joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800215a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0xa8]
add eax, 0xe67
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
xor eax, 0x3869
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa8]
xor eax, 0x36cd
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x3ff
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1d1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
add eax, 0xd5c
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x192e
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x19b1
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
xor eax, 0x5c1
cmp dword [rsp + 0x2c], eax
jg 0x1800217f2
mov eax, dword [rsp + 0x20]
xor eax, 0x15b2
cmp dword [rsp + 0x34], eax
jle 0x1800216c1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0x88]
xor eax, 0x1663b7
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
imul ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x20]
add eax, 0x229b
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
mov dword [rax + 0x64], ecx
jmp 0x1800217f2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
imul eax, dword [rcx + 0x48]
add eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jb 0x1800217f2
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800216fb
mov eax, dword [rsp + 0x24]
add eax, 4
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x2c]
add eax, 0x32d3
cmp dword [rsp + 0x24], eax
jae 0x1800217f2
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0xb8]
mov dword [rsp + 0x28], eax
jmp 0x18002173e
mov eax, dword [rsp + 0x28]
add eax, 4
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x90]
sub eax, 0x28d2
cmp dword [rsp + 0x28], eax
jae 0x1800217ed
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x50], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0x18]
mov eax, dword [rcx + rax + 0xb8]
xor eax, edx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [rsp + 0x2c]
xor eax, 0x1c5f
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x88]
add eax, dword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xb4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xb4], eax
jmp 0x180021733
jmp 0x1800216f0
mov eax, dword [rsp + 0x30]
sub eax, 0xa28
add rsp, 0x68
ret
Function at 0x1400290fc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c6f4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c6f4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002924c
cmp rax, 0xffffffffffffffff
je 0x14002924c
xor edi, edi
test rbp, rbp
jle 0x1400291f7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f008
mov rbx, rax
test rax, rax
jne 0x140029184
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400291ed
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a028
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d3d0
cmp eax, 0xffffffff
je 0x1400291cd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029194
mov edx, r15d
mov ecx, r14d
call fcn.14001a028
jmp 0x1400291ed
cmp byte [rsi + 0x38], dil
je 0x1400291e4
cmp dword [rsi + 0x34], 5
jne 0x1400291e4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400291ed
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001adbc
jmp 0x140029260
jns 0x140029260
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c6f4
cmp rax, 0xffffffffffffffff
jne 0x140029218
cmp byte [rsi + 0x30], dil
je 0x140029260
mov edi, dword [rsi + 0x2c]
jmp 0x140029260
mov ecx, r14d
call fcn.1400184e0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x140029260
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029260
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029259
mov eax, dword [rsi + 0x2c]
jmp 0x14002925e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c6f4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14096b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14096b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14096b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14096b06f
add dl, dl
jne 0x14096b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14096b0f6
xor eax, eax
add dl, dl
jne 0x14096b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14096b1ad
add dl, dl
jne 0x14096b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14096b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14096b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14096b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14096b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14096b07e
mov eax, 1
add dl, dl
jne 0x14096b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14096b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14096b0fb
sub eax, ebx
mov ebx, 1
jne 0x14096b14c
mov ecx, 1
add dl, dl
jne 0x14096b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14096b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14096b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14096b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14096b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14096b15d
cmp eax, 0x7d00
jae 0x14096b19b
cmp eax, 0x500
jb 0x14096b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096b07e
cmp eax, 0x7f
ja 0x14096b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14096b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14096b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x403a44
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, qword [rcx + 0xa8]
mov r12, rcx
mov r8, rdx
test rbx, rbx
je 0x403a76
lea edx, [rax + 1]
cmp dword [r12 + 0xb0], eax
je 0x403a87
mov rbx, qword [rbx + 0x28]
mov eax, edx
jmp 0x403a5c
mov rax, qword [r12]
xor edx, edx
mov rcx, r12
call qword [rax + 0x28]
jmp 0x403baa
cmp qword [r12 + 0x78], 0xffffffffffffffff
mov dword [r12 + 0xb0], edx
je 0x403ac9
mov rcx, qword [r12 + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [r12 + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r12 + 0x78], 0xffffffffffffffff
mov ecx, dword [rbx + 4]
mov edx, dword [rbx + 8]
mov r8d, dword [rbx + 0xc]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [r12 + 0x78], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x403b00
lea r13, [rsp + 0x28]
lea rdx, str.socket_error
mov rcx, r13
call fcn.004cec4e
jmp 0x403b96
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov dword [rsp + 0x24], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [r12 + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [r12 + 0x78]
mov r8d, 0x8001
mov r9d, 0x10
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r12 + 0x78]
mov r8d, dword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x403baa
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
cmp eax, 0x2733
jne 0x403b85
mov rdx, qword [r12 + 0x98]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x2710
call sym.winbox.exe_addTimer_unsigned_int__EventListener__void__bool_
mov dword [r12 + 0xa0], eax
jmp 0x403baa
call rbx
lea r13, [rsp + 0x28]
mov edx, eax
mov rcx, r13
call fcn.00402cbd
mov rcx, r12
mov rdx, r13
call fcn.00403a44
mov rcx, r13
call fcn.004cea4a
nop
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
Function at 0x403cb8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov rdx, qword [rcx + 0x50]
mov rsi, rdx
mov edx, 0x1000
sub rsi, qword [rcx + 0x48]
lea r15, [rcx + 0x48]
lea r13, [rsp + 0x28]
mov r12, rcx
mov byte [rsp + 0x28], 0
mov r8, r13
mov rcx, r15
call fcn.004cfac2
mov rdx, qword [r12 + 0x48]
mov eax, esi
xor r9d, r9d
mov r8, qword [r12 + 0x50]
mov rcx, qword [r12 + 0x78]
sub r8, rdx
add rdx, rax
sub r8d, esi
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x403d6d
mov r8, r13
mov edx, esi
mov rcx, r15
mov byte [rsp + 0x28], 0
call fcn.004cfac2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r14d, eax
cmp eax, 0x2733
je 0x403db8
cmp eax, 0x2738
je 0x403d9c
mov rcx, qword [0x0053cb90]
lea rdx, str.error_while_reading_err
call fcn.004d0ff9
mov edx, r14d
mov rcx, rax
call fcn.004d10e2
mov rcx, rax
call fcn.004d13bf
jmp 0x403db8
test eax, eax
jne 0x403d9c
mov rax, qword [r12]
mov rcx, r13
lea rdx, str.peer_closed_connection
mov rbx, qword [rax + 0x28]
call fcn.004cec4e
mov rcx, r12
mov r8, r13
xor edx, edx
call rbx
mov rcx, r13
call fcn.004cea4a
jmp 0x403db8
mov rcx, r15
lea edx, [rbx + rsi]
mov r8, r13
mov byte [rsp + 0x28], 0
call fcn.004cfac2
mov rcx, r12
call fcn.00403596
nop
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x403dc8
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbx
add rsp, 0xffffffffffffff80
mov r13, qword [sym.imp.WS2_32.dll_send]
mov r12, rcx
lea rbx, [rcx + 0x58]
mov rdx, qword [r12 + 0x58]
mov r8d, dword [r12 + 0x60]
xor r9d, r9d
mov rcx, qword [r12 + 0x78]
sub r8d, edx
call r13
cmp eax, 0xffffffff
jne 0x403e73
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
cmp eax, 0x2733
je 0x403eef
call rbx
lea r8, str.send_error__d
lea rcx, [rsp + 0x30]
mov edx, 0x50
mov r9d, eax
call fcn.0052fc10
mov rcx, qword [0x0053cb90]
lea rdx, str.ERROR:_while_sending_err
call fcn.004d0ff9
mov r13, rax
call rbx
mov rcx, r13
lea r13, [rsp + 0x28]
mov edx, eax
call fcn.004d10e2
mov rcx, rax
call fcn.004d13bf
mov rax, qword [r12]
lea rdx, str.peer_closed_connection
mov rcx, r13
mov rbx, qword [rax + 0x28]
call fcn.004cec4e
jmp 0x403eb6
mov rdx, qword [r12 + 0x58]
cdqe
mov rcx, rbx
lea r8, [rdx + rax]
call fcn.004cf86c
mov rax, qword [r12 + 0x60]
cmp qword [r12 + 0x58], rax
jne 0x403ddf
cmp byte [r12 + 0x81], 0
je 0x403eca
mov rax, qword [r12]
lea r13, [rsp + 0x30]
mov rcx, r13
mov rbx, qword [rax + 0x28]
call fcn.004cebac
mov rcx, r12
mov r8, r13
xor edx, edx
call rbx
mov rcx, r13
call fcn.004cea4a
jmp 0x403eef
mov rcx, qword [r12 + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [r12 + 0x78]
mov r9d, 0x21
mov r8d, 0x8001
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
Function at 0x404114
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x70], 0xffffffffffffffff
mov rbx, rcx
je 0x404151
mov rcx, qword [rcx + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x70], 0xffffffffffffffff
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov edx, 0xffff
lea r9, [rsp + 0x3c]
mov qword [rbx + 0xb8], 0
mov qword [rbx + 0x70], rax
mov rcx, rax
mov r8d, 0x20
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rdx, str.could_not_make_socket_broadcast
test eax, eax
jne 0x4041e0
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], 2
call qword [sym.imp.WS2_32.dll_bind]
inc eax
jne 0x4041f6
lea rdx, str.could_not_bind_socket
mov rcx, qword [0x0053cb90]
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
jmp 0x404219
mov rcx, qword [rbx + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [rbx + 0x70]
mov r9d, 1
mov r8d, 0x8001
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
nop
add rsp, 0x50
pop rbx
ret

Function at 0x404220
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x40
or eax, 0xffffffff
cmp byte [rcx + 0xb0], 0
mov qword [rsp + 0x30], 0
mov rbx, rcx
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], 2
jne 0x40425e
mov eax, dword [rcx + 0xb4]
imul rax, rax, 0xc
add rax, qword [rcx + 0x78]
mov eax, dword [rax + 8]
mov dword [rsp + 0x60], r8d
mov ecx, 0x5051
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov r8d, eax
mov al, 1
test r8d, r8d
jg 0x4042cc
mov rcx, qword [0x0053cb90]
lea rdx, str.sendto_failed
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x404efe
Capabilities:
Get local ipv4 addresses

Disassembly:
push r13
mov eax, 0x8068
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004d43f0
sub rsp, rax
xor r8d, r8d
mov edx, 0x10
lea rax, [rsp + 0x40]
lea rbx, [rsp + 0x60]
mov rsi, rcx
mov ecx, 2
mov qword [rsp + 0x20], rax
mov r9, rbx
mov dword [rsp + 0x40], 0x8000
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x405083
mov rbp, qword [0x0053cb90]
mov ax, word [rbx + 0x54]
mov edx, dword [rbx + 0x50]
lea rcx, [rsp + 0x4a]
mov dword [rsp + 0x4a], edx
mov word [rsp + 0x4e], ax
call fcn.004d2466
test al, al
jne 0x405076
cmp qword [rbx + 0xb0], 0
je 0x405076
mov edx, dword [rbx + 4]
mov rcx, qword [0x0053cb90]
call fcn.004d1044
lea rdx, [0x00532292]
mov rcx, rax
call fcn.004d0ff9
mov rdx, qword [rbx + 0x10]
mov rcx, rax
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
mov rax, qword [rbx + 0xb0]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 4]
mov dword [rsp + 0x44], edx
mov edx, dword [rax + 0x20]
xor eax, eax
cmp eax, edx
je 0x404fdc
shr ecx, 1
inc eax
or ecx, 0x80000000
jmp 0x404fcc
call qword [sym.imp.WS2_32.dll_htonl]
lea r12, [rsp + 0x50]
lea rdx, [0x00532295]
mov rcx, rbp
not eax
or dword [rsp + 0x44], eax
call fcn.004d0ff9
lea rdx, [rsp + 0x44]
mov rcx, r12
mov r13, rax
call fcn.004d24c6
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax]
lea rdx, [rax + 4]
mov eax, 0xffffffff
shl rax, 0x20
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x30]
and rdi, rax
or rdi, rcx
mov rcx, r13
mov qword [rsp + 0x38], rdi
call fcn.004d1018
mov rcx, r12
mov r13, rax
call fcn.004cea4a
mov rcx, r13
call fcn.004d13bf
mov eax, dword [rsp + 0x4a]
lea rcx, [rsi + 0x78]
mov rdx, r12
mov dword [rsp + 0x50], eax
mov ax, word [rsp + 0x4e]
mov word [rsp + 0x54], ax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
call fcn.00519460
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x404f51
mov rax, qword [rsi + 0x80]
cmp qword [rsi + 0x78], rax
jne 0x4050b6
lea rdx, [rsp + 0x50]
lea rcx, [rsi + 0x78]
mov dword [rsp + 0x50], 0xffffffff
mov word [rsp + 0x54], 0xffff
mov dword [rsp + 0x58], 0xffffffff
call fcn.00519460
nop
add rsp, 0x8068
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40573e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x610
mov rax, qword [rdx]
mov rbx, rcx
mov rcx, rdx
call qword [rax + 0x20]
test al, 1
je 0x405805
mov dword [rsp + 0x3c], 0x10
lea rdi, [rsp + 0x50]
lea rbp, [rsp + 0x3c]
mov r12, qword [sym.imp.WS2_32.dll_recvfrom]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx + 0x70]
mov r8d, 0x5c0
call r12
mov esi, eax
cmp eax, 0x15
jle 0x405805
cmp byte [rsp + 0x50], 1
jne 0x405805
lea rdx, [rbx + 0x88]
lea rcx, [rsp + 0x52]
mov r8d, 6
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x405805
mov edx, dword [rbx + 0xb4]
lea rcx, [rsp + 0x58]
mov r8d, 6
imul rdx, rdx, 0xc
add rdx, qword [rbx + 0x78]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x405805
movzx eax, word [rsp + 0x60]
cmp eax, dword [rbx + 0x90]
jne 0x405805
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.00405514
jmp 0x405778
add rsp, 0x610
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x421e74
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x005310c0], 0xffffffffffffffff
mov ebx, ecx
je 0x421ef6
mov word [rsp + 0x2e], 0x400
mov rbp, qword [sym.imp.WS2_32.dll_send]
lea r12, [rsp + 0x2e]
lea rdi, [0x005ea200]
mov r13d, 0xff
test ebx, ebx
je 0x421ef6
cmp ebx, 0xff
mov esi, r13d
mov rcx, qword [0x005310c0]
mov rdx, r12
cmovbe esi, ebx
mov r8d, 2
xor r9d, r9d
mov byte [rsp + 0x2e], sil
sub ebx, esi
call rbp
mov rdx, rdi
mov byte [rsp + 0x2f], 0xff
xor r9d, r9d
mov rcx, qword [0x005310c0]
mov r8d, esi
call rbp
mov eax, esi
add rdi, rax
jmp 0x421eac
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x4234a6
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
call method.IWindow.getHandle__
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x423612
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x42360b
lea r12, [rsp + 0x48]
lea r14, [0x00532d19]
mov rcx, r12
call fcn.004cebac
mov r15d, dword [rdi + 4]
mov r9d, dword [rsi + 4]
cmp r9d, r15d
jl 0x4235ae
mov rcx, qword [rbp + 0x18]
mov edx, r15d
xor r13d, r13d
call fcn.00422cd6
mov rdx, qword [rax + 8]
sub rdx, qword [rax]
sar rdx, 3
cmp r15d, dword [rdi + 4]
jne 0x42352f
cmp dword [rdi], 0
cmovns r13d, dword [rdi]
mov ebx, edx
cmp r9d, r15d
jne 0x42353b
cmp dword [rsi], edx
cmovle ebx, dword [rsi]
mov r9d, r13d
mov r10d, r13d
shl r9, 3
cmp ebx, r10d
mov dword [rsp + 0x3c], r10d
mov rdx, qword [rax]
jbe 0x423581
movsx edx, byte [rdx + r9]
mov rcx, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
call fcn.004cee1e
mov r10d, dword [rsp + 0x3c]
mov r9, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
inc r10d
add r9, 8
jmp 0x423545
mov rax, qword [rax + 8]
sub rax, rdx
sar rax, 3
cmp r13d, eax
ja 0x4235a6
cmp r15d, dword [rsi + 4]
jne 0x42359b
cmp dword [rsi], eax
jle 0x4235a6
mov rdx, r14
mov rcx, r12
call fcn.004cedda
inc r15d
jmp 0x4234fb
mov rax, qword [rsp + 0x48]
mov ecx, 0x2000
mov eax, dword [rax]
lea edx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r13, rax
test rax, rax
je 0x423603
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x423603
mov rsi, qword [rsp + 0x48]
mov rdi, rax
mov edx, dword [rsi]
add rsi, 4
lea ecx, [rdx + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r13
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, r12
call fcn.004cea4a
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x423624
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov rbx, rcx
call method.IWindow.getHandle__
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x423715
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r12, rax
test rax, rax
je 0x42370e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x42370e
mov rcx, r12
lea r13, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rdx, r14
mov rcx, r13
lea r14, [rsp + 0x28]
mov r8d, eax
mov eax, 0
dec r8d
cmovs r8d, eax
call fcn.004cec42
mov rcx, r12
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x7fff
ja 0x4236ca
mov rcx, qword [rbx + 0x18]
mov rdx, r13
call fcn.00422f76
jmp 0x423706
mov r15, qword [rbx + 0x18]
mov r8d, r12d
mov r9d, 0x4000
mov rdx, r13
mov rcx, r14
add r12d, 0x4000
call fcn.004cf482
mov rdx, r14
mov rcx, r15
call fcn.00422f76
mov rcx, r14
call fcn.004cea4a
mov rax, qword [rsp + 0x20]
cmp dword [rax], r12d
ja 0x4236ca
mov rcx, r13
call fcn.004cea4a
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x42f202
Capabilities:
Get graphical window text

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov r13, rdx
mov rdx, qword [rdx + 0x10]
mov r12, rcx
test byte [rdx], 0x10
jne 0x42f22e
cmp qword [rdx + 8], 0
jne 0x42f23f
add rdx, 0x20
mov rcx, r12
call fcn.004cebf6
jmp 0x42f30c
mov rcx, r13
call method.IWindow.getHandle__
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jne 0x42f261
mov rcx, r12
call fcn.004cebac
jmp 0x42f30c
cmp byte [r13 + 8], 0
lea ebx, [rax + 1]
je 0x42f2b4
movsxd rax, ebx
mov r14, rsp
add rax, rax
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.004d43f0
sub rsp, rax
mov rcx, r13
call method.IWindow.getHandle__
lea r15, [rsp + 0x20]
mov r8d, ebx
mov rcx, rax
mov rdx, r15
call qword [sym.imp.USER32.dll_GetWindowTextW]
or r8d, 0xffffffff
mov rdx, r15
mov rcx, r12
call fcn.0042e301
mov rsp, r14
jmp 0x42f30c
lea r14, [rbp - 0x58]
mov rcx, r14
call fcn.004cebac
xor r8d, r8d
mov edx, ebx
mov rcx, r14
call fcn.004cf150
mov rax, qword [rbp - 0x58]
mov rcx, r13
lea r15, [rax + 4]
call method.IWindow.getHandle__
mov r8d, ebx
mov rdx, r15
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xor r8d, r8d
mov rcx, r14
mov edx, eax
call fcn.004cf150
mov rcx, r12
mov rdx, r14
call fcn.004cec08
mov rcx, r14
call fcn.004cea4a
mov rax, r12
lea rsp, [rbp - 0x48]
pop rbx
pop r12
pop r13
pop r14
pop r15
pop rbp
ret