joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013ff60
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14013ffd3
lea rdx, str.OpenProcess_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400b29d0
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rsp + 0x38], rax
lea rdx, [0x1400bcb40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14014000a
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14013fffd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14014000a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret
Function at 0x1401465c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x12a8
call fcn.1401c7190
sub rsp, rax
lea r8, [rsp + 0x24]
mov edx, 0x1000
lea rcx, [rsp + 0x2a0]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x1401465f6
xor eax, eax
jmp 0x140146780
mov eax, dword [rsp + 0x24]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
jmp 0x14014661c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jae 0x14014677e
mov eax, dword [rsp + 0x20]
cmp dword [rsp + rax*4 + 0x2a0], 0
je 0x140146779
lea rax, [rsp + 0x90]
lea rcx, str._unknown_
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_sendto
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa4]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x20]
mov r8d, dword [rsp + rax*4 + 0x2a0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140146779
mov dword [rsp + 0x2c], 0x104
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14014676e
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.1400c0d00
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x1402307cc]
lea rcx, [rsp + 0x48]
call fcn.1400e3620
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140146764
mov rax, qword [rsp + 0x40]
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400ed3d0
mov rdx, qword [rsp + 0x12c0]
lea rcx, [rsp + 0x68]
call fcn.1400df3d0
test eax, eax
jne 0x140146759
mov eax, dword [rsp + 0x20]
mov eax, dword [rsp + rax*4 + 0x2a0]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.1400c4860
nop
lea rcx, [rsp + 0x48]
call fcn.1400c4860
mov eax, dword [rsp + 0x30]
jmp 0x140146780
lea rcx, [rsp + 0x68]
call fcn.1400c4860
nop
lea rcx, [rsp + 0x48]
call fcn.1400c4860
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140146612
xor eax, eax
add rsp, 0x12a8
pop rdi
pop rsi
ret
Function at 0x140148f30
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x34], 0
lea rdx, [0x140228997]
lea rcx, [rsp + 0x38]
call fcn.1400bebf0
nop
mov dword [rsp + 0x30], 0x32000
mov rcx, qword [rsp + 0x88]
call fcn.1400b82a0
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400cd070
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.1400b82a0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x78]
call fcn.1400b82a0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x48]
lea r8, [0x140233b68]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.1400d38a0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400beb90
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x38]
call fcn.1400c39e0
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400c39e0
nop
mov rcx, qword [rsp + 0x80]
call fcn.1400c39e0
nop
mov rcx, qword [rsp + 0x88]
call fcn.1400c39e0
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140149af0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1400bedb0
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x140149b9f
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401c721c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20]
inc eax
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400c57d0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1401c6e00
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.1400beb90
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.1400c39e0
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x14014b240
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, WSAGetLastError
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
call fcn.1400b82a0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14014b298
jmp 0x14014b2c7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x140230bb0]
mov rcx, qword [rsp + 0x28]
call fcn.1400becb0
mov qword [rsp + 0x30], rax
mov edx, 0x4ba
mov rcx, qword [rsp + 0x30]
call fcn.14014b1d0
xor eax, eax
add rsp, 0xb0
pop rdi
ret

Function at 0x14014b2e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
lea rdx, [0x14027ed80]
lea rcx, [rsp + 0x30]
call fcn.1400bebf0
lea rcx, [rsp + 0x30]
call fcn.1400b82a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.steam:__rungameid_899770
mov r8, rax
lea rdx, [0x14022ed38]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400c39e0
add rsp, 0x48
ret
Function at 0x14015bdb0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.1400bedb0
nop
mov rdx, qword [rsp + 0x2d8]
lea rcx, [rsp + 0x38]
call fcn.1400beb90
nop
lea rdx, [0x140231a04]
lea rcx, [rsp + 0x38]
call fcn.1400c7ac0
lea rcx, [rsp + 0x38]
call fcn.1400b82a0
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x14015be6c
mov eax, dword [rsp + 0x70]
and eax, 0x10
test eax, eax
je 0x14015be2a
jmp 0x14015be4d
lea rdx, [0x140231a0c]
lea rcx, [rsp + 0x20]
call fcn.1400c7a60
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x20]
call fcn.1400c7ac0
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14015be1d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1400beb90
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400f5550
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.1400c5710
nop
lea rcx, [rsp + 0x60]
call fcn.1400c39e0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400beb90
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x38]
call fcn.1400c39e0
nop
lea rcx, [rsp + 0x20]
call fcn.1400c39e0
mov rax, qword [rsp + 0x2d0]
add rsp, 0x2c8
ret
Function at 0x140160f40
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
cmp dword [rsp + 0xb0], 0
jle 0x140160f5a
jmp 0x140161103
mov eax, 0x488
mov eax, eax
mov ecx, dword [0x1404cf030]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1404cbe40], eax
jle 0x140160fb5
lea rcx, [0x1404cbe40]
call fcn.1401c7100
cmp dword [0x1404cbe40], 0xffffffff
jne 0x140160fb5
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov ecx, reloc.WLDAP32.dll_Ordinal_30
call fcn.140160c30
mov dword [0x1404cbe3c], eax
lea rcx, [0x1404cbe40]
call fcn.1401c7094
mov eax, 0x488
mov eax, eax
mov ecx, dword [0x1404cf030]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1404cbe50], eax
jle 0x14016100f
lea rcx, [0x1404cbe50]
call fcn.1401c7100
cmp dword [0x1404cbe50], 0xffffffff
jne 0x14016100f
xor ecx, ecx
call fcn.140163c80
sub rax, 0x3e8
mov qword [0x1404cbe48], rax
lea rcx, [0x1404cbe50]
call fcn.1401c7094
xor ecx, ecx
call fcn.140163c80
mov qword [rsp + 0x30], rax
mov rax, qword [0x1404cbe48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [0x14023a87c]
mov rcx, qword [rsp + 0x20]
call fcn.1400bebf0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400cac40
cmp eax, dword [0x1404cbe3c]
jl 0x140161103
call fcn.1401615b0
movzx eax, al
test eax, eax
je 0x1401610ae
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x14023a880]
mov rcx, qword [rsp + 0x48]
call fcn.1400becb0
mov qword [rsp + 0x50], rax
mov edx, 0x809
mov rcx, qword [rsp + 0x50]
call fcn.14014b1d0
jmp 0x1401610e0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rdx, str.err1
mov rcx, qword [rsp + 0x58]
call fcn.140071ff0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140108080
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140160c30
mov dword [0x1404cbe3c], eax
xor ecx, ecx
call fcn.140163c80
mov qword [0x1404cbe48], rax
add rsp, 0xa8
ret
Function at 0x140169fa0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x68]
call fcn.14006ec40
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x14016a051
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c62d0
movsx eax, byte [rax]
cmp eax, 0x61
jge 0x14016a007
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c62d0
movsx eax, byte [rax]
cmp eax, 0x41
jl 0x14016a042
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c62d0
movsx eax, byte [rax]
cmp eax, 0x7a
jle 0x14016a03b
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c62d0
movsx eax, byte [rax]
cmp eax, 0x5a
jg 0x14016a042
mov byte [rsp + 0x20], 1
jmp 0x14016a051
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x140169fc9
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14016a0d1
mov rcx, qword [rsp + 0x68]
call fcn.1400dc640
mov rcx, rax
call sub.WS2_32.dll_gethostbyname
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14016a0b9
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400722f0
mov eax, dword [rsp + 0x2c]
jmp 0x14016a0f5
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
call fcn.1400722f0
mov eax, dword [rsp + 0x30]
jmp 0x14016a0f5
mov rcx, qword [rsp + 0x68]
call fcn.1400dc640
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400722f0
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x14016b280
Capabilities:
Connect socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.14016b300
movzx eax, al
test eax, eax
jne 0x14016b2a6
jmp 0x14016b2eb
mov eax, 2
mov word [rsp + 0x20], ax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x22], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x14016b2e1
jmp 0x14016b2eb
mov al, 1
jmp 0x14016b2ed
xor al, al
add rsp, 0x38
ret

Function at 0x14016b360
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_recv
add rsp, 0x28
ret
Function at 0x14016b570
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_send
add rsp, 0x28
ret
Function at 0x1401740b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x14017413a
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.140186550
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1401740dc
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14017458d
call fcn.14018ab70
test al, al
jne 0x14017458d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140174527
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.140195610
test rax, rax
je 0x14017456c
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.140195610
mov rsi, rax
test rax, rax
je 0x14017456c
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401740b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140174500
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x14017413a
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.140186550
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1401740dc
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14017458d
call fcn.14018ab70
test al, al
jne 0x14017458d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140174527
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.140195610
test rax, rax
je 0x14017456c
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.140195610
mov rsi, rax
test rax, rax
je 0x14017456c
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401740b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140181500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa97], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1401815be
cmp qword [rcx + 0x260], 0
je 0x14018157e
mov qword [rsp + 0x40], rbx
call fcn.14016f220
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14016f580
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14016f580
mov rbx, qword [rsp + 0x40]
jmp 0x1401815be
cmp esi, 2
ja 0x1401815be
mov r9, qword [rdi + 0x1d0]
lea rax, [0x140243710]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401815e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x14026fad8]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xa97], 0
mov rdi, rcx
jne 0x140181623
cmp qword [rcx + 0x1e0], 0
je 0x140181711
mov r8, rdx
mov qword [rsp + 0x150], rsi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140188df0
mov rdx, qword [rdi + 0x1e0]
movsxd r9, eax
test rdx, rdx
je 0x140181689
cmp byte [rdi + 0x132f], 0
jne 0x140181689
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140181670
mov byte [rdi + 0x132f], 1
mov byte [rsp + r9 + 0x30], 0xa
inc r9d
movsxd rsi, r9d
cmp rsi, 0x102
jae 0x140181762
cmp byte [rdi + 0xa97], 0
mov byte [rsp + rsi + 0x30], 0
je 0x140181709
cmp qword [rdi + 0x260], 0
je 0x14018172a
mov rcx, rdi
mov qword [rsp + 0x158], rbx
call fcn.14016f220
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14016f580
mov rdx, qword [rdi + 0x1d8]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rsi
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14016f580
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401c74a0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x1d0]
lea rcx, [0x140243710]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x140181709
call fcn.1401c75c8
int3

Function at 0x140184180
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x140184470
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x140243be0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14018449a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x140243bf0]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140243c00]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test eax, eax
je 0x1401844fc
mov rcx, rbx
test r14, r14
je 0x1401844e6
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x140184534
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140184534
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1401845f8
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x140184560
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1401845ea
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401845ea
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140184590
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x1401845a4
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1401845c0
mov rcx, rdi
test r14, r14
je 0x1401845e1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1401845e7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1401c8df5]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140184610
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14026fad8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140184676
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140184659
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140184653
shr ax, 8
cmp al, 2
je 0x140184676
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401c74a0
add rsp, 0x1e8
ret
call fcn.1401b9b70
test eax, eax
jne 0x1401846ef
lea rcx, str.iphlpapi.dll
call fcn.140184470
mov qword [0x1404cefa8], rax
test rax, rax
je 0x1401846bc
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1404cefa0]
test rax, rax
cmovne rcx, rax
mov qword [0x1404cefa0], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1401b9710
test al, al
lea rcx, [0x1404cf658]
setne byte [0x1404cf650]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401c74a0
add rsp, 0x1e8
ret