joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d0c8
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0xa0
xor ebx, ebx
mov r14, r8
mov r13, rdx
mov r12d, ecx
lea rdi, [0x1800576b4]
mov esi, ebx
cmp dword [rdi - 4], r12d
jne 0x18001d13b
cmp dword [rdi], ebx
je 0x18001d14c
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov ebp, eax
jle 0x18001d14c
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, ebp
call fcn.180044c10
cmp eax, dword [rdi]
je 0x18001d14c
inc esi
add rdi, 0x14
cmp esi, 3
jae 0x18001d215
jmp 0x18001d0fc
mov eax, esi
lea rbp, [0x1800576b0]
lea rdi, [rax + rax*4]
cmp dword [rbp + rdi*4 + 0xc], ebx
je 0x18001d196
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18001d196
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180044c10
cmp eax, dword [rbp + rdi*4 + 0xc]
jne 0x18001d215
cmp dword [rbp + rdi*4 + 8], ebx
je 0x18001d1d3
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov esi, eax
jle 0x18001d1d3
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180044c10
cmp eax, dword [rbp + rdi*4 + 8]
jne 0x18001d215
cmp dword [rbp + rdi*4 + 0x10], ebx
je 0x18001d210
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18001d210
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180044c10
cmp eax, dword [rbp + rdi*4 + 0x10]
jne 0x18001d215
mov ebx, 1
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x18001d23c
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x180
xor r13d, r13d
mov edi, r8d
mov rbp, rcx
mov ebx, edx
lea rcx, [rsp + 0x4c]
lea r8d, [r13 + 0x26]
xor edx, edx
mov r12d, r9d
mov esi, r13d
mov dword [rsp + 0x48], r13d
call sub.ntdll.dll_memset
cmp ebx, 0x100
jne 0x18001d42d
lea r8d, [r13 + 0x2a]
lea rcx, [rsp + 0x48]
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, ebx
call sub.ntdll.dll_memset
lea edx, [r13 + 3]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetAncestor]
mov ebx, dword [rsp + 0x1c8]
mov ecx, dword [rsp + 0x1d0]
mov r8, rax
cmp rax, r13
mov eax, dword [rsp + 0x1c0]
cmove r8, rbp
mov rdx, rbp
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r8
call fcn.18001d0c8
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
cmp eax, r13d
je 0x18001d42d
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, 0xa0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xa1
mov r11w, ax
shr r11, 8
mov byte [rsp + 0x120], r11b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ecx, [r13 + 0x10]
mov r11w, ax
shr r11, 8
mov byte [rsp + 0x121], r11b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x30], rbx
mov r11w, ax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
shr r11, 8
mov edx, r12d
mov ecx, edi
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x40], r13w
mov byte [rsp + 0x90], r11b
mov dword [rsp + 0x20], 3
call qword [sym.imp.USER32.dll_ToUnicodeEx]
lea esi, [r13 + 1]
cmp eax, 0xffffffff
je 0x18001d42d
cmp eax, r13d
je 0x18001d3d2
movsxd rdi, eax
mov rbx, r13
cmp rdi, r13
jle 0x18001d42d
movzx eax, word [rsp + rbx*2 + 0x40]
lea rcx, [rsp + 0x48]
mov word [rsp + 0x68], ax
call fcn.18001cb4c
add rbx, rsi
cmp rbx, rdi
jl 0x18001d3b4
jmp 0x18001d42d
sub edi, 8
mov ax, r13w
je 0x18001d413
sub edi, esi
je 0x18001d40c
sub edi, 0x1c
je 0x18001d405
sub edi, esi
je 0x18001d3fe
sub edi, esi
je 0x18001d3f7
cmp edi, esi
jne 0x18001d418
mov eax, 0x2193
jmp 0x18001d418
mov eax, 0x2192
jmp 0x18001d418
mov eax, 0x2191
jmp 0x18001d418
mov eax, 0x2190
jmp 0x18001d418
mov eax, 0x2423
jmp 0x18001d418
mov eax, 0x21d0
mov word [rsp + 0x68], ax
cmp ax, r13w
je 0x18001d42d
lea rcx, [rsp + 0x48]
call fcn.18001cb4c
mov r8, qword [rsp + 0x6a]
cmp r8, r13
je 0x18001d446
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x180]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18001d578
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x50
and dword [rax - 0x38], 0
xor edx, edx
lea rcx, [rax - 0x34]
lea r8d, [rdx + 0x26]
call sub.ntdll.dll_memset
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x18001d690
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov rbp, rax
test rax, rax
je 0x18001d690
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18001d690
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x18001d68a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x18001d681
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x2a]
mov ebx, eax
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x60]
mov edx, 3
mov dword [rsp + 0x20], ecx
mov rcx, rbp
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_GetAncestor]
mov rcx, qword [0x180059270]
lea r8d, [rbx + rbx + 2]
xor edx, edx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x42], rax
test rax, rax
je 0x18001d677
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
call fcn.18001cb4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18001efa0
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and dword [rax + 0x20], 0
mov rsi, rcx
mov rcx, qword [0x180059270]
mov rbp, rdx
mov edi, 8
xor edx, edx
lea r8d, [rdi + 0x49]
mov dword [rax - 0x20], 1
mov dword [rax - 0x1c], 0x2710
mov dword [rax - 0x18], 0x3e8
mov dword [rax - 0x28], 0x493e0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18001f0f7
lea r8d, [rdi + 0x49]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rdi + 4]
