joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2d00
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x180], 0
mov rbx, rcx
je 0x1400a354b
mov rax, qword [rcx]
call qword [rax + 0x228]
test eax, eax
je 0x1400a354b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x220]
lea rcx, [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xc0]
lea rcx, [rbx + 0x7b0]
test rcx, rcx
je 0x1400a3577
cmp qword [rcx + 0x40], 0
je 0x1400a3577
mov rax, qword [rcx]
call qword [rax + 0xc0]
lea rcx, [rbx + 0xbc8]
test rcx, rcx
je 0x1400a3593
cmp qword [rcx + 0x40], 0
je 0x1400a3593
mov rax, qword [rcx]
call qword [rax + 0xc0]
lea rcx, [rbx + 0xe28]
test rcx, rcx
je 0x1400a35af
cmp qword [rcx + 0x40], 0
je 0x1400a35af
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14012ae50
push rbx
sub rsp, 0x20
mov edx, dword [0x1403e4118]
mov rbx, rcx
lea rcx, [0x1400d2aa0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1403e4108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1403e4110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10f0]
test rcx, rcx
je 0x1400d2d52
cmp qword [rcx + 0x40], 0
je 0x1400d2d52
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400a3520
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
xor ebx, ebx
mov rdi, rcx
test rax, rax
je 0x14012ae77
cmp dword [rax + 0x18], 7
je 0x14012ae89
cmp dword [rax + 0x18], 6
je 0x14012ae89
call fcn.14011eba0
cmp byte [rax + 0x28], bl
jne 0x14012ae89
mov rcx, rdi
call fcn.14012ae04
call fcn.14013ba78
mov r11, qword [rdi + 0x140]
test r11, r11
je 0x14012ae9d
call r11
mov rcx, qword [rdi + 0x100]
test rcx, rcx
je 0x14012aeb6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rdi + 0x100], rbx
call fcn.14012d3a0
test rax, rax
je 0x14012aec8
call fcn.14012d3a0
mov ebx, dword [rax + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5030
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rcx
call fcn.1400a5a50
nop
lea rax, vtable.CTaskSpaceApp.0
mov qword [rbx], rax
lea rax, vtable.CAppHistory_class_CTaskSpaceLayout_.0
mov qword [rbx + 0xfa0], rax
mov dword [rbx + 0xfa8], 0xa
xor esi, esi
mov qword [rbx + 0xfb0], rsi
mov qword [rbx + 0xfb8], rsi
mov qword [rbx + 0xfc0], rsi
mov qword [rbx + 0xfd0], rsi
call fcn.14011c934
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d50b5
mov ecx, 0x80004005
call fcn.14008ec20
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.TaskSpaceHookDll64.dll
test rdx, 0xffffffffffff0000
jne 0x1400d50f8
movzx edi, dx
mov ecx, edi
call fcn.14011ced4
test rax, rax
je 0x1400d5109
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14008f890
jmp 0x1400d5109
mov r8d, reloc.WSOCK32.dll_shutdown
lea rcx, [rsp + 0x48]
call fcn.14008f9b0
nop
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rbx + 0xfd8]
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.1400d29f0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400d5144
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbx + 0x1020]
call fcn.1400b81e0
nop
lea rcx, [rbx + 0x1080]
call fcn.1400b8730
mov qword [rbx + 0x10e0], rsi
mov qword [rbx + 0x10e8], rsi
mov qword [rbx + 0x10f0], rsi
mov qword [rbx + 0x10f8], rsi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ddf40
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.14025e980
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1400ddf9f
mov rax, qword [rsp + 0x20]
shr rax, 0x20
cmp eax, 5
jne 0x1400ddf9f
cmp dword [rsp + 0x28], 2
jne 0x1400ddf9f
lea ecx, [rax + 0x54]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1400ddf9f
mov al, 1
add rsp, 0x148
ret
xor al, al
add rsp, 0x148
ret

Function at 0x1400ddfb0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.14025e980
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1400de005
mov rax, qword [rsp + 0x20]
shr rax, 0x20
cmp eax, 6
jne 0x1400de005
cmp byte [rsp + 0x13a], 1
je 0x1400de005
mov al, 1
add rsp, 0x148
ret
xor al, al
add rsp, 0x148
ret

Function at 0x1400de540
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
cmp eax, edi
je 0x1400de5b1
mov r8d, 1
mov edx, eax
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x1400de5b1
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, qword [rbx + 0x40]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]

Function at 0x1400e5e70
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x20]
mov ecx, 8
mov dil, 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e5f24
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x434
call fcn.14025e980
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x30], 0x438
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1400e5f1b
nop word [rax + rax]
lea rdx, str.wow64.dll
lea rcx, [rsp + 0x60]
call fcn.14025e8e4
test eax, eax
je 0x1400e5f18
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1400e5ef0
jmp 0x1400e5f1b
xor dil, dil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14025db20
mov rbx, qword [rsp + 0x498]
add rsp, 0x480
pop rdi
ret
Function at 0x1400f2e00
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x1400f2e5e
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1400f2e58
shr ax, 8
cmp al, 2
jne 0x1400f2e58
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x1d8
ret
call qword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x1d8
ret

Function at 0x1400f4d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x1400f4d6c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
mov r8, rax
add rdx, 4
mov ecx, 2
jmp fcn.140103370
Function at 0x1400fdfc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WSOCK32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400fdff9
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
or edx, 0xffffffff
mov ecx, Ordinal_60
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400fe1a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x1c0]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x1400fe1e3
mov rax, qword [rcx + 0x138]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test edx, edx
js 0x1400fe22a
cmp edx, 2
jg 0x1400fe22a
mov r9, qword [rbx + 0x130]
movsxd rax, edx
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x1402db378]
lea r8d, [rdx - 1]
add rcx, rax
call fcn.14025e188
mov r9, qword [rbx + 0x130]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.14025e188
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400fe4e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rax, edx
mov r10, r9
mov r11, r8
mov rdi, rcx
mov rcx, qword [rcx + rax*8 + 0x120]
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WSOCK32.dll_send]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x1400fe54c
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400fe530
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, eax
mov rcx, rdi
call fcn.1400f2cd0
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400fe410
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400fedb0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov r10, rdx
mov edx, 6
movzx eax, byte [rbx + 0x3a6]
mov rdi, rcx
lea r9, [rsp + 0x40]
lea r8d, [rdx - 5]
mov rcx, r10
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], eax
call qword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jns 0x1400fee1e
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
call fcn.1400f2cd0
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.1400fe360
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.1400fe360
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fee40
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
call qword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
jne 0x1400fee8f
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1400feeb0
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WSOCK32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1400ff2f0
Capabilities:
Parse pe header

Disassembly:
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x1400ff30f
lea r8, [0x140000000]
cdqe
mov edx, dword [r8 + rax*4 + 0xff364]
add rdx, r8
jmp rdx
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, Ordinal_79
ret
mov al, reloc.WLDAP32.dll_Ordinal_79
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
movzx eax, cl
ret
Function at 0x140103a70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov edx, 1
mov rsi, rcx
lea ecx, [rdx + 0x3f]
mov r12d, r8d
call qword [case.0x1400fca78.3]
xor r13d, r13d
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rax
test rdi, rdi
jne 0x140103ac1
lea ecx, [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140103c4f
mov rcx, qword [rsi + 0x3d8]
mov qword [rsp + 0x60], rbx
call fcn.1400f52e0
mov rcx, rbp
call qword [case.0x1400fca78.1]
mov qword [rsi + 0x3d8], rax
test rax, rax
jne 0x140103b02
mov rcx, rdi
call qword [fcn.14025db40]
mov ecx, reloc.WSOCK32.dll_ioctlsocket
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140103c4a
xor r8d, r8d
mov dword [rsi + 0x3e0], r12d
mov byte [rsi + 0x3f0], r13b
mov dword [rsi + 0x3f4], r13d
mov qword [rsi + 0x3e8], r13
mov qword [rsi + 0x3f8], rdi
lea edx, [r8 + 1]
xor ecx, ecx
mov qword [rdi + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x140103bac
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x140103bac
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x30], rax
test rax, rax
je 0x140103bac
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x140103bac
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x140103bca
lea rcx, [rsi + 0x3d8]
call fcn.140103970
mov ecx, listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140103c4a
lea rax, [rdi + 8]
lea r8, [0x140103880]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call fcn.14025f818
mov qword [rdi], rax
test rax, rax
jne 0x140103c10
call fcn.140263720
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x3d8]
call fcn.140103970
xor al, al
jmp 0x140103c4a
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x28]
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, 2
mov ecx, edx
xor r8d, r8d
call qword [sym.imp.WSOCK32.dll_socket]
mov qword [rdi + 0x10], rax
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x140103c70
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, qword [rcx]
mov rbp, qword [rcx + 0x3f8]
mov r13, rdx
mov edx, dword [r12 + 0x224]
mov rdi, rcx
test edx, edx
jne 0x140103cb6
mov eax, dword [r12 + 0x220]
mov edx, 0x493e0
test eax, eax
cmovne edx, eax
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
xor esi, esi
mov qword [rbp + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x20], rsi
test ebx, ebx
jne 0x140103d10
mov rcx, qword [rbp]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140103d65
mov rcx, qword [rbp]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rbx, [rbp + 0xc]
mov byte [rdi + 0x3f0], 1
mov dword [rbx], 0xffffffff
test r13, r13
je 0x140103d31
mov rax, qword [rdi + 0x3e8]
mov qword [r13], rax
cmp qword [rdi + 0x3e8], rsi
jne 0x140103e15
mov eax, dword [rbx]
cmp eax, 0x1b
jne 0x140103d84
mov ecx, eax
mov esi, eax
call fcn.1400f2540
lea rdx, str.Could_not_resolve_host:__s
mov rcx, r12
mov r8, rax
call fcn.1400fe410
jmp 0x140103e15
mov ecx, dword [rdi + 0x3f4]
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
mov rcx, qword [rbp]
lea rbx, [rbp + 0xc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x140103d21
cmp byte [rdi + 0x3f0], sil
je 0x140103de9
mov edx, dword [rdi + 0x3f4]
mov rcx, rdi
cmp byte [rdi + 0x1eb], sil
je 0x140103dc4
call fcn.1400f2cd0
mov r8, qword [rdi + 0xd8]
lea rdx, str.Could_not_resolve_proxy:__s___s
mov r9, rax
mov rcx, r12
call fcn.1400fe410
mov esi, 5
jmp 0x140103e15
call fcn.1400f2cd0
mov r8, qword [rdi + 0xb0]
lea rdx, str.Could_not_resolve_host:__s___s
mov r9, rax
mov rcx, r12
call fcn.1400fe410
mov esi, 6
jmp 0x140103e15
cmp eax, 0xffffffff
je 0x140103dfa
cmp dword [rdi + 0x3f4], 0x2afc
jne 0x140103e10
mov r8, qword [rdi + 0xb0]
lea rdx, [0x1402dc5f0]
mov rcx, r12
call fcn.1400fe410
mov esi, Ordinal_30
lea rcx, [rdi + 0x3d8]
call fcn.140103970
cmp qword [rdi + 0x3e8], 0
mov eax, esi
jne 0x140103e34
mov byte [rdi + 0x1e8], 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140103f20
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov r12, qword [rcx]
mov ebx, r8d
mov rbp, rcx
lea r8, [rsp + 0x50]
mov ecx, 2
mov rsi, r9
mov rdi, rdx
mov dword [r9], 0
call fcn.140114ee0
test eax, eax
jle 0x140103f75
lea rdx, [rsp + 0x50]
mov r9d, ebx
mov r8, rdi
mov ecx, 2
call fcn.1401035d0
jmp 0x140103ffc
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call fcn.140103a70
test al, al
je 0x140103f91
mov dword [rsi], 1
xor eax, eax
jmp 0x140103ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
mov edx, eax
call fcn.1400f2cd0
lea rdx, str.init_resolve_thread___failed_for__s___s_n
mov r8, rdi
mov r9, rax
mov rcx, r12
call fcn.1400fe360
mov rcx, rdi
call qword [sym.imp.WSOCK32.dll_gethostbyname]
test rax, rax
jne 0x140103ff2
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, rbp
mov edx, eax
call fcn.1400f2cd0
lea rdx, str.gethostbyname_2__failed_for__s:_d___s_n
mov r9d, ebx
mov r8, rdi
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.1400fe360
xor eax, eax
jmp 0x140103ffc
mov edx, ebx
mov rcx, rax
call fcn.140103490
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1401045f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
sub edx, 3
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov rdi, qword [rax]
je 0x14010476a
sub edx, 2
je 0x140104675
dec edx
je 0x1401046fc
dec edx
je 0x14010464e
lea r8, str.tftp_rx:_internal_error
lea rdx, [0x1403551f8]
mov rcx, rdi
call fcn.1400fe410
mov eax, 0x47
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
inc dword [rcx + 0x20]
mov r8d, dword [rcx + 0x20]
lea rdx, str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
mov rcx, rdi
call fcn.1400fe360
movsxd r11, dword [rbx + 0x20]
cmp r11, qword [rbx + 0x30]
jle 0x14010468e
mov dword [rbx + 8], 0xffffff9d
mov ecx, 3
xor eax, eax
mov dword [rbx], ecx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rbx + 0x150]
mov rdx, qword [rbx + 0x180]
lea rcx, [rbx + 0xd0]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x18]
lea r8d, [r9 + 4]
call qword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jns 0x14010484d
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, qword [rbx + 0x10]
mov edx, eax
call fcn.1400f2cd0
lea rdx, [0x1403551f8]
mov rcx, rdi
mov r8, rax
call fcn.1400fe410
mov eax, gethostname
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor eax, eax
add rcx, 0x180
mov word [rcx - 0x138], ax
mov dword [rcx - 0x160], eax
lea edx, [rax + 4]
call fcn.1401041f0
movzx edx, word [rbx + 0x48]
lea rcx, [rbx + 0x180]
call fcn.140104210
mov eax, dword [rbx + 0x150]
mov rdx, qword [rbx + 0x180]
lea rcx, [rbx + 0xd0]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x18]
lea r8d, [r9 + 4]
call qword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
js 0x1401046c4
mov edx, 1
jmp 0x14010484b
add rcx, 0x178
call fcn.140104240
movzx esi, ax
movzx eax, word [rbx + 0x48]
inc eax
cmp eax, esi
je 0x1401047ce
lea rdx, str.Received_unexpected_DATA_packet_block__d_n
mov r8d, esi
mov rcx, rdi
call fcn.1400fe360
inc dword [rbx + 0x20]
movsxd rax, dword [rbx + 0x20]
cmp rax, qword [rbx + 0x30]
jle 0x1401047ce
movzx r8d, word [rbx + 0x48]
lea rdx, str.tftp_rx:_giving_up_waiting_for_block__d
mov rcx, rdi
inc r8d
call fcn.1400fe410
mov eax, 0x47
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor eax, eax
lea rcx, [rbx + 0x180]
mov word [rbx + 0x48], si
lea edx, [rax + 4]
mov dword [rbx + 0x20], eax
call fcn.1401041f0
movzx edx, word [rbx + 0x48]
lea rcx, [rbx + 0x180]
call fcn.140104210
mov eax, dword [rbx + 0x150]
mov rdx, qword [rbx + 0x180]
lea rcx, [rbx + 0xd0]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x18]
lea r8d, [r9 + 4]
call qword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
js 0x1401046c4
mov rax, qword [rbx + 0x168]
mov edx, 1
mov ecx, 3
add rax, 4
cmp qword [rbx + 0x158], rax
cmovl edx, ecx
mov dword [rbx], edx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140105770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
mov r13, rcx
mov edx, 0x5c
mov rdi, qword [rax + 0x87c0]
mov rcx, qword [rdi]
call fcn.140262a68
mov rsi, qword [r13]
xor r15d, r15d
lea r12, [rsi + 0x638]
mov rbp, rax
mov r14d, r15d
call fcn.140112410
mov rcx, qword [rsi + 0x1b0]
mov qword [r13 + 0x2a8], rcx
mov rcx, qword [rsi + 0x158]
mov rbx, rax
mov qword [r13 + 0x2b0], rcx
mov rcx, qword [r13]
mov qword [rcx + 0x120], r12
test rbp, rbp
jne 0x140105807
mov eax, Ordinal_41
jmp 0x1401059b1
cmp byte [rbp + 1], r14b
je 0x1401057fd
mov rcx, qword [rdi]
cmp qword [rsi + 0x87b8], r14
je 0x140105822
lea rdx, [0x1402dcc04]
jmp 0x140105868
mov rax, qword [r13]
mov edx, 0x8301
mov r8d, dword [rax + 0x3b4]
call fcn.1402796c8
test eax, eax
jns 0x140105857
mov r8, qword [rdi]
lea rdx, str.Cant_open__s_for_writing
mov rcx, rsi
call fcn.1400fe410
mov eax, reloc.WSOCK32.dll_socket
jmp 0x1401059b1
mov ecx, eax
call fcn.14026b614
mov rcx, qword [rdi]
lea rdx, [0x140332758]
call fcn.140263598
mov rbp, rax
test rax, rax
je 0x14010583b
mov rdx, qword [rsi + 0x230]
cmp rdx, 0xffffffffffffffff
je 0x14010588a
mov rcx, rsi
call fcn.140102cc0
cmp qword [rsi + 0x87b8], r14
jge 0x1401058e0
mov rcx, rbp
call fcn.1402652a8
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.140263ac0
test eax, eax
je 0x1401058cf
mov rcx, rbp
call fcn.14025d970
mov r8, qword [rdi]
lea rdx, str.Cant_get_the_size_of__s
mov rcx, rsi
call fcn.1400fe410
mov eax, reloc.WSOCK32.dll_socket
jmp 0x1401059b1
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x87b8], rax
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov edx, 0x4000
mov rcx, r13
call fcn.1400f9d00
mov edi, eax
test eax, eax
jne 0x1401059a7
movsxd rax, dword [rsp + 0x20]
test eax, eax
jle 0x140105991
mov rdi, rax
mov rax, qword [rsi + 0x87b8]
test rax, rax
je 0x14010592a
cmp rdi, rax
jg 0x140105973
sub rax, rdi
mov rdi, r15
mov qword [rsi + 0x87b8], rax
mov rcx, r12
mov r9, rbp
mov r8, rdi
mov edx, 1
call fcn.14025e188
cmp rax, rdi
jne 0x14010598a
add r14, rdi
mov rcx, rsi
mov rdx, r14
call fcn.140102c90
mov rcx, r13
call fcn.140102ce0
test eax, eax
jne 0x140105983
mov rdx, rbx
mov rcx, rsi
call fcn.140112960
mov edi, eax
test eax, eax
je 0x1401058e0
jmp 0x1401059a7
lea rcx, [rax + r12]
sub rdi, rax
mov qword [rsi + 0x87b8], r15
jmp 0x14010592d
mov edi, Ordinal_46
jmp 0x1401059a7
mov edi, gethostname
jmp 0x1401059a7
mov rcx, r13
call fcn.140102ce0
mov ecx, edi
mov edi, Ordinal_46
test eax, eax
cmovne ecx, edi
mov edi, ecx
mov rcx, rbp
call fcn.14025d970
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025db20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret