r12
call rbx
mov qword [0x00a8b610], rax
test rax, rax
je 0x4de67d
lea rcx, [0x0071e2a5]
call rsi
mov rcx, rax
test rax, rax
je 0x4de691
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x00a8b650], rax
call r12
mov rcx, rax
test rax, rax
je 0x4de631
lea rdx, str.PowerRegisterSuspendResumeNotification
call rbx
mov qword [0x00a8b638], rax
lea rcx, str.user32.dll
call r12
mov rcx, rax
test rax, rax
je 0x4de653
lea rdx, str.SetWinEventHook
call rbx
mov qword [0x00a8b600], rax
lea rcx, str.advapi32.dll
call rsi
mov rcx, rax
test rax, rax
je 0x4de691
lea rdx, str.SystemFunction036
call rbx
mov qword [0x00a8b5f8], rax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.004bb090
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.004bb090
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4de780
Capabilities:
Initialize winsock library

Disassembly:
push r12
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x00a8b660]
lea rcx, str.0.0.0.0
call fcn.004b8d30
test eax, eax
jne 0x6c7f30
xor edx, edx
lea r8, [0x00a8b670]
lea rcx, [0x0071e358]
call fcn.004b8d80
test eax, eax
jne 0x6c7f30
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x4de8e5
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4de972
mov rbx, qword [sym.imp.WS2_32.dll_socket]
xor r8d, r8d
mov edx, 1
mov ecx, 2
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4de8f0
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x4de994
test byte [rsp + 0x1e2], 2
jne 0x4de85e
mov dword [0x00a8b690], 1
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x4de9a8
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4de930
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x4de980
test byte [rsp + 0x1e2], 2
jne 0x4de8d7
mov dword [0x00a8b68c], 1
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x4de95e
add rsp, 0x468
pop rbx
pop r12
ret
mov r12, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call r12
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x4de870
sub eax, 0x273e
cmp eax, 1
jbe 0x4de870
call r12
lea rdx, [0x0071e37d]
mov ecx, eax
call fcn.004bb090
nop dword [rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x4de8e5
sub eax, 0x273e
cmp eax, 1
jbe 0x4de8e5
call rbx
lea rdx, [0x0071e37d]
mov ecx, eax
call fcn.004bb090
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.004bb090
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.004bb090
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.004bb090
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.004bb090
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.004bb090
nop dword [rax]
Function at 0x4e3d90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00a0a0e8]
test eax, eax
je 0x4e3db0
mov eax, dword [0x00a0a0e4]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x00a0a0e4]
test rcx, rcx
je 0x4e3dd5
call sub.msvcrt.dll_atoi
mov dword [0x00a0a0e4], eax
mov dword [0x00a0a0e8], 1
add rsp, 0x28
ret