lea r8, [rsp + 0x58]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x18], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x18001f0ef
cmp dword [rsi + 0x54], eax
je 0x18001f090
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x18001f0ef
mov rdx, rbp
mov rcx, rbx
call qword [rsi + 0x40]
mov edi, eax
test eax, eax
jne 0x18001f0ef
lea rcx, [rsi + 0x10]
mov qword [rbx + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8d, [rdi + 0x10]
lea rcx, [0x18001ebd0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x18001f0d9
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rsi + 8], rbx
jmp 0x18001f0e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x18001f0f7
mov rcx, rbx
call fcn.18001eb6c
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001f384
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x18001f3e9
cmp eax, 0xffffffff
jne 0x18001f3dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x18001f3ee
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x18001f3e3
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x18001f3ee
jmp 0x18001f3a3
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001f408
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
xor esi, esi
mov r12, r9
mov rbp, r8
mov r13, rdx
test r9, r9
jne 0x18001f43b
lea edi, [rsi + 0x57]
jmp 0x18001f59e
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test eax, eax
jne 0x18001f573
mov rcx, qword [0x180059270]
mov edi, 0x8c
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18001f47f
lea edi, [rsi + 7]
jmp 0x18001f590
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x18001f580
mov qword [rbx + 0x70], rbp
test rbp, rbp
jne 0x18001f4f8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
test rax, rax
je 0x18001f580
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.18001e96c]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x18001e9b4]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x18001f580
lea rax, [rbx + 0x88]
lea r8, [0x18001f110]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x18001f580
mov qword [0x180059280], rbx
xor edi, edi
jmp 0x18001f57b
mov rbx, qword [rsp + 0x208]
cmp edi, 0xffffffff
jne 0x18001f588
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x18001f59e
test esi, esi
je 0x18001f59e
mov rcx, rbx
call fcn.18001f5c0
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1800222c8
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
xor esi, esi
lea rax, [rax - 0x10]
mov rdi, rdx
mov qword [rax], rsi
mov word [rax + 0x28], si
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rsi
mov qword [rax + 0x30], rsi
mov qword [rax - 0x18], rsi
lea r9, [0x18004e820]
lea r8d, [rsi + 1]
lea rcx, [0x18004e860]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x78]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x50]
cmp eax, esi
jne 0x1800223d6
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov ebx, eax
cmp eax, esi
jne 0x1800223ad
cmp word [rsp + 0x70], si
jne 0x18002243e
mov rcx, qword [rsp + 0x78]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x90]
mov ebx, eax
cmp eax, esi
je 0x18002243e
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x78], rsi
xor edx, edx
lea rax, [rsp + 0x78]
lea r9, [0x18004e7f0]
lea r8d, [rdx + 1]
lea rcx, [0x18004e840]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x78]
lea rdx, [0x18005daa0]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
cmp eax, esi
jne 0x18002243e
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
cmp rcx, rsi
je 0x18002244e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x18002245e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
cmp rcx, rsi
je 0x18002246e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x18002247e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
cmp rcx, rsi
je 0x18002248e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800224a0
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall rule properties via inetfwrule

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
lea rax, [rax - 0x18]
mov rdi, r8
mov qword [rax - 0x10], rsi
mov qword [rax - 8], rsi
mov word [rax + 0x38], si
lea ebp, [rsi + 1]
lea r9, [0x18004e810]
lea rcx, [0x18004e850]
xor edx, edx
mov r8d, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp eax, esi
jne 0x18002261c
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov ebx, eax
cmp eax, esi
jne 0x18002261c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x18005daa0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ebx, eax
cmp eax, esi
jne 0x18002257a
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x108]
cmp eax, esi
jne 0x180022550
cmp word [rsp + 0x78], si
jne 0x18002261c
mov rcx, qword [rsp + 0x30]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x110]
mov ebx, eax
cmp eax, esi
je 0x18002261c
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x30]
lea r9, [0x18004e800]
lea rcx, [0x18004e830]
mov r8d, ebp
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp eax, esi
jne 0x18002261c
mov rcx, qword [rsp + 0x30]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x180050d70]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rsp + 0x30]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18005daa0]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18005daa0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x18002262c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
cmp rcx, rsi
je 0x18002263c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x18002264c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180022664
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
lea esi, [r8 + 7]
xor ebp, ebp
mov rdi, rcx
and esi, 0xfffffff8
cmp dword [rcx + 0xdc8], ebp
jle 0x180022743
lea eax, [r8 - 8]
lea r15, [rdx + 8]
mov r13, rbp
cdqe
mov qword [rsp + 0x170], rax
mov rax, qword [rdi + 0xdc0]
lea rcx, [rdi + 0xddc]
mov edx, 8
mov rbx, qword [r13 + rax]
call fcn.1800448e4
mov r9d, 1
lea r8, [rdi + 0xddc]
lea rcx, [rsp + 0x30]
lea edx, [r9 + 7]
call fcn.18002c364
mov rdx, qword [rsp + 0x170]
lea r9, [rdi + 0xde4]
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.18002c2c0
lea rax, [rdi + 0xd80]
lea rdx, [rdi + 0xddc]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
inc ebp
add r13, 0x90
cmp ebp, dword [rdi + 0xdc8]
jl 0x1800226b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180028728
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x240
mov rbp, rcx
mov edi, r8d
mov r12, rdx
xor ebx, ebx
lea rcx, [rsp + 0x38]
xor edx, edx
and dword [rsp + 0x30], ebx
mov r8d, 0x200
call sub.ntdll.dll_memset
mov r8d, edi
movsxd rdx, ebx
xor r9d, r9d
sub r8d, ebx
add rdx, r12
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1800287bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x1800287c1
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea ecx, [rsi + 2]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1800287c1
add ebx, esi
cmp ebx, edi
jl 0x180028765
lea r11, [rsp + 0x240]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x1800287e4
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x250
xor ebx, ebx
mov edi, r9d
mov esi, r8d
xor ebp, ebp
mov r12, rdx
mov r14, rcx
and dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
and dword [rsp + 0x30], ebx
xor eax, eax
xor ecx, ecx
mov dword [rsp + 0x34], eax
call fcn.18001ab60
and dword [rsp + 0x34], ebx
mov ecx, 1
mov r13, rax
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x30], edi
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1800288cd
je 0x1800288c6
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd r11, eax
test eax, eax
je 0x1800288bf
cmp r11d, 0xffffffff
je 0x1800288b7
xor ecx, ecx
sub esi, r11d
add r12, r11
add ebp, r11d
call fcn.18001ab60
sub r13d, eax
add edi, r13d
test esi, esi
je 0x1800288d5
test edi, edi
js 0x1800288d5
jmp 0x180028814
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800288d3
mov ebx, 0x4d4
jmp 0x1800288d5
mov ebx, 0x5b4
jmp 0x1800288d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsp + 0x290]
test rax, rax
je 0x1800288e4
mov dword [rax], ebp
lea r11, [rsp + 0x250]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x180029bf0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx eax, word [rcx + 0x2c]
lea rbx, [rcx + 0xc48]
xor esi, esi
mov rbp, rcx
mov dword [rcx + 0xc58], 0x598
lea r12, [rbx + 0x88]
lea edi, [rsi + 1]
xor edx, edx
mov rcx, r12
mov r8d, edi
mov word [r11 + 8], ax
mov r15d, esi
mov r14d, esi
call fcn.180043204
cmp eax, esi
je 0x180029c53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180029d97
lea rax, [rsp + 0x98]
lea r8, [0x1800298f0]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
cmp rax, rsi
je 0x180029c46
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rbp
lea rax, [0x180029998]
mov edx, 2
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov r8d, edx
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.180033e44
mov edi, eax
cmp qword [rbx], rsi
jne 0x180029ccf
cmp qword [rbx + 8], rsi
je 0x180029d90
movzx eax, word [rsp + 0x90]
lea rcx, [rbx + 0x20]
xor edx, edx
mov word [rbp + 0x2c], ax
mov r13d, dword [rbx + 0x10]
mov r8d, r15d
add r13d, 0x90
mov dword [rbx + 0x78], 0x2800
mov dword [rbx + 0x7c], pe_nt_image_headers64
mov dword [rbx + 0x74], r13d
call fcn.180043204
mov edi, eax
test eax, eax
jne 0x180029d67
xor r12d, r12d
add r13d, 8
mov rcx, qword [0x180059270]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [rbx + 0x20]
test rax, rax
je 0x180029d56
mov rdx, rax
call fcn.1800432d0
inc dword [rbx + 0x80]
inc r12d
cmp r12d, 0x100
jl 0x180029d13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x84], eax
jmp 0x180029d60
mov edi, 8
call fcn.180043330
lea r12, [rbx + 0x88]
cmp edi, esi
jne 0x180029c46
mov rdx, qword [rbx]
mov r14d, r15d
cmp rdx, rsi
je 0x180029d90
mov rcx, rbp
call fcn.180033d5c
mov edi, eax
cmp eax, esi
je 0x180029d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rbx + 0xdc], r15d
cmp edi, esi
je 0x180029dfd
cmp r15d, esi
je 0x180029dfd
mov rcx, qword [rbx]
mov dword [rbx + 0xe0], 1
cmp rcx, rsi
je 0x180029dba
call fcn.180034124
mov qword [rbx], rsi
mov rcx, qword [rbx + 0xc4]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x18]
cmp rcx, rsi
je 0x180029de7
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rsi
mov rcx, r12
call fcn.180043330
cmp r14d, esi
je 0x180029dfd
lea rcx, [rbx + 0x20]
call fcn.180043330
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret