joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0140
Capabilities:
Enumerate processes
Initialize winsock library
Terminate process

Disassembly:
push rbx
sub rsp, 0x1c0
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
mov eax, dword [0x1402569a0]
test eax, eax
je 0x1400d0180
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x1400d01ac
add rsp, 0x1c0
pop rbx
ret
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400d01b1
mov rcx, qword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.140001400
mov dword [0x1402569a0], 1
jmp 0x1400d0166
call fcn.1401d96b0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.unable_to_initialize_winsock_subsystem__error__d
mov edx, eax
call fcn.1400b6950
nop
nop word cs:[rax + rax]

Function at 0x1400d01d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [0x14022c040]
xor r8d, r8d
mov rbp, qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
lea r14, [rsp + 0x50]
lea r13, [rsp + 0x4c]
mov rsi, rcx
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
lea r12, [rsp + 0x54]
mov rdx, rcx
mov r9, r14
xor ecx, ecx
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
call rbp
mov ecx, dword [rsp + 0x54]
mov eax, dword [rsp + 0x50]
add rcx, rax
call fcn.1400bd0a0
mov edx, dword [rsp + 0x54]
xor ecx, ecx
mov r9, r14
mov qword [rbx], rax
lea r8, [rax + rdx]
mov qword [rsp + 0x30], r13
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rbp
mov rcx, qword [rbx]
mov esi, eax
test eax, eax
je 0x1400d02a0
mov eax, dword [rsp + 0x54]
mov byte [rcx + rax], 0x2f
mov rax, qword [rsp + 0x58]
sub rax, qword [rdi]
jne 0x1400d02ae
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.1400eaf30
mov qword [rbx], 0
jmp 0x1400d0280
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop
Function at 0x1400d02c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
mov eax, 0x10178
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rsi, qword [0x14022c040]
mov r13d, 1
mov rdx, qword [rsi]
mov qword [rsp + 0x10168], rdx
xor edx, edx
mov qword [rsp + 0x28], rcx
mov rdi, rcx
mov ecx, 2
lea rbx, [rsp + 0x30]
lea rbp, [rsp + 0x160]
lea rsi, [rsp + 0x15c]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x160], eax
xor eax, eax
mov ecx, 0x26
mov rdi, rbx
mov rdx, rbx
rep stosq qword [rdi], rax
mov rcx, r12
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400d04a9
mov r14d, r13d
mov rdi, rbp
mov r15, rsi
nop
movsxd rcx, r14d
lea edx, [r14 - 1]
mov r8d, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x50]
shl rcx, 2
shl rdx, 2
lea rax, [rbp + rcx]
add rcx, rsi
sub rcx, rdx
nop word cs:[rax + rax]
nop
mov edx, dword [rax - 4]
cmp edx, r8d
je 0x1400d03b5
cmp edx, r9d
jne 0x1400d03ac
movsxd rdx, r14d
add r14d, 1
mov dword [rsp + rdx*4 + 0x160], r8d
sub rax, 4
cmp rax, rcx
jne 0x1400d0390
cmp r14d, 0x3fff
jg 0x1400d03f1
mov rdx, rbx
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400d0360
cmp r13d, r14d
je 0x1400d04a9
mov r13d, r14d
jmp 0x1400d032d
mov r14d, r13d
lea rdi, [rsp + 0x160]
lea r15, [rsp + 0x15c]
movsxd rax, r14d
mov r12, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
shl rax, 2
lea rsi, [r15 + rax]
add rdi, rax
lea eax, [r14 - 2]
mov r14, qword [sym.imp.KERNEL32.dll_TerminateProcess]
shl rax, 2
mov r15d, 0xffffffff
sub rsi, rax
nop word [rax + rax]
mov r8d, dword [rdi - 4]
xor edx, edx
mov ecx, 1
call r12
mov rbx, rax
test rax, rax
je 0x1400d045d
mov rcx, rax
mov edx, 0x8f
call r14
mov rcx, rbx
test eax, eax
cmove ebp, r15d
call r13
sub rdi, 4
cmp rdi, rsi
jne 0x1400d0430
mov rcx, qword [rsp + 0x28]
mov edx, 0x8f
call r14
test eax, eax
je 0x1400d04d0
mov rcx, qword [rsp + 0x28]
call r13
mov rdi, qword [0x14022c040]
mov rax, qword [rsp + 0x10168]
sub rax, qword [rdi]
jne 0x1400d04c5
mov eax, ebp
add rsp, 0x10178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r13d, 1
jne 0x1400d03de
mov r14, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x1400d0466
call fcn.1401d96b0
nop word [rax + rax]
mov ebp, 0xffffffff
jmp 0x1400d0477
Function at 0x1400d0e20
Capabilities:
Delete file
Get file attributes

Disassembly:
push r12
mov eax, 0x2090
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rbp, qword [0x14022c040]
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rbp]
mov qword [rsp + 0x2088], rcx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x410
cmp eax, 0x400
je 0x1400d0e90
mov eax, 1
mov rdx, qword [rsp + 0x2088]
sub rdx, qword [rbp]
jne 0x1400d1054
add rsp, 0x2090
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rsi
call sub.msvcrt.dll_wcslen
movzx ecx, word [rdi]
mov rbx, rax
cmp cx, 0x2f
je 0x1400d0eef
cmp cx, 0x5c
je 0x1400d0eef
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x1400d0ec3
cmp word [rdi + 2], 0x3a
je 0x1400d1020
test rbx, rbx
je 0x1400d0eef
nop dword [rax + rax]
movzx eax, word [rsi + rbx*2 - 2]
cmp ax, 0x2f
je 0x1400d0fa8
cmp ax, 0x5c
je 0x1400d0fa8
sub rbx, 1
jne 0x1400d0ed0
mov rcx, rdi
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 7
xor edx, edx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d0f80
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400d0ff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [rsp + 0x40], 0x10
je 0x1400d0e61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400d0f80
mov r8d, dword [0x1401e4950]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
je 0x1400d0f80
mov eax, 2
jmp 0x1400d0e66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
xor eax, eax
jmp 0x1400d0e66
mov rcx, rdi
call sub.msvcrt.dll_wcslen
lea rax, [rbx + rax + 1]
cmp rax, 0x1000
ja 0x1400d103d
lea r12, [rsp + 0x80]
add rbx, rbx
mov rdx, rsi
mov r8, rbx
mov rcx, r12
call sub.msvcrt.dll_memcpy
lea rcx, [r12 + rbx]
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, r12
jmp 0x1400d0ef2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rsi, rax
call fcn.1400d0b80
mov rcx, rbx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400d0e66
movzx eax, word [rdi + 4]
cmp ax, 0x2f
je 0x1400d0eef
cmp ax, 0x5c
jne 0x1400d0ec3
jmp 0x1400d0eef
mov r8, rsi
mov rdx, rdi
lea rcx, str.Could_not_make__ls_relative_to__ls__too_large_
call fcn.1400b6bf0
jmp 0x1400d0e61
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400d10f0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov ecx, eax
or edx, 2
and ecx, 0xfffffffd
test esi, esi
cmove edx, ecx
cmp edx, eax
je 0x1400d1121
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400d1130
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400d1123

Function at 0x1400d1510
Capabilities:
Get disk information

Disassembly:
push r15
mov eax, 0x2058
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rbp, qword [0x14022c040]
mov rdi, r8
mov r12d, ecx
mov rsi, rdx
mov r8, qword [rbp]
mov qword [rsp + 0x2048], r8
mov r8d, edi
call sub.msvcrt.dll__write
movsxd rbx, eax
test rbx, rbx
js 0x1400d1580
mov rax, qword [rsp + 0x2048]
sub rax, qword [rbp]
jne 0x1400d16c8
mov rax, rbx
add rsp, 0x2058
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [sym.imp.msvcrt.dll__errno]
call r13
cmp dword [rax], 0x16
jne 0x1400d15d0
test rsi, rsi
je 0x1400d1555
call r13
mov ecx, r12d
mov r15d, dword [rax]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r14, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1400d15f0
cmp r15d, 0x16
je 0x1400d1660
call r13
mov dword [rax], r15d
jmp 0x1400d1555
call r13
cmp dword [rax], 9
je 0x1400d158f
call r13
cmp dword [rax], 0x1c
jne 0x1400d1555
jmp 0x1400d158f
cmp r15d, 0x16
je 0x1400d1648
call r13
cmp dword [rax], 9
je 0x1400d1648
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x3c]
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
test eax, eax
je 0x1400d16b0
mov eax, dword [rsp + 0x3c]
mov r8, rax
cmp rax, rdi
jae 0x1400d15be
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll__write
movsxd rbx, eax
jmp 0x1400d1555
call r13
mov dword [rax], 0x20
jmp 0x1400d1555
lea rsi, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
sub eax, 1
cmp eax, 0xffe
ja 0x1400d15be
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x1400d169f
cmp eax, 4
jne 0x1400d15be
lea rcx, str.invalid_write_operation_detected__you_may_try:_n_n_tgit_config_windows.appendAtomically_false
call fcn.1400b6cc0
jmp 0x1400d15be
mov dword [rsp + 0x3c], 0x1000
mov eax, 0x1000
mov r8d, 0x1000
jmp 0x1400d1629
call fcn.1401d96b0
nop
nop

Function at 0x1400d17f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov edx, 0x180
jmp fcn.1400bdcf0
Function at 0x1400d1800
Capabilities:
Create pipe
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x14022c040]
mov rsi, rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movabs rax, 0xd6bf94d5e57a42bd
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x20]
imul rcx
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
movabs rax, 0x6666666666666667
mov dword [rsi], edx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul rcx
sar rcx, 0x3f
sar rdx, 2
sub rdx, rcx
mov dword [rsi + 4], edx
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x1400d188a
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
call fcn.1401d96b0
nop

Function at 0x1400d1890
Capabilities:
Create pipe
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14022c040]
xor r8d, r8d
mov r9d, 0x2000
mov rbx, rcx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400d1910
movsxd rcx, dword [rsp + 0x20]
mov rdi, qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx], eax
test eax, eax
js 0x1400d1931
movsxd rcx, dword [rsp + 0x28]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx + 4], eax
test eax, eax
js 0x1400d1948
xor eax, eax
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rsi]
jne 0x1400d195c
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400d18f4
mov rcx, qword [rsp + 0x20]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x28]
call rbx
jmp 0x1400d192a
mov ecx, dword [rbx]
call sub.msvcrt.dll__close
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d192a
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d1970
Capabilities:
Create thread
Get hostname

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
test rcx, rcx
mov rbx, rcx
setg al
cmp edx, 0xf
jne 0x1400d199b
test al, al
jne 0x1400d19e8
test edx, edx
jne 0x1400d1b38
test al, al
je 0x1400d1b38
mov ecx, 0x400
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
test rax, rax
je 0x1400d1b38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsi]
jne 0x1400d1bdb
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov ecx, 0x43b
call rbp
mov rdi, rax
test rax, rax
je 0x1400d1ae0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400d19cb
cmp dword [rsp + 0x40], 0x103
jne 0x1400d19cb
mov eax, dword [0x140256bd0]
test eax, eax
je 0x1400d1b50
mov rax, qword [0x140256bc8]
test rax, rax
je 0x1400d1af8
mov eax, dword [0x1401e4820]
cmp eax, 0xffffffff
je 0x1400d1b88
cmp eax, 0xfffffffe
je 0x1400d1af8
lea rbx, [rsp + 0x44]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400d1af8
mov eax, dword [0x1401e4820]
cmp dword [rsp + 0x44], eax
jne 0x1400d1af8
mov rcx, rdi
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9, qword [0x140256bc8]
mov qword [rsp + 0x20], 0x8f
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
test rax, rax
je 0x1400d1af8
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400d1af8
mov rcx, rdi
call rbx
jmp 0x1400d19cb
mov r8d, ebx
xor edx, edx
mov ecx, 1
call rbp
mov rdi, rax
test rax, rax
je 0x1400d1bbc
mov rcx, rdi
call fcn.1400d02c0
test eax, eax
je 0x1400d19cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, ebp
mov rbx, rax
call fcn.1400d0b80
mov rcx, rdi
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400d19cd
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400d1b2b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
je 0x1400d1be0
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x140256bd0], 1
mov qword [0x140256bc8], rax
jmp 0x1400d1a38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [0x1401e4820]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400d1bad
mov eax, dword [0x1401e4820]
jmp 0x1400d1a50
mov dword [0x1401e4820], 0xfffffffe
jmp 0x1400d1af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
jmp 0x1400d1b2b
call fcn.1401d96b0
lea rcx, str.BUG:_cannot_find_kernel32
call fcn.1400b6950
nop
nop dword [rax]
Function at 0x1400d1bf0
Capabilities:
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
call fcn.1400d0140
mov rcx, rbx
mov edx, esi
call qword [sym.imp.WS2_32.dll_gethostname]
mov ebx, eax
test eax, eax
js 0x1400d1c20
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
ja 0x1400d1c40
lea rdx, [0x140205fc0]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400d1cd0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rbp, r9
call fcn.1400d0140
mov rcx, rbx
mov r9, rbp
mov r8, rdi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
js 0x1400d1d10
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
ja 0x1400d1d30
lea rdx, [0x140205fc0]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400d1e00
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, r8
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, rbx
mov r8d, esi
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test eax, eax
js 0x1400d1e30
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
ja 0x1400d1e50
lea rdx, [0x140205fc0]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400d1ee0
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov ebx, edx
mov esi, r8d
mov rdi, r9
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov edx, ebx
mov r9, rdi
mov r8d, esi
mov rcx, rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
test eax, eax
js 0x1400d1f20
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
ja 0x1400d1f40
lea rdx, [0x140205fc0]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400d20e0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x14022c040]
mov rcx, qword [rbx]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
jne 0x1400d2113
add rsp, 0x60
pop rbx
ret
call fcn.1401d96b0
nop
nop dword [rax]
Function at 0x1400d2120
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
test r8, r8
jne 0x1400d2298
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400d2160
cmp eax, dword [rbx]
je 0x1400d21b0
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer:_it_interval_must_be_zero_or_eq_it_value
mov dword [rax], 0x16
call fcn.1400b6bf0
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov ecx, dword [rdx + 0xc]
test ecx, ecx
jne 0x1400d2138
cmp qword [0x140256d10], 0
je 0x1400d2179
call fcn.1400cfe40
mov eax, dword [rbx + 8]
mov ecx, dword [rbx]
test ecx, ecx
je 0x1400d21c8
movsxd rdx, dword [rbx + 4]
imul ecx, ecx, 0x3e8
mov r8, rdx
imul rdx, rdx, 0x10624dd3
sar r8d, 0x1f
sar rdx, 0x26
sub edx, r8d
add edx, ecx
mov dword [0x140256d0c], edx
test eax, eax
je 0x1400d21e8
xor eax, eax
jmp 0x1400d21f3
mov ecx, dword [rbx + 4]
cmp dword [rbx + 0xc], ecx
jne 0x1400d213c
cmp qword [0x140256d10], 0
jne 0x1400d2171
jmp 0x1400d2179
mov edx, dword [rbx + 4]
test edx, edx
jne 0x1400d217f
test eax, eax
je 0x1400d22b5
mov dword [0x140256d0c], 0
xor eax, eax
jmp 0x1400d21f3
mov eax, dword [rbx + 0xc]
test eax, eax
sete al
movzx eax, al
mov dword [0x140256d08], eax
mov eax, dword [0x140256110]
test eax, eax
je 0x1400d2260
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x140256d18], rax
test rax, rax
je 0x1400d22cb
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x1400d0730]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [0x140256d10], rax
test rax, rax
je 0x1400d2278
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rcx, [fcn.1400cfe40]
call fcn.140001400
mov dword [0x140256110], 1
jmp 0x1400d2203
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_start_timer_thread
mov dword [rax], 0xc
call fcn.1400b6bf0
jmp 0x1400d2154
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer_param_3___NULL_not_implemented
mov dword [rax], 0x16
call fcn.1400b6bf0
jmp 0x1400d2154
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400d2254
mov dword [0x140256d0c], 0
jmp 0x1400d21eb
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_allocate_resources_for_timer
mov dword [rax], 0xc
call fcn.1400b6bf0
jmp 0x1400d2154

Function at 0x1400d2380
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
cmp ecx, 2
je 0x1400d23c0
cmp ecx, 0xe
jne 0x1400d23b0
mov rax, qword [0x140256d00]
test rax, rax
je 0x1400d23e0
cmp rax, 1
je 0x1400d23a7
mov ecx, 0xe
call rax
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1401dec18
mov rax, qword [0x140256cf8]
test rax, rax
je 0x1400d240c
cmp rax, 1
je 0x1400d23a7
mov ecx, 2
call rax
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call fcn.1400da6f0
test eax, eax
jne 0x1400d242a
lea rcx, str.compat_mingw.c
mov r8d, 0x8e
mov edx, 0xbbc
call fcn.140009c20
mov ecx, eax
call sub.msvcrt.dll_exit
lea rcx, str.compat_mingw.c
mov r8d, 0x82
mov edx, 0xbc3
call fcn.140009c20
mov ecx, eax
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.1401de8b0]
mov r8d, 0xc
mov edx, 1
lea rcx, str.Alarm_clock_n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x1400d23ee
jmp qword [sym.imp.msvcrt.dll_raise]
Function at 0x1400d2a40
Capabilities:
Set environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test rcx, rcx
je 0x1400d2a55
cmp byte [rcx], 0
jne 0x1400d2a60
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_strlen
mov edx, 2
lea ebp, [rax + rax + 1]
movsxd rdi, ebp
mov rcx, rdi
call fcn.1400eb230
mov rsi, rax
test rax, rax
je 0x1400d2aff
mov rdx, rbx
mov rcx, rax
mov r9d, 0xffffffff
mov r8, rdi
call fcn.1400d25c0
mov edx, 0x3d
mov rcx, rsi
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400d2af0
xor edx, edx
mov rcx, rsi
mov word [rax], dx
lea rdx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
mov rcx, rsi
call fcn.1400eaf30
test ebx, ebx
jne 0x1400d2a55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400d2a57
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400d2abb
mov edx, ebp
lea rcx, str.Out_of_memory___tried_to_allocate__u_wchar_ts_
call fcn.1400b6950
nop
nop