joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ee210
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400da6f0
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
mov qword [rbp - 0x48], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, rdi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
mov r9, rsi
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140002c90
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140002ce0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1400ee2d3
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.1400da720
call fcn.140001f34
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400ef860
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400da6f0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r13, r13
jne 0x1400ef8c8
xor r8d, r8d
jmp 0x1400ef8cc
lea r8, [r13 + 0x10]
mov qword [rbp - 0x48], r8
test r12, r12
jne 0x1400ef8da
xor r9d, r9d
jmp 0x1400ef8df
lea r9, [r12 + 0x10]
mov qword [rbp - 0x50], r9
test r15, r15
jne 0x1400ef8ec
xor eax, eax
jmp 0x1400ef8f0
lea rax, [r15 + 0x10]
mov qword [rbp - 0x58], rax
test r14, r14
jne 0x1400ef8fe
xor r10d, r10d
jmp 0x1400ef902
lea r10, [r14 + 0x10]
mov qword [rbp - 0x60], r10
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rsi
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r8
mov rcx, rdx
mov qword [rbp - 0x7c], rcx
mov edx, ebx
mov dword [rbp - 0x74], edx
mov r8, rsi
mov qword [rbp - 0x84], r8
mov r9, rdi
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.140002c90
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov esi, eax
lea rcx, [rbp - 0xb8]
call fcn.140002ce0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1400ef9ac
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.1400da720
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400efef0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400da6f0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x1400eff41
add rsi, 0xc
jmp 0x1400eff43
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.140002c90
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140002ce0
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1400effbc
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.1400da720
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401003e0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x1d0]
xorps xmm4, xmm4
movabs rax, 0xffffffffffffff10
movaps xmmword [rbp + rax - 0x40], xmm4
movaps xmmword [rbp + rax - 0x30], xmm4
movaps xmmword [rbp + rax - 0x20], xmm4
add rax, 0x30
jne 0x140100408
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rbx, rcx
mov r14, rdx
mov r15, r8
mov r12, r9
mov r13, qword [rbp + 0x48]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
call fcn.1400d87c0
mov qword [rbp - 0x40], rax
mov rcx, r14
mov edx, 1
xor r8d, r8d
call fcn.1400d87c0
mov qword [rbp - 0x48], rax
xor edi, edi
cmp byte [rbp + 0x30], 0
setne dil
mov dword [rbp - 0x4c], edi
mov rcx, r13
mov edx, 1
xor r8d, r8d
call fcn.1400d87c0
mov qword [rbp - 0x58], rax
lea rdi, [rbp - 0xb8]
mov rsi, qword [rbp + 0x50]
mov ecx, 0xc
rep movsq qword [rdi], qword [rsi]
lea rcx, [rbp - 0xb8]
lea rdx, [rbp - 0x120]
call fcn.140150090
mov rsi, qword [rbp + 0x58]
mov qword [rbp - 0x128], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ebx, dword [rbp - 0x4c]
mov dword [rsp + 0x20], ebx
mov ebx, dword [rbp + 0x38]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rbp + 0x40]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rbp - 0x58]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x120]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rsi
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x138], rcx
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x140], rdx
mov r8, r15
mov qword [rbp - 0x148], r8
mov r9, r12
mov qword [rbp - 0x150], r9
lea rcx, [rbp - 0x178]
call fcn.140002c90
mov rcx, qword [rbp - 0x138]
mov rdx, qword [rbp - 0x140]
mov r8, qword [rbp - 0x148]
mov r9, qword [rbp - 0x150]
call sub.KERNEL32.dll_CreateProcessA
mov esi, eax
lea rcx, [rbp - 0x178]
call fcn.140002ce0
call fcn.140001f34
mov rdi, rax
mov qword [rbp - 0x130], rdi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x130]
mov dword [rcx + 8], eax
test esi, esi
setne sil
movzx esi, sil
cmp qword [rbp + 0x10], 0
je 0x140100594
mov r14, qword [rbp - 0x40]
test r14, 0xffffffffffff0000
je 0x140100594
mov rcx, r14
call fcn.1400eee60
cmp qword [rbp + 0x18], 0
je 0x1401005b0
mov r15, qword [rbp - 0x48]
test r15, 0xffffffffffff0000
je 0x1401005b0
mov rcx, r15
call fcn.1400eee60
cmp qword [rbp + 0x48], 0
je 0x1401005c8
test rbx, 0xffffffffffff0000
je 0x1401005c8
mov rcx, rbx
call fcn.1400eee60
lea rcx, [rbp - 0x120]
call fcn.14014ff10
movzx eax, sil
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140101770
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x18], rdx
mov rsi, rcx
mov edi, r8d
mov ebx, r9d
mov r14, qword [rbp + 0x30]
mov rcx, rdx
mov edx, 1
xor r8d, r8d
call fcn.1400d87c0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r14
mov r14d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r14d
mov rcx, rsi
mov qword [rbp - 0x60], rcx
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x68], rdx
mov r8d, edi
mov dword [rbp - 0x4c], r8d
mov r9d, ebx
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x90]
call fcn.140002c90
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8d, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.ADVAPI32.dll_RegSetValueExA
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140002ce0
call fcn.140001f34
mov rdi, rax
mov qword [rbp - 0x58], rdi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x58]
mov dword [rcx + 8], eax
cmp qword [rbp + 0x18], 0
je 0x14010185a
mov rdx, qword [rbp - 0x40]
test rdx, 0xffffffffffff0000
je 0x14010185a
mov rcx, rdx
call fcn.1400eee60
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401283c0
Capabilities:
Get token membership

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov rsi, r8
xor edx, edx
mov dword [rbp - 0x40], edx
mov dword [rbp - 0x48], edx
mov qword [rbp + 0x20], rsi
cmp byte [rsi], 0
jne 0x1401283fd
xor edx, edx
jmp 0x140128402
mov edx, 1
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x48]
cmp dword [rcx], ecx
call fcn.1400da6f0
mov rcx, qword [rbp + 0x10]
mov rbx, qword [rcx + 8]
test rdi, rdi
jne 0x140128422
xor r14d, r14d
jmp 0x140128426
lea r14, [rdi + 0x10]
mov qword [rbp - 0x50], r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea r8, [rbp - 0x40]
mov qword [rbp - 0x58], r8
mov rcx, rbx
mov qword [rbp - 0x60], rcx
mov rdx, r14
mov qword [rbp - 0x68], rdx
lea rcx, [rbp - 0x90]
call fcn.140002c90
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
call sub.ADVAPI32.dll_CheckTokenMembership
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140002ce0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
test esi, esi
setne sil
movzx esi, sil
cmp dword [rbp - 0x40], 0
setne cl
mov rbx, qword [rbp + 0x20]
mov byte [rbx], cl
cmp byte [rbp - 0x48], 0
je 0x1401284a7
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.1400da720
call fcn.140001f34
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140011104
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001f380
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a0f5]
call fcn.1400119c4
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001f3d7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001f4e3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001f47c
cmp qword [rbp + 0x28], 0
jle 0x14001f47c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001f41c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011933
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001f4d2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001f4d2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011357
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14001d410
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x998
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x19a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x9b8]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0x958], rax
lea rcx, [0x14003a0fc]
call fcn.1400119c4
mov dword [rbp + 0x414], 0
lea rdx, str.Opening_the_file_for_reading_...
lea rcx, [rbp + 0x868]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0x980]
call fcn.140011866
nop
lea rcx, [rbp + 0x868]
call fcn.1400111d1
mov edx, 0x110
lea rcx, [rbp + 0x440]
call fcn.1400116c2
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x21
mov rdx, qword [rbp + 0x988]
lea rcx, [rbp + 0x440]
call fcn.14001190b
nop
mov rax, qword [rbp + 0x440]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x440]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14001d562
lea rdx, str.Error_opening_the_file_to_read_:_
lea rcx, [rbp + 0x8a8]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x8a8]
mov rcx, qword [rbp + 0x980]
call fcn.140011866
nop
lea rcx, [rbp + 0x8a8]
call fcn.1400111d1
mov byte [rbp + 0x8e4], 0
lea rcx, [rbp + 0x440]
call fcn.140011190
movzx eax, byte [rbp + 0x8e4]
jmp 0x14001d643
mov rax, qword [rbp + 0x440]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x440]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14001d5e0
mov r8d, 0x400
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140D.dll_public:_long_long___int64____cdecl_std::basic_istream_char__struct_std::char_traits_char__::gcount_void_const___ptr64]
cmp rax, 0x400
jge 0x14001d5c4
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140D.dll_public:_long_long___int64____cdecl_std::basic_istream_char__struct_std::char_traits_char__::gcount_void_const___ptr64]
mov dword [rbp + 0x414], eax
xor r9d, r9d
mov r8d, 0x408
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x990]
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14001d562
lea rdx, str.File_sent_successfully_
lea rcx, [rbp + 0x908]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x908]
mov rcx, qword [rbp + 0x980]
call fcn.140011866
nop
lea rcx, [rbp + 0x908]
call fcn.1400111d1
lea rcx, [rbp + 0x440]
call fcn.140011587
mov byte [rbp + 0x944], 1
lea rcx, [rbp + 0x440]
call fcn.140011190
movzx eax, byte [rbp + 0x944]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002b2f0]
call fcn.140011816
mov rax, rdi
mov rcx, qword [rbp + 0x958]
xor rcx, rbp
call fcn.1400114ba
lea rsp, [rbp + 0x968]
pop rdi
pop rbp
ret
Function at 0x1400113fc
Capabilities:
Create tcp socket

Disassembly:
jmp 0x14001b800
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a0fc]
call fcn.1400119c4
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rbp + 0x140]
mov dword [rcx], eax
mov rax, qword [rbp + 0x140]
movsxd rax, dword [rax]
cmp rax, 0xffffffffffffffff
jne 0x14001b86c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socket_failed
mov rcx, qword [rbp + 0x140]
call fcn.1400116c7
jmp 0x14001b8d3
mov rax, qword [rbp + 0x140]
cmp dword [rax], 0xffffffff
jne 0x14001b896
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socket_error
mov rcx, qword [rbp + 0x140]
call fcn.1400116c7
jmp 0x14001b8d3
lea rdx, str.socket_success
lea rcx, [rbp + 0xe8]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0x140]
call fcn.140011866
nop
lea rcx, [rbp + 0xe8]
call fcn.1400111d1
mov byte [rbp + 4], 1
mov rax, qword [rbp + 0x140]
mov eax, dword [rax]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x14001158c
Capabilities:
Terminate process

Disassembly:
jmp 0x140021f20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400116ae
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1400192b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14003a0fc]
call fcn.1400119c4
lea rdx, str.____________Ftp_Client1
lea rcx, [rbp + 8]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, 5
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x160]
call fcn.140011866
mov rax, qword [rbp + 0x160]
add rax, 0x18
mov rdx, rax
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140019358
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.WSAStartup_failed
mov rcx, qword [rbp + 0x160]
call fcn.1400116c7
lea rdx, str.WSAStartup_success
lea rcx, [rbp + 0x108]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x160]
call fcn.140011866
nop
lea rcx, [rbp + 0x108]
call fcn.1400111d1
nop
lea rcx, [rbp + 8]
call fcn.1400111d1
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b130]
call fcn.140011816
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400114ba
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400116c7
Capabilities:
Terminate process

Disassembly:
jmp 0x14001bd40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14003a0fc]
call fcn.1400119c4
lea rdx, str.error:
lea rcx, [rbp + 8]
call fcn.14001144c
nop
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 8]
call fcn.1400110cd
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x120]
call fcn.140011866
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 8]
call fcn.1400111d1
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b1b0]
call fcn.140011816
nop
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400114ba
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400116db
Capabilities:
Parse pe header

Disassembly:
jmp 0x140022a50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140022a70
xor al, al
jmp 0x140022af1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140022a83
xor al, al
jmp 0x140022af1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140022aad
xor al, al
jmp 0x140022af1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140022ac1
xor al, al
jmp 0x140022af1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140022ad3
xor al, al
jmp 0x140022af1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140022aef
xor al, al
jmp 0x140022af1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011735
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14001d710
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x9b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x9d8]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0x978], rax
lea rcx, [0x14003a0fc]
call fcn.1400119c4
mov dword [rbp + 0x414], 0
lea rdx, str.Opening_the_file_for_writing_...
lea rcx, [rbp + 0x888]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x888]
mov rcx, qword [rbp + 0x9a0]
call fcn.140011866
nop
lea rcx, [rbp + 0x888]
call fcn.1400111d1
mov edx, 0x108
lea rcx, [rbp + 0x440]
call fcn.1400113ca
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
mov rdx, qword [rbp + 0x9a8]
lea rcx, [rbp + 0x440]
call fcn.1400113b1
nop
mov rax, qword [rbp + 0x440]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x440]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14001d862
lea rdx, str.Error_opening_the_file_to_write_:_
lea rcx, [rbp + 0x8c8]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x8c8]
mov rcx, qword [rbp + 0x9a0]
call fcn.140011866
nop
lea rcx, [rbp + 0x8c8]
call fcn.1400111d1
mov byte [rbp + 0x904], 0
lea rcx, [rbp + 0x440]
call fcn.140011267
movzx eax, byte [rbp + 0x904]
jmp 0x14001d938
xor eax, eax
cmp eax, 1
je 0x14001d8d5
xor r9d, r9d
mov r8d, 0x408
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x9b0]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x14001d894
jmp 0x14001d8d5
cmp dword [rbp + 0x414], 0
jne 0x14001d8b6
mov r8d, 0x400
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001d8d3
movsxd rax, dword [rbp + 0x414]
mov r8, rax
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001d8d5
jmp 0x14001d862
lea rdx, str.File_received_successfully_
lea rcx, [rbp + 0x928]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x928]
mov rcx, qword [rbp + 0x9a0]
call fcn.140011866
nop
lea rcx, [rbp + 0x928]
call fcn.1400111d1
lea rcx, [rbp + 0x440]
call fcn.140011514
mov byte [rbp + 0x964], 1
lea rcx, [rbp + 0x440]
call fcn.140011267
movzx eax, byte [rbp + 0x964]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002b3b0]
call fcn.140011816
mov rax, rdi
mov rcx, qword [rbp + 0x978]
xor rcx, rbp
call fcn.1400114ba
lea rsp, [rbp + 0x988]
pop rdi
pop rbp
ret