joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1c0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, rcx
mov eax, dword [0x14023b1f8]
test al, 1
jne 0x14002802a
or eax, 1
mov dword [0x14023b1f8], eax
xor r9d, r9d
lea r8, str.GetFileAttributesExW
lea rdx, str.kernel32
lea rcx, [0x14023b1e8]
call fcn.140086de0
lea rcx, [0x14018a930]
call fcn.14011f460
nop
mov eax, dword [0x14023b1f8]
cmp qword [0x14023b1e8], 0
je 0x140028094
mov dword [rsp + 0x20], 0
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14007bc10
nop
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [0x14023b1e8]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
call fcn.14011e0c0
test bl, bl
je 0x140028080
xor eax, eax
jmp 0x140028144
mov eax, dword [rsp + 0x54]
shl rax, 0x20
mov ecx, dword [rsp + 0x58]
or rax, rcx
jmp 0x140028144
test al, 2
jne 0x1400280cb
or eax, 2
mov dword [0x14023b1f8], eax
xor r9d, r9d
lea r8, str.GetFileAttributesExA
lea rdx, str.kernel32
lea rcx, [0x14023b1d8]
call fcn.140086de0
lea rcx, [0x14018a920]
call fcn.14011f460
nop
mov rax, qword [0x14023b1d8]
test rax, rax
je 0x1400280fc
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
jne 0x1400280eb
xor eax, eax
jmp 0x140028144
mov eax, dword [rsp + 0x54]
shl rax, 0x20
mov ecx, dword [rsp + 0x58]
or rax, rcx
jmp 0x140028144
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14002810e
xor eax, eax
jmp 0x140028144
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
jne 0x140028126
xor eax, eax
jmp 0x140028144
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x8c]
shl rax, 0x20
mov ecx, dword [rsp + 0x90]
or rax, rcx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x1c0
pop rbx
ret
Function at 0x140029330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rdi, rcx
add rcx, 0x1b0
call fcn.140092970
nop
lea rcx, [rdi + 0x188]
call fcn.140092970
nop
lea rcx, [rdi + 0x160]
call fcn.140092970
nop
lea rcx, [rdi + 0x138]
call fcn.140092970
nop
lea rcx, [rdi + 0x110]
call fcn.140092970
nop
mov rcx, qword [rdi + 0xe8]
test rcx, rcx
je 0x1400293a7
call fcn.14011e950
xor ebp, ebp
mov qword [rdi + 0xe8], rbp
mov qword [rdi + 0xf0], rbp
mov qword [rdi + 0xf8], rbp
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x1400293cf
call fcn.14011e950
mov qword [rdi + 0xc8], rbp
mov qword [rdi + 0xd0], rbp
mov qword [rdi + 0xd8], rbp
mov rbx, qword [rdi + 0xa0]
test rbx, rbx
je 0x14002941e
mov rsi, qword [rdi + 0xa8]
cmp rbx, rsi
je 0x140029412
nop
mov rcx, qword [rbx + 8]
call fcn.14011e950
add rbx, 0x30
cmp rbx, rsi
jne 0x140029400
mov rcx, qword [rdi + 0xa0]
call fcn.14011e950
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov qword [rdi + 0xb0], rbp
lea rcx, [rdi + 0x68]
call fcn.1400ad6c0
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.140092240
Function at 0x14002b970
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x730
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x720], rax
xor esi, esi
mov rbx, rsi
mov qword [rsp + 0x38], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14002b9f8
nop
cmp dword [rsp + 0x60], 0x400
je 0x14002b9ee
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x14002b9c0
jmp 0x14002b9f8
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, 0x274
lea rdx, [rsp + 0x4a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002ba8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x88], 0
or r9d, 0xffffffff
lea r8, [0x140196720]
mov edx, 0x100
lea rcx, [rsp + 0x88]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x88]
call fcn.14007f910
lea rcx, [rsp + 0x18c]
lea rdx, [rsp + 0x88]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x18c]
call fcn.14011f050
lea rdx, str.read_socket_info
lea rcx, [0x14023b270]
call fcn.140002fd0
cmp dword [rsp + 0x30], 0x274
je 0x14002bafd
mov byte [rsp + 0x88], 0
or r9d, 0xffffffff
lea r8, str.short_read
mov edx, 0x100
lea rcx, [rsp + 0x88]
call fcn.14007b3b0
lea rcx, [rsp + 0x394]
lea rdx, [rsp + 0x88]
mov r8d, 0x100
call fcn.14011e9b0
lea rdx, [0x14020b7d0]
lea rcx, [rsp + 0x394]
call fcn.14011f050
call fcn.1400333d0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x4a0]
or r8d, 0xffffffff
or edx, r8d
or ecx, r8d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002bb95
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov byte [rsp + 0x88], 0
or r9d, edi
lea r8, str.WSASocket
mov edx, 0x100
lea rcx, [rsp + 0x88]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x88]
call fcn.14007f910
lea rcx, [rsp + 0x290]
lea rdx, [rsp + 0x88]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x290]
call fcn.14011f050
mov ecx, 0xb0
call fcn.14011ecf0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002bbce
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
xor r9d, r9d
mov r8b, 1
mov edx, edi
mov rcx, rax
call fcn.140032bf0
mov rdi, rax
jmp 0x14002bbd1
mov rdi, rsi
test rbx, rbx
je 0x14002bbdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.14011f1c0
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140030ec0
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x180
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov esi, edx
mov r13, rcx
mov ecx, edx
call fcn.140035c10
mov r8, rax
lea rdx, str.trying__s
lea rcx, [0x14023b2c0]
call fcn.140002fd0
mov ecx, 0x48
call fcn.14011ecf0
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x140030f3a
mov dword [rsp + 0x20], 0xffffffff
movzx r9d, byte [r13 + 0x44]
mov r8d, esi
mov edx, dword [r13 + 0x40]
mov rcx, rax
call fcn.1400351b0
mov r12, rax
jmp 0x140030f3d
xor r12d, r12d
mov qword [rsp + 0x1b0], r12
cmp esi, 0x17
jne 0x140030fe6
mov rax, qword [0x14023b318]
mov rbx, qword [rax]
cmp rbx, rax
jne 0x140030f62
call fcn.14011ef50
cmp byte [rbx + 0x1c], 0
je 0x140030fe6
mov dword [rsp + 0x1a8], 0xa
movsxd rcx, dword [r12 + 8]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x1a8]
mov edx, 0x29
lea r8d, [rdx - 0x12]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140030fe6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x78], 0
or r9d, 0xffffffff
lea r8, str.setsockopt
mov edx, 0x100
lea rcx, [rsp + 0x78]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.14007f910
lea r8, [rsp + 0x78]
lea rdx, str.unable_to_enable_NAT_traversal:__s
lea rcx, [0x14023b2c0]
call fcn.140001050
mov rdx, qword [r13 + 0x50]
test rdx, rdx
jne 0x140030ff3
mov rdx, qword [r13 + 0x48]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [r13 + 0x58]
mov rcx, r12
call fcn.1400358b0
lea rdi, [r13 + 8]
mov rbx, qword [rdi + 8]
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x14003102e
cmp dword [rax + 0x18], esi
jge 0x140031026
mov rax, qword [rax + 0x10]
jmp 0x140031015
mov rbx, rax
mov rax, qword [rax]
jmp 0x140031015
mov qword [rsp + 0x38], rbx
test rdi, rdi
jne 0x14003103d
call fcn.14011ef50
mov qword [rsp + 0x30], rdi
cmp rbx, qword [rdi + 8]
je 0x14003104d
cmp esi, dword [rbx + 0x18]
jge 0x140031099
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140030780
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x1400310a3
call fcn.14011ef50
cmp rbx, qword [rdi + 8]
jne 0x1400310ae
call fcn.14011ef50
mov qword [rbx + 0x20], r12
mov ecx, esi
call fcn.140035c10
mov r8, rax
mov r9d, dword [r13 + 0x40]
lea rdx, str.listening_on__s__port__d
lea rcx, [0x14023b2c0]
call fcn.140002f80
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140032b90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test dl, dl
mov edx, 6
sete al
lea r9, [rsp + 0x48]
lea r8d, [rdx - 5]
movsxd rcx, ecx
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x48], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140032be5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.unable_to_setsockopt_TCP_NODELAY:__d
lea rcx, [0x14023b328]
mov r8d, eax
call fcn.140002fd0
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x140032bf0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
movsxd rbx, edx
mov rdi, rcx
mov byte [rsp + 0x30], 1
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov edx, ebx
call fcn.1400338f0
nop
lea rax, [0x140197298]
mov qword [rdi], rax
lea rax, [0x140197280]
mov qword [rdi + 0x28], rax
lea rax, [0x140197268]
mov qword [rdi + 0x30], rax
xor eax, eax
mov qword [rdi + 0x98], rax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rsp + 0x68], 1
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x68]
lea edx, [rax + 6]
lea r8d, [rax + 1]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140032cb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.unable_to_setsockopt_TCP_NODELAY:__d
lea rcx, [0x14023b328]
call fcn.140002fd0
nop
mov rax, rdi
jmp 0x140032cb6
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400333d0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x3e8
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
cmp byte [0x14023b348], 0
jne 0x140033482
lea rdx, [rsp + 0x230]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14003347b
mov qword [rsp + 0x3e0], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.unable_to_initialise_Winsock2
lea rcx, [rsp + 0x20]
or r9d, 0xffffffff
mov edx, 0x100
mov ebx, eax
mov byte [rsp + 0x20], 0
call fcn.14007b3b0
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14007f910
lea rcx, [rsp + 0x124]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x124]
call fcn.14011f050
mov rbx, qword [rsp + 0x3e0]
mov byte [0x14023b348], 1
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x3e8
ret
Function at 0x140033600
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
sub rsp, 0x238
xor eax, eax
test dl, dl
lea r8, [r11 + 0x10]
sete al
movsxd rcx, ecx
mov edx, 0x8004667e
mov dword [r11 + 0x10], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14003369a
mov qword [rsp + 0x230], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.setBlocking
lea rcx, [rsp + 0x20]
or r9d, 0xffffffff
mov edx, 0x100
mov ebx, eax
mov byte [rsp + 0x20], 0
call fcn.14007b3b0
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14007f910
lea rcx, [rsp + 0x124]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x124]
call fcn.14011f050
mov rbx, qword [rsp + 0x230]
add rsp, 0x238
ret

Function at 0x1400336b0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x288], rbx
mov ebp, r9d
movzx edi, r8b
mov esi, edx
mov rbx, rcx
cmp dword [rcx + 0x44], 0
jl 0x140033707
mov r9d, 0x4f
lea r8, str..FdIo.cxx
lea rdx, str.fd___0
lea rcx, [rsp + 0x140]
call fcn.140086ab0
mov rcx, rax
call fcn.140086a30
mov byte [rbx + 0x40], dil
mov dword [rbx + 0x44], esi
mov ecx, 0x50
call fcn.14011ecf0
mov qword [rsp + 0x280], rax
xor edi, edi
test rax, rax
je 0x140033745
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x20], dil
mov r9d, ebp
or r8d, 0xffffffff
mov edx, dword [rbx + 0x44]
mov rcx, rax
call fcn.1400779d0
jmp 0x140033748
mov rax, rdi
mov qword [rbx + 8], rax
mov ecx, 0x58
call fcn.14011ecf0
mov qword [rsp + 0x280], rax
test rax, rax
je 0x140033782
mov byte [rsp + 0x20], 0
mov r9d, dword [rsp + 0x2a0]
or r8d, 0xffffffff
mov edx, dword [rbx + 0x44]
mov rcx, rax
call fcn.1400778d0
mov rdi, rax
mov qword [rbx + 0x10], rdi
lea rax, [rbx + 0x30]
mov qword [rdi + 0x48], rax
movsxd rcx, dword [rbx + 0x44]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140033803
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x38], 0
or r9d, 0xffffffff
lea r8, str.setInheritable
mov edx, 0x100
lea rcx, [rsp + 0x38]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.14007f910
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x38]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x140]
call fcn.14011f050
int3
cmp byte [rsp + 0x2a8], 0
je 0x140033897
mov dword [rsp + 0x290], 1
movsxd rcx, dword [rbx + 0x44]
lea r8, [rsp + 0x290]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140033897
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x38], 0
or r9d, 0xffffffff
lea r8, str.setBlocking
mov edx, 0x100
lea rcx, [rsp + 0x38]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.14007f910
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x38]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x140]
call fcn.14011f050
int3
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400338f0
Capabilities:
Initialize winsock library

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x400
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
movzx esi, r8b
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rdx
mov dword [rcx + 0x20], edx
lea rax, [rcx + 0x28]
lea rcx, [0x1401975d8]
mov qword [rbx], rcx
lea rcx, [0x1401975c0]
mov qword [rax], rcx
lea rcx, [0x1401975a8]
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x38], rdx
mov byte [rbx + 0x40], 1
mov byte [rbx + 0x41], r9b
mov dword [rbx + 0x44], 0xffffffff
mov dword [rbx + 0x48], edx
mov qword [rbx + 0x50], rdx
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x60], rdx
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rdx
mov qword [rbx + 0x88], rdx
mov byte [rbx + 0x90], dl
mov byte [rbx + 0x91], dl
mov byte [rbx + 0x92], dl
cmp byte [0x14023b348], dl
jne 0x140033a29
lea rdx, [r11 - 0x1b8]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140033a22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x40], 0
or r9d, 0xffffffff
lea r8, str.unable_to_initialise_Winsock2
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14007f910
lea rcx, [rsp + 0x144]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x144]
call fcn.14011f050
int3
mov byte [0x14023b348], 1
test edi, edi
js 0x140033a5b
movzx ecx, byte [rsp + 0x440]
mov byte [rsp + 0x28], cl
mov ecx, dword [rsp + 0x438]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x430]
movzx r8d, sil
mov edx, edi
mov rcx, rbx
call fcn.1400336b0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.14011f1c0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400343d0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
movzx r13d, r9w
mov qword [rbp], 0
mov r14d, r8d
mov r15d, edx
mov byte [rax], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
mov r12, rax
je 0x140034505
cmp word [rax + 0x10], 2
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
jne 0x1400344c7
cmp word [rax + 0x12], 4
jne 0x1400344c7
mov rdi, qword [rax + 0x18]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400344c7
nop
nop
nop
mov esi, dword [rcx]
mov edx, gethostbyname
lea ecx, [rdx - 0x2f]
call fcn.140123f00
test rax, rax
mov rbx, rax
je 0x1400344ad
mov edx, reloc.WS2_32.dll_recv
lea ecx, [rdx - 0xf]
call fcn.140123f00
test rax, rax
jne 0x140034485
mov rcx, rbx
call fcn.140123ff0
xor ebx, ebx
jmp 0x1400344ad
mov word [rax], 2
mov word [rax + 2], r13w
mov dword [rax + 4], esi
mov dword [rbx + 4], 2
mov dword [rbx + 8], r15d
mov dword [rbx + 0xc], r14d
mov qword [rbx + reloc.WS2_32.dll_recv], 0x10
mov qword [rbx + 0x20], rax
test rbx, rbx
mov qword [rbp], rbx
je 0x1400344fe
mov rcx, qword [rdi + 8]
add rdi, 8
lea rbp, [rbx + 0x28]
test rcx, rcx
jne 0x140034450
mov r8, qword [r12]
mov rcx, qword [rsp + 0x70]
mov r9d, 0x400
lea edx, [r9 + 1]
call fcn.140124040
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 8
jmp 0x1400344e1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x14003451c
sub eax, 1
je 0x140034542
sub eax, 1
je 0x14003452f
mov eax, 0x2af9
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0x2afb
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0x2afa
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140034ee0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x14023b3c0], 0
lea rax, [0x140034890]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140034c40]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x140034830]
mov qword [rsp + 0x48], rax
jne 0x1400350af
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400350a5
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x290], rsi
call fcn.140123d80
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140124240
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140034fd4
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140035034
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140123d80
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140124240
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14003509d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140035034
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14003509d
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx], rax
je 0x14003508c
add rdi, 1
add rbx, 0x10
cmp rdi, 3
jl 0x140035043
mov rax, qword [rsp + 0x28]
mov qword [0x1402115d8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1402115e8], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1402115f8], rax
jmp 0x140035095
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x14023b3c0], 1
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14011f1c0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140044650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x50]
xor ebx, ebx
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], ebx
call fcn.14007bc10
mov rdx, qword [rsp + 0x50]
lea r8, str.BUILTINRESOURCE
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [rsp + 0x50]
mov rsi, rax
call fcn.14011e950
test rsi, rsi
jne 0x1400446a6
mov dword [rdi], ebx
jmp 0x1400446cf
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400446a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi], eax
mov rsi, qword [rsp + 0x48]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14004b020
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [rcx + 8]
cmp eax, 0xa0
jne 0x14004b032
mov rcx, qword [rcx]
jmp fcn.14004f900
mov rdx, qword [rcx]
mov ecx, eax
jmp fcn.14004e370
Function at 0x14004f900
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov dword [rcx + 4], eax
mov dword [rcx], eax
ret