joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001e868
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x18001e8d4
xor r8d, r8d
xor edx, edx
call qword [sym.imp.kERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
je 0x18001e8d4
mov rcx, qword [0x180035a68]
lea r8d, [rax + rax]
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18001e8d4
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.kERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x18001e8d4
mov rcx, qword [0x180035a68]
mov r8, rbx
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001ec38
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [rsp + 0x48]
call fcn.18002a120
mov ebx, eax
test eax, eax
jne 0x18001ed3d
and dword [rsp + 0x40], eax
mov rax, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x48]
mov ebx, 8
mov qword [rdi + 0x28], rax
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x40]
lea r8d, [rbx + 0x38]
mov rdx, rbx
call qword [sym.imp.kERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001ed1f
mov rax, qword [rsi + 8]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, qword [rax]
mov qword [rdi + 0x10], rcx
mov rax, qword [rsi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rdi + 0x20], rcx
mov rcx, qword [rsi + 8]
mov rax, qword [rdi + 0x28]
mov qword [rcx], rax
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsi + 8]
call qword [sym.imp.kERNEL32.dll_VirtualProtect]
or dword [rdi + 0x38], 0x101
lea rcx, [0x180035fc0]
call qword [sym.imp.kERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x180035fb0]
lea rax, [0x180035fb0]
mov qword [rdi], r11
mov qword [rdi + 8], rax
mov qword [r11 + 8], rdi
lea rcx, [0x180035fc0]
mov qword [0x180035fb0], rdi
call qword [sym.imp.kERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi + 0x20]
xor ebx, ebx
mov qword [rsi + 0x20], r11
jmp 0x18001ed3d
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x18001ed3d
mov rcx, qword [0x180035a68]
mov r8, rdi
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001f128
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180035c60]
lea rbp, [0x180000000]
lea rcx, [rax + rbp + 0x397f6]
call qword [sym.imp.kERNEL32.dll_GetModuleHandleA]
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx ecx, word [rdx + 0x14]
lea r8, [rcx + rdx + 0x18]
movzx ecx, word [rdx + 6]
test ecx, ecx
je 0x18001f181
bt dword [r8 + 0x24], 0x1f
jb 0x18001f184
add r8, 0x28
add ecx, 0xffffffff
jne 0x18001f170
xor r8d, r8d
xor edi, edi
test r8, r8
je 0x18001f254
mov ebx, dword [r8 + 0xc]
xor ecx, ecx
add rbx, rax
mov eax, dword [r8 + 8]
mov dword [rsp + 0x50], ecx
lea rsi, [rax + rbx - 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rax, [0x180007a94]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmp rbx, rsi
ja 0x18001f254
mov rax, qword [rbx]
cmp rax, rbx
jne 0x18001f24c
cmp rax, qword [rbx + 8]
jne 0x18001f24c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 8], rcx
lea rax, [rsp + 0x20]
mov qword [rbx], rax
mov rax, qword [0x180035c60]
lea rcx, [rax + rbp + 0x39cfe]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001f231
mov rcx, rax
call qword [sym.imp.kERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
cmovne rdi, rbx
add rbx, 0x10
test ecx, ecx
je 0x18001f1e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x180020374
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xf0
xor edi, edi
mov r12d, r8d
mov r13, rcx
and dword [rax + 0x20], edi
lea rcx, [rax - 0x80]
lea r8d, [rdi + 0x60]
xor edx, edx
call sub.ntdll.dll_memset
and qword [rsp + 0x50], rdi
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x80], 0x68
xor ebx, ebx
call fcn.180011ae0
mov rsi, rax
test rax, rax
je 0x18002042f
mov edx, 0x104
mov rcx, rax
call fcn.18002b3b0
mov rbp, rax
test rax, rax
je 0x180020416
mov rcx, rax
call qword [sym.imp.SHELL32.dll_PathGetShortPath]
mov rcx, rbp
mov rbx, rsi
call qword [sym.imp.kERNEL32.dll_lstrlenW]
mov rdx, rbp
mov rcx, rsi
inc eax
movsxd r8, eax
call qword [sym.imp.ntdll.dll_wcstombs]
mov r8, rbp
jmp 0x180020419
mov r8, rsi
mov rcx, qword [0x180035a68]
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
test rbx, rbx
cmovne rdi, rbx
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0xc000000
and dword [rsp + 0x20], 0
call qword [sym.imp.kERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180020527
mov rax, qword [0x180035c88]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
lea esi, [r8 + 2]
mov r9d, r12d
mov ecx, esi
mov qword [rsp + 0x70], rax
call qword [sym.imp.kERNEL32.dll_WaitForMultipleObjects]
mov edi, 0x102
mov dword [rsp + 0x128], eax
cmp eax, edi
jne 0x1800204ea
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e5
call qword [sym.imp.kERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1800204dd
lea rdx, [rsp + 0x68]
mov r9d, r12d
xor r8d, r8d
mov ecx, esi
call qword [sym.imp.kERNEL32.dll_WaitForMultipleObjects]
jmp 0x1800204e3
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov dword [rsp + 0x128], eax
test eax, eax
jne 0x1800204f7
mov dword [rsp + 0x128], edi
jmp 0x18002050f
cmp eax, 1
jne 0x18002050f
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x128]
call qword [sym.imp.kERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.kERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.kERNEL32.dll_CloseHandle]
jmp 0x180020534
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov dword [rsp + 0x128], eax
test rbx, rbx
je 0x18002054b
mov rcx, qword [0x180035a68]
mov r8, rbx
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x128]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180020894
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rax + 0x10], 1
cmp dword [rdx + 0x48], esi
jne 0x1800208c6
mov eax, dword [rdx + 0x60]
test al, 0x40
je 0x180020a32
mov eax, dword [rdx + 0x60]
test al, 1
je 0x180020a16
mov eax, dword [rdx + 0x60]
test al, 6
jne 0x18002096f
mov eax, dword [rdx + 0x60]
test al, 0x40
jne 0x180020967
or dword [rsp + 0xa8], 0xffffffff
cmp dword [rdx + 0x48], esi
je 0x180020984
mov r8d, dword [rbx + 0x48]
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 8]
mov r10, qword [rcx]
sub eax, r8d
lea r9, [rsp + 0xa8]
movsxd rdx, eax
add rdx, qword [rbx + 0x3c]
call qword [r10 + 0x20]
mov r11, qword [rdi + 8]
mov rdx, qword [rbx + 0x3c]
mov rcx, qword [rdi]
xor r9d, r9d
mov r8d, 0x4000
call qword [r11 + 8]
cmp eax, esi
mov dword [rbx + 0x44], eax
jle 0x180020940
mov dword [rbx + 0x48], eax
jmp 0x180020960
je 0x180020957
mov ecx, dword [0x18003416c]
cmp ecx, 0xffffffff
je 0x18002095a
call qword [sym.imp.kERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x18002095a
mov dword [rbx + 0x4c], esi
mov dword [rbx + 0x44], esi
mov dword [rbx + 0x48], esi
cmp dword [rbx + 0x48], esi
jne 0x1800208f8
jmp 0x18002097b
mov dword [rdx + 0x4c], esi
mov dword [rdx + 0x48], esi
jmp 0x18002097b
call fcn.18000951c
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], esi
jge 0x18002098f
mov eax, dword [rbx + 0x60]
test al, 0x40
je 0x180020a32
mov edx, dword [rbx + 0x5c]
mov ecx, dword [rdi + 0x1c]
mov rax, qword [rbx + 0x64]
mov r9, qword [rbx + 0x30]
mov r8, qword [rbx + 0x10]
not edx
and edx, 0x100
and ecx, 0x80
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, qword [rbx + 8]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbx + 0x74]
call fcn.180025828
lea rdx, [rsp + 0x40]
mov r8d, 1
mov dword [rbx + 0x5c], eax
bts dword [rbx + 0x5c], 8
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x60]
cmp dword [rsp + 0x50], esi
jne 0x1800209f1
cmp dword [rbx + 0x4c], esi
jne 0x1800209f9
mov rcx, rbx
call fcn.18000bd58
mov eax, dword [rbx + 0x5c]
test al, 1
jne 0x180020a0c
mov eax, dword [rbx + 0x60]
test al, 2
jne 0x180020a32
cmp dword [rbx + 0x4c], esi
jne 0x180020a32
mov rcx, rbx
call fcn.18000bd58
jmp 0x180020a32
mov r8d, dword [rdx + 0x48]
mov eax, dword [rdx + 0x44]
mov rcx, qword [rbx]
sub eax, r8d
movsxd rdx, eax
add rdx, qword [rbx + 0x3c]
call fcn.180007870
mov dword [rbx + 0x48], esi
mov eax, dword [rsp + 0xa8]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180020b90
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180035c60]
lea rdi, [0x180000000]
xor ebx, ebx
lea rcx, [rax + rdi + 0x39794]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180020d57
call qword [sym.imp.kERNEL32.dll_TlsAlloc]
mov dword [0x180035bb0], eax
cmp eax, 0xffffffff
je 0x180020d5c
cmp byte [0x180035c70], 6
ja 0x180020c4d
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x39ce8]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x399aa]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x39cf7]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x39c5a]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x39817]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rax, qword [0x180035c60]
lea rcx, [rax + rdi + 0x39cf0]
call qword [sym.imp.kERNEL32.dll_LoadLibraryA]
mov rdx, qword [0x180035c60]
lea rcx, [0x180034a70]
mov r8d, 0xc
mov rax, qword [rcx]
add qword [rax], rdx
mov rax, qword [rcx]
add rcx, 0x18
add qword [rax + 8], rdx
sub r8, 1
jne 0x180020c76
lea rcx, [rdx + rdi + 0x3995a]
call fcn.18002cb8c
mov r11, qword [0x180035bd0]
xor r8d, r8d
or dword [r11 + 0x34], 1
lea edx, [r8 + 0xc]
lea rcx, [0x180034a70]
call fcn.18000e7f8
mov ebx, eax
test eax, eax
je 0x180020ccf
cmp dword [0x180035bcc], 0x40214d1e
jne 0x180020d5c
mov rcx, qword [0x180035c68]
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.180024e84
mov ebx, eax
test eax, eax
jne 0x180020d44
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180020d30
mov rdi, qword [rsp + 0x38]
mov rsi, rax
mov rax, qword [0x180035c78]
cmp qword [rdi], rax
je 0x180020d26
mov r8, qword [rdi]
lea rcx, [0x180034950]
mov edx, 0xc
call fcn.18000e7f8
add rdi, 8
sub rsi, 1
jne 0x180020d06
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x180035a68]
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
lea rcx, [0x180034a70]
mov edx, 0xc
call fcn.180006004
jmp 0x180020d5c
mov ebx, 0x7e
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180020f74
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x180020fd9
cmp eax, 0xffffffff
jne 0x180020fcc
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x180020fde
mov ecx, 0x64
call qword [sym.imp.kERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x180020fd3
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x180020fde
jmp 0x180020f93
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180021c14
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12d, r8d
mov r13d, edx
mov r14, rcx
mov rbx, qword [0x180035b08]
lea rcx, [rsp + 0x20]
call qword [sym.imp.kERNEL32.dll_GetSystemTimeAsFileTime]
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
bswap r11d
bswap eax
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], r11d
test rbx, rbx
je 0x180021c7a
mov rcx, rbx
call qword [sym.imp.kERNEL32.dll_lstrlenA]
mov edi, eax
jmp 0x180021c7c
xor edi, edi
mov rcx, qword [0x180035a68]
lea ebp, [rdi + 1]
xor edx, edx
mov r8d, ebp
add r8, 0x13
call qword [sym.imp.kERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180021d33
test rbx, rbx
je 0x180021cf1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.kERNEL32.dll_lstrcpyA]
mov rcx, rsi
call fcn.180011ae0
mov rbx, rax
test rax, rax
je 0x180021ce9
xor edx, edx
mov rcx, rax
call qword [sym.imp.kERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180021cd7
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov rcx, qword [0x180035a68]
mov r8, rbx
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
mov eax, edi
mov edi, ebp
mov byte [rax + rsi], 0x5c
mov ebx, edi
lea rcx, [rsp + 0x20]
mov edx, 9
add rbx, rsi
mov r8, rbx
call fcn.18002a668
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
mov rcx, rsi
mov byte [rbx + 0x12], 0
call fcn.180014f78
mov rcx, qword [0x180035a68]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.kERNEL32.dll_HeapFree]
jmp 0x180021d38
mov ebx, 8
cmp ebx, 0x50
je 0x180021c3a
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x180022540
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, edx
mov r14, rcx
cmp edx, 0x1000
jbe 0x180022717
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
xor esi, esi
mov rbp, rax
cmp rax, rsi
je 0x180022717
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x88]
call fcn.1800057a8
mov ebx, eax
cmp eax, esi
jne 0x18002271c
mov rdi, qword [0x180035a88]
cmp rdi, rsi
je 0x1800225be
mov rcx, rdi
call qword [sym.imp.kERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x28]
cmp rcx, rsi
je 0x1800225be
call qword [sym.imp.kERNEL32.dll_CloseHandle]
mov qword [rdi + 0x28], rsi
mov eax, 0x2000
lea r12, [0x180000000]
test word [rbp + 0x16], ax
mov rax, qword [0x180035c60]
lea r15, [rax + r12 + 0x3ae78]
jne 0x1800225e7
lea r15, [rax + r12 + 0x3ae68]
mov rsi, qword [rsp + 0x88]
mov rdx, qword [0x180035f48]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov r9, r14
mov r8, r15
mov dword [rsp + 0x20], r13d
call fcn.18001dd90
mov ebx, eax
test eax, eax
je 0x18002267a
mov rcx, qword [0x180035ca0]
xor edx, edx
mov rcx, qword [rcx + 0xd8]
call fcn.180012060
xor ecx, ecx
cmp rax, rcx
je 0x180022670
mov qword [0x180035f48], rax
mov eax, dword [rsp + 0x78]
mov r9, r14
mov word [rsi + rax*2], cx
mov rdx, qword [0x180035f48]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov r8, r15
mov rcx, rsi
mov dword [rsp + 0x20], r13d
call fcn.18001dd90
mov ebx, eax
xor r13d, r13d
cmp ebx, r13d
jne 0x1800226f0
jmp 0x18002267d
xor r13d, r13d
cmp rdi, r13
je 0x18002268e
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x28], rax
mov eax, 0x2000
test word [rbp + 0x16], ax
je 0x1800226bf
mov rax, qword [0x180035c60]
mov rcx, rsi
lea rdx, [rax + r12 + 0x3a64d]
call fcn.1800258f8
mov rbp, rax
cmp rax, r13
jne 0x1800226c5
mov ebx, 8
jmp 0x1800226c5
mov rbp, rsi
mov rsi, r13
cmp ebx, r13d
jne 0x1800226f0
mov edx, 1
mov rcx, rbp
call fcn.18000df20
mov ebx, eax
cmp rbp, rsi
je 0x1800226f0
mov rcx, qword [0x180035a68]
mov r8, rbp
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
cmp rdi, r13
je 0x1800226fe
mov rcx, rdi
call qword [sym.imp.kERNEL32.dll_LeaveCriticalSection]
cmp rsi, r13
je 0x18002271c
mov rcx, qword [0x180035a68]
mov r8, rsi
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
jmp 0x18002271c
mov ebx, 0xb
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180022734
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.kERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
je 0x18002279b
mov rcx, qword [0x180035a68]
lea r8d, [rax + rax]
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18002279b
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.kERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x18002279b
mov rcx, qword [0x180035a68]
mov r8, rbx
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800227b0
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, rdx
mov rdi, rcx
xor ebx, ebx
lea r8d, [rbx + 0x10]
xor edx, edx
mov rcx, rbp
call sub.ntdll.dll_memset
lea r11d, [rbx + 2]
mov rcx, rdi
mov word [rbp], r11w
call qword [sym.imp.kERNEL32.dll_lstrlenA]
mov rcx, qword [0x180035a68]
lea r12d, [rbx + 1]
xor edx, edx
lea r8d, [r12 + rax]
call qword [sym.imp.kERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, rbx
je 0x180022898
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy
lea edx, [rbx + 0x3a]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrA]
mov rdi, rax
cmp rax, rbx
jne 0x180022838
mov rdi, rsi
jmp 0x18002283d
mov byte [rax], bl
add rdi, r12
cmp rdi, rbx
je 0x180022857
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 2], ax
cmp rdi, rsi
je 0x18002287b
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
cmp rax, rbx
je 0x180022886
mov rax, qword [rax + 0x18]
mov ebx, r12d
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp + 4], eax
jmp 0x180022886
cmp word [rbp + 2], bx
mov dword [rbp + 4], ebx
cmovne ebx, r12d
mov rcx, qword [0x180035a68]
mov r8, rsi
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1800228bc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov dword [r11 + 0x20], r9d
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
lea rax, [r11 + 0x20]
lea r9d, [rbx + 0x40]
lea r8d, [rbx + 4]
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x28], rax
call qword [sym.imp.kERNEL32.dll_VirtualProtectEx]
cmp eax, ebx
je 0x180022946
lea rax, [rsp + 0x30]
lea r9d, [rbx + 4]
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180017e74
cmp eax, ebx
je 0x180022925
cmp qword [rsp + 0x30], 4
lea eax, [rbx + 1]
cmove ebx, eax
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov r8d, 4
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.kERNEL32.dll_VirtualProtectEx]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180022ab8
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov ebp, 0x57
mov rdi, rcx
mov ebx, ebp
call fcn.18000f86c
xor r12d, r12d
cmp eax, r12d
je 0x180022cd5
cmp dword [rcx + 0x10], r12d
je 0x180022cd5
mov rcx, qword [rcx]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
lea esi, [rbp - 0x4c]
cmp rax, r12
je 0x180022b2d
mov rax, qword [0x180035ca0]
mov r9d, dword [rdi + 0x10]
mov r8, qword [rdi]
mov rdx, qword [rax + 0x90]
mov rcx, qword [0x180035bf0]
mov dword [rsp + 0x20], 1
call fcn.18000fa7c
mov ebx, eax
jmp 0x180022b2f
mov ebx, esi
cmp ebx, r12d
jne 0x180022cd5
cmp dword [rdi + 0x14], r12d
je 0x180022b7f
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp rax, r12
je 0x180022b7b
mov rax, qword [0x180035ca0]
mov r9d, dword [rdi + 0x14]
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 0x98]
mov rcx, qword [0x180035bf0]
mov dword [rsp + 0x20], 1
call fcn.18000fa7c
mov ebx, eax
jmp 0x180022b81
mov ebx, esi
jmp 0x180022b81
mov ebx, ebp
cmp ebx, r12d
jne 0x180022cd5
mov rdi, qword [0x180035a88]
mov qword [rsp + 0x60], r12
cmp rdi, r12
je 0x180022ba4
mov rcx, rdi
call qword [sym.imp.kERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x180035c60]
lea rbp, [0x180000000]
lea r8, [rsp + 0x68]
lea rdx, [rax + rbp + 0x3920a]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
cmp eax, r12d
jne 0x180022cc7
mov r8, qword [0x180035f40]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.18001df64
cmp eax, r12d
je 0x180022c1d
cmp rdi, r12
je 0x180022c18
mov rcx, qword [rdi + 0x30]
cmp rcx, r12
je 0x180022c18
xor edx, edx
call fcn.18002b3b0
mov rsi, rax
jmp 0x180022c22
mov rsi, r12
jmp 0x180022c22
mov rsi, qword [rsp + 0x60]
cmp rsi, r12
je 0x180022cb7
cmp rdi, r12
je 0x180022c43
mov rcx, qword [rdi + 0x28]
cmp rcx, r12
je 0x180022c43
call qword [sym.imp.kERNEL32.dll_CloseHandle]
mov qword [rdi + 0x28], r12
mov rax, qword [0x180035c60]
mov rcx, rsi
lea rdx, [rax + rbp + 0x3add0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, r12
je 0x180022c75
mov rcx, qword [0x180035c60]
add rax, 0x12
lea rbp, [rcx + rbp + 0x3add0]
jmp 0x180022c93
mov edx, 0x20
mov rcx, rsi
mov rbp, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, r12
je 0x180022c93
mov word [rax], r12w
add rax, 2
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.1800040ec
mov rcx, qword [0x180035a68]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.kERNEL32.dll_HeapFree]
jmp 0x180022cbc
mov ebx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rdi, r12
je 0x180022cd5
mov rcx, rdi
call qword [sym.imp.kERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret