joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007680
Capabilities:
Get graphical window text

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
mov r12, rcx
cmp edx, 1
je 0x100076a8
add rsp, 0x40
pop rbx
pop r12
pop r13
jmp qword [sym.imp.user32.dll_DefWindowProcW]
call qword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ecx, [rax + 1]
mov rbx, rcx
add rcx, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test rax, rax
je 0x1000771e
mov r8d, ebx
mov rdx, rax
mov rcx, r12
call qword [sym.imp.user32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x38], 0
mov rcx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sym.atl80.dll_AtlAxCreateControlLicEx
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_free]
xor eax, eax
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
mov eax, 1
jmp 0x10007714

Function at 0x10007770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov r13, rcx
mov r12, rdx
mov rbx, r8
mov rsi, r9
test byte [0x1000c050], 8
jne 0x10007840
mov r8d, 5
mov rdx, r12
mov rcx, r13
call qword [sym.imp.kernel32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x10007890
mov rdx, rax
mov rcx, r13
call qword [sym.imp.kernel32.dll_LoadResource]
mov r15, rax
test rax, rax
je 0x10007890
mov rcx, rax
call qword [sym.imp.kernel32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x10007898
mov rcx, rax
call sym.AX_ConvertDialogTemplate
mov r12, rax
test rax, rax
je 0x10007820
mov r8, rbx
mov rdx, r12
mov r9, rsi
mov rcx, r13
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.user32.dll_CreateDialogIndirectParamW]
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ucrtbase.dll_free]
mov r12, rbx
mov rcx, r14
call qword [sym.imp.kernel32.dll_FreeResource]
mov rax, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdx
call sym.wine_dbgstr_wn.constprop.0_1
mov qword [rsp + 0x38], rsi
mov ecx, 3
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rbx
lea r9, str.__p__s__p__p__Ix__n
lea r8, str.AtlAxCreateDialogW
mov qword [rsp + 0x40], rdx
lea rdx, [0x1000c050]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call sym.wine_dbg_log.constprop.0_2
jmp 0x10007797
xor r12d, r12d
jmp 0x10007829
mov rcx, r15
call qword [sym.imp.kernel32.dll_FreeResource]
jmp 0x10007829
Function at 0x100078b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [rsp + 0xa0]
mov rax, rdx
mov r14, rcx
mov r12, rdx
mov rbx, r8
shr rax, 0x10
mov rsi, r9
je 0x10007970
mov r8, rdx
mov r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov qword [rsp + 0x20], 0
call r15
movsxd rcx, eax
mov rdi, rcx
add rcx, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test rax, rax
je 0x10007985
mov r8, r12
mov r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call r15
mov qword [rsp + 0x20], rbp
mov rcx, r14
mov r9, rsi
mov r8, rbx
mov rdx, r13
call sym.atl80.dll_AtlAxCreateDialogW
mov rcx, r13
mov r12, rax
call qword [sym.imp.ucrtbase.dll_free]
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.atl80.dll_AtlAxCreateDialogW
xor r12d, r12d
jmp 0x1000795b

Function at 0x10007b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
test byte [0x1000c050], 8
jne 0x10007bc8
mov rdx, r13
mov r8d, 5
mov rcx, r12
call qword [sym.imp.kernel32.dll_FindResourceW]
mov rdx, rax
test rax, rax
je 0x10007bb0
mov rcx, r12
call qword [sym.imp.kernel32.dll_LoadResource]
mov rcx, rax
test rax, rax
je 0x10007bb0
call qword [sym.imp.kernel32.dll_LockResource]
mov rcx, rax
call sym.AX_ConvertDialogTemplate
mov r13, rax
test rax, rax
je 0x10007bb0
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.user32.dll_DialogBoxIndirectParamW]
mov rcx, r13
mov r12, rax
call qword [sym.imp.ucrtbase.dll_free]
mov rax, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, rdx
call sym.wine_dbgstr_wn.constprop.0_1
mov qword [rsp + 0x38], rsi
mov ecx, 3
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rbx
lea r9, str.instance__p__name__s__owner__p__proc__p__param__Ix_n
lea r8, str.AtlAxDialogBoxW
mov qword [rsp + 0x40], rdx
lea rdx, [0x1000c050]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call sym.wine_dbg_log.constprop.0_2
jmp 0x10007b33
Function at 0x10007c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [rsp + 0xa0]
mov rax, rdx
mov r14, rcx
mov r12, rdx
mov rbx, r8
shr rax, 0x10
mov rsi, r9
je 0x10007ce0
mov r8, rdx
mov r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov qword [rsp + 0x20], 0
call r15
movsxd rcx, eax
mov rdi, rcx
add rcx, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test rax, rax
je 0x10007cf5
mov r8, r12
mov r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call r15
mov qword [rsp + 0x20], rbp
mov rcx, r14
mov r9, rsi
mov r8, rbx
mov rdx, r13
call sym.atl80.dll_AtlAxDialogBoxW
mov rcx, r13
mov r12, rax
call qword [sym.imp.ucrtbase.dll_free]
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.atl80.dll_AtlAxDialogBoxW
xor r12d, r12d
jmp 0x10007ccb
Function at 0x10009430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r14, rcx
mov r12, r8
mov rcx, rdx
mov rbx, r9
mov r8d, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov r13, rax
test rax, rax
je 0x10009570
mov rdx, r12
mov r8, rbx
mov rcx, rax
call qword [sym.imp.kernel32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x10009520
mov rdx, rax
mov rcx, r13
call qword [sym.imp.kernel32.dll_LoadResource]
mov rdx, r12
mov rcx, r13
mov rbx, rax
call qword [sym.imp.kernel32.dll_SizeofResource]
mov r12d, eax
test rbx, rbx
je 0x100095a0
mov r8, rbx
mov rdi, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov r9d, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov edx, 2
mov esi, eax
lea ecx, [rsi + 1]
mov rbp, rcx
call qword [sym.imp.ucrtbase.dll_calloc]
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov r15, rax
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rsp + 0xa0]
xor eax, eax
mov rcx, r14
mov rdx, r15
mov word [r15 + rsi*2], ax
call sym.string_register
mov rcx, r15
mov r12d, eax
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x1000954a
test byte [0x1000c060], 4
jne 0x100095d0
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovg r12d, eax
mov rcx, r13
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test byte [0x1000c060], 4
jne 0x100095f8
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovg r12d, eax
jmp 0x10009553
test byte [0x1000c060], 4
je 0x1000952d
lea r9, str.could_not_load_resource_n
lea r8, str.resource_register
mov ecx, 2
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x1000952d
lea r9, str.Could_not_find_source_n
lea r8, str.resource_register
mov ecx, 2
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x1000952d
lea r9, str.Could_not_load_resource_file_n
lea r8, str.resource_register
mov ecx, 2
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x10009579
Function at 0x100099e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r12, rdx
mov r14, rcx
mov ebx, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x10009ad0
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, eax
mov rsi, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
xor r9d, r9d
mov r8d, esi
mov rcx, r13
mov qword [rsp + 0x20], 0
mov r15, rax
mov rdx, rax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x10009b00
test byte [0x1000c060], 4
jne 0x10009bc0
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
mov rbx, qword [sym.imp.ucrtbase.dll_free]
movzx eax, r12w
mov edx, r12d
or eax, 0x80070000
test r12d, r12d
cmovg edx, eax
mov r12d, edx
mov rcx, r15
call rbx
mov rcx, r13
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, r12d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test byte [0x1000c060], 4
jne 0x10009b88
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovg r12d, eax
jmp 0x10009ab6
mov r9d, esi
mov r8, r15
mov rbp, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
mov edx, 2
mov r12d, eax
lea ecx, [r12 + 1]
mov dword [rsp + 0x4c], ecx
call qword [sym.imp.ucrtbase.dll_calloc]
mov r8d, dword [rsp + 0x4c]
mov r9d, esi
xor edx, edx
mov rdi, rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], r8d
mov r8, r15
call rbp
xor eax, eax
mov r8d, ebx
mov rcx, r14
mov rdx, rdi
mov word [rdi + r12*2], ax
call sym.string_register
mov rbx, qword [sym.imp.ucrtbase.dll_free]
mov rcx, rdi
mov r12d, eax
call rbx
jmp 0x10009aa8
mov rcx, r12
mov edx, 0xffffffff
call sym.wine_dbgstr_wn
lea r9, str.Could_not_open_file__s_n
mov ecx, 2
lea r8, str.file_register
mov qword [rsp + 0x20], rax
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x10009add
mov rcx, r12
mov edx, 0xffffffff
call sym.wine_dbgstr_wn
lea r9, str.Failed_to_read_file__s_n
mov ecx, 2
lea r8, str.file_register
mov qword [rsp + 0x20], rax
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x10009a7f

Function at 0x10009c00
Capabilities:
Get file size
Read file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov r12, rcx
mov r13, rdx
test byte [0x1000c060], 1
jne 0x10009c30
xor r8d, r8d
mov rdx, r13
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp sym.file_register
mov rcx, r13
mov edx, 0xffffffff
call sym.wine_dbgstr_wn
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea r9, str.__p_____s__n
mov qword [rsp + 0x28], rax
lea r8, str.Registrar_FileUnregister
lea rdx, [0x1000c060]
call sym.wine_dbg_log.constprop.0_3
jmp 0x10009c17
Function at 0x10009c70
Capabilities:
Get file size
Read file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov r12, rcx
mov r13, rdx
test byte [0x1000c060], 8
jne 0x10009ca0
mov r8d, 1
mov rdx, r13
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp sym.file_register
mov rcx, r13
mov edx, 0xffffffff
call sym.wine_dbgstr_wn
mov qword [rsp + 0x20], r12
lea r9, str.__p_____s__n
lea r8, str.Registrar_FileRegister
mov qword [rsp + 0x28], rax
lea rdx, [0x1000c060]
mov ecx, 3
call sym.wine_dbg_log.constprop.0_3
jmp 0x10009c87

Function at 0x1000a890
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x1000a8e3
cmp byte [r12 + rbx - 1], 0xa
je 0x1000a8be
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x1001e124], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x1000afc0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x100
mov ebx, ecx
mov rcx, rdx
mov rsi, rdx
mov rdi, r8
call sym.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, ebx
jae 0x1000b198
mov ecx, dword [0x1001e124]
xor eax, eax
mov rdx, qword gs:[0x30]
cmp dword [rdx + 0x48], ecx
je 0x1000b0a4
test byte [0x1000c080], 8
jne 0x1000b140
lea r12, [rsp + 0x30]
mov rbp, r12
test byte [0x1000c090], 8
jne 0x1000b100
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
lea rdx, str._04x:
mov rcx, rbp
call sym.sprintf
test rdi, rdi
je 0x1000b04b
cmp ebx, 3
jbe 0x1000b0b8
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, r12
mov r9, rax
mov ecx, dword [r8]
add r8, 4
lea edx, [rcx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x1000b05c
mov eax, edx
mov rcx, r12
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [r8 + 2]
cmove r8, rax
mov eax, edx
add al, dl
mov edx, 1
sbb r8, 3
sub r8, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cdqe
add rsi, 1
mov qword [rsp + 0x28], rdi
lea r8, str._s:_s:_s
lea rcx, [rbp + rax]
mov rax, r12
mov qword [rsp + 0x20], rsi
sub rax, rcx
lea rdx, [rax + 0xc8]
lea rax, str.fixme
mov r9, qword [rax + rbx*8]
call sym.snprintf.constprop.0
jmp 0x1000b04b
lea rcx, [0x1000c090]
call sym.__wine_dbg_get_channel_flags
test al, 8
je 0x1000b025
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x40]
mov rcx, rbp
lea rdx, str._04x:
call sym.sprintf
cdqe
add rbp, rax
jmp 0x1000b025
lea rcx, [0x1000c080]
call sym.__wine_dbg_get_channel_flags
test al, 8
je 0x1000b010
call qword [sym.imp.kernel32.dll_GetTickCount]
lea r12, [rsp + 0x30]
lea rdx, str._3u._03u:
mov r8d, eax
mov rcx, r12
mov r9, r8
imul r8, r8, 0x10624dd3
shr r8, 0x26
imul eax, r8d, 0x3e8
sub r9d, eax
call sym.sprintf
movsxd rbp, eax
add rbp, r12
jmp 0x1000b018
mov eax, 0xffffffff
jmp 0x1000b0a4

Function at 0x1000b210
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x230
mov rax, qword [0x1001e160]
mov r12, rcx
mov rbx, rdx
test rax, rax
je 0x1000b2a0
mov rcx, rbx
call rax
mov dword [rbx + 0xc], eax
test eax, eax
js 0x1000b28c
lea rsi, [rsp + 0x20]
mov r8d, 0x104
mov rcx, r12
mov rdx, rsi
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov rcx, qword [rbx]
mov r8, rsi
lea rdx, str.MODULE
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r8d, 0x104
mov rdx, rsi
lea rcx, str.SystemRoot
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
mov r8, rsi
lea rdx, str.SystemRoot
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rax, qword [rbx]
add rsp, 0x230
pop rbx
pop rsi
pop r12
ret
lea rcx, str.atl100.dll
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1000b2d2
lea rdx, str.AtlCreateRegistrar
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x1001e160], rax
test rax, rax
jne 0x1000b22d
mov dword [rbx + 0xc], 0x80004002
xor eax, eax
jmp 0x1000b28f
Function at 0x1000b2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r10, rdx
mov r12, rcx
mov rdx, r8
mov rbx, r9
mov r8, r10
call qword [sym.imp.kernel32.dll_FindResourceW]
mov rcx, r12
mov r13, rax
mov rdx, rax
call qword [sym.imp.kernel32.dll_LoadResource]
mov rdx, r13
mov rcx, r12
mov rsi, rax
call qword [sym.imp.kernel32.dll_SizeofResource]
mov r13d, eax
test rsi, rsi
je 0x1000b428
cmp qword [rbx], 0
je 0x1000b410
mov r9d, r13d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov rbp, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov qword [rsp + 0x20], 0
call rbp
xor edx, edx
mov edi, eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
lea r8d, [rdi + 1]
mov r14, r8
add r8, r8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x1000b439
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r14d
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8, rsi
call rbp
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
xor eax, eax
mov word [r12 + rdi*2], ax
test edx, edx
mov rax, qword [rcx]
mov rdx, r12
jne 0x1000b400
call qword [rax + 0x50]
mov dword [rbx + 0xc], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, r12
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [rbx + 0xc]
not eax
shr eax, 0x1f
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [rax + 0x48]
mov dword [rbx + 0xc], eax
jmp 0x1000b3c5
mov rdx, rbx
mov rcx, r12
call sym.create_registrar
test rax, rax
jne 0x1000b337
nop dword [rax]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rbx + 0xc], 0x8007000e
xor eax, eax
jmp 0x1000b42a
Function at 0x140e4e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e4e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e4e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e4e06f
add dl, dl
jne 0x140e4e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e4e0f6
xor eax, eax
add dl, dl
jne 0x140e4e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e4e1ad
add dl, dl
jne 0x140e4e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e4e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e4e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e4e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e4e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e4e07e
mov eax, 1
add dl, dl
jne 0x140e4e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e4e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e4e0fb
sub eax, ebx
mov ebx, 1
jne 0x140e4e14c
mov ecx, 1
add dl, dl
jne 0x140e4e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e4e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e4e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e4e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e4e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e4e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e4e15d
cmp eax, 0x7d00
jae 0x140e4e19b
cmp eax, 0x500
jb 0x140e4e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e4e07e
cmp eax, 0x7f
ja 0x140e4e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e4e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e4e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e4e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400746b3
Capabilities:
Write file on windows

Disassembly:
jmp 0x14008c8a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1401d10f2]
call fcn.140078d5d
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14008c8f7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14008ca03
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14008c99c
cmp qword [rbp + 0x28], 0
jle 0x14008c99c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14008c93c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140078849
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14008c9f2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14008c9f2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400747c1
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x140106970
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401d14ae]
call fcn.140078d5d
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140074d07
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400aac90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1401d1292]
call fcn.140078d5d
mov qword [rbp + 8], 0
jmp 0x1400aacce
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1400aad24
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1400aacc3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1400756d5
Capabilities:
Get socket status

Disassembly:
jmp 0x140106e40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1401d14ae]
call fcn.140078d5d
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax]
mov rax, qword [rax]
inc rax
mov rcx, qword [rbp + 0xe0]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0xe0]
mov r9, qword [rcx + 0x18]
mov rcx, qword [rbp + 0xe0]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rcx + 8]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret