joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015a10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r14, r9
mov rsi, r8
mov r12, rdx
mov rdi, rcx
cmp r8, rbx
jne 0x140015a58
lea rdx, str.RegistryEx.cpp
lea rcx, str.pszValue___pszDefaultValue
mov r8d, 0x126
call fcn.140018670
xor ebp, ebp
mov r13d, ebp
test r12, r12
je 0x140015bdd
test rsi, rsi
je 0x140015bdd
test r14, r14
je 0x140015bdd
mov rcx, qword [rdi + 0x10]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], r15
test rcx, rcx
je 0x140015b9e
mov r15, qword [rsp + 0x88]
mov r13d, dword [r14]
mov qword [rsp + 0x68], rcx
test r15, r15
je 0x140015acc
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140015b9e
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
test r15, r15
je 0x140015afd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x80]
cmp ecx, 2
jne 0x140015b69
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.140018af8
mov r15, rax
test rax, rax
je 0x140015b62
mov r8d, r13d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rdx, rsi
mov rcx, r15
sub rdx, r15
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140015b40
mov rcx, rsi
call fcn.14001ca2c
mov rcx, r15
mov dword [r14], eax
call fcn.140018d84
mov ecx, dword [rsp + 0x80]
test r12d, r12d
jne 0x140015b9e
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140015b7b
cmp ecx, 7
jne 0x140015b80
mov ebp, 1
mov eax, ebp
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test rbx, rbx
je 0x140015bd9
inc rdi
cmp byte [rbx + rdi], bpl
jne 0x140015ba3
inc edi
cmp edi, r13d
ja 0x140015bd9
sub rsi, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rsi + rbx - 1], al
test al, al
jne 0x140015bc0
mov dword [r14], edi
mov eax, 1
jmp 0x140015b82
xor eax, eax
jmp 0x140015b82
xor eax, eax
jmp 0x140015b87
Function at 0x140015de0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x60
mov rcx, qword [rcx + 0x10]
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
test rcx, rcx
je 0x140015ec3
test rdx, rdx
je 0x140015ec3
test r9, r9
je 0x140015ec3
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rcx
cmp qword [rsp + 0x98], rbx
je 0x140015e84
mov rdx, qword [rsp + 0x98]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140015e7f
xor eax, eax
mov rbx, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp qword [rsp + 0x98], rbx
je 0x140015eba
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x140015e67
lea r11, [rsp + 0x60]
xor eax, eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400169c0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x1400425e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x140044498]
test al, 1
jne 0x140016a44
or eax, 1
mov dword [0x140044498], eax
mov qword [0x140044490], 0xf
mov qword [0x140044488], rdi
mov byte [0x140044478], dil
xor r8d, r8d
lea rdx, [0x1400331aa]
lea rcx, [0x140044478]
call fcn.14000e9b0
lea rcx, [0x140031570]
call fcn.140018f74
nop
cmp dword [0x140044474], 0
jne 0x140016aa5
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [rsp + 0x30], 0
jne 0x140016a70
mov r8, rdi
jmp 0x140016a8a
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140016a80
lea rdx, [rsp + 0x30]
lea rcx, [0x140044478]
call fcn.14000e9b0
mov dword [0x140044474], 1
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov byte [rbx], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140044478]
mov rcx, rbx
call fcn.14000e7c0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001c4b0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140017e70
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1400425e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rdx, [rsp + 0x30]
mov ebx, r9d
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140017ea0
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], al
call fcn.140019790
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathGetArgsA]
lea rcx, [rsp + 0x140]
mov r8, rax
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140017ee4
xor edx, edx
movzx eax, byte [r8 + rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140017ef0
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
test ebx, ebx
je 0x140017f29
lea rcx, [rsp + 0x30]
call fcn.140018350
test eax, eax
je 0x140017f6a
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400165b0
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001c4b0
add rsp, 0x260
pop rbx
ret
Function at 0x1400180a0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x238
mov rax, qword [0x1400425e0]
xor rax, rsp
mov qword [rsp + 0x220], rax
cmp qword [rdx + 0x18], 0x10
mov esi, r9d
mov rdi, r8
mov rbx, rdx
mov r14, rcx
jb 0x1400180d7
mov rcx, qword [rdx]
jmp 0x1400180da
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001811b
cmp qword [rbx + 0x18], 0x10
jb 0x1400180f4
mov rcx, qword [rbx]
call fcn.140018d84
xor esi, esi
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
cmp qword [rdi + 0x18], 0x10
jb 0x140018114
mov rcx, qword [rdi]
call fcn.140018d84
xor eax, eax
jmp 0x140018234
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x200
mov qword [rsp + 0x230], rbp
call fcn.140019790
mov ebp, dword [rsp + 0x288]
test ebp, ebp
je 0x140018182
cmp qword [rbx + 0x18], 0x10
jb 0x14001814c
mov rcx, qword [rbx]
jmp 0x14001814f
mov rcx, rbx
lea r8, [rsp + 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
lea r8, [r8 + 1]
lea rcx, [rcx + 1]
mov byte [r8 - 1], al
test al, al
jne 0x140018160
lea rcx, [rsp + 0x20]
mov edx, 0x200
call fcn.1400165b0
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x70]
call fcn.140019790
lea rax, str.open
mov dword [r14 + 4], esi
xor esi, esi
mov qword [r14 + 0x10], rax
mov dword [r14], 0x70
mov qword [r14 + 8], rsi
test ebp, ebp
je 0x1400181b7
lea rax, [rsp + 0x20]
jmp 0x1400181c6
cmp qword [rbx + 0x18], 0x10
jb 0x1400181c3
mov rax, qword [rbx]
jmp 0x1400181c6
mov rax, rbx
mov qword [r14 + 0x18], rax
cmp qword [rdi + 0x18], 0x10
jb 0x1400181d6
mov rax, qword [rdi]
jmp 0x1400181d9
mov rax, rdi
cmp dword [rsp + 0x280], 1
mov qword [r14 + 0x20], rax
mov eax, esi
sete al
mov rcx, r14
mov qword [r14 + 0x28], rsi
mov dword [r14 + 0x30], eax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp qword [rbx + 0x18], 0x10
mov ebp, eax
jb 0x14001820c
mov rcx, qword [rbx]
call fcn.140018d84
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
cmp qword [rdi + 0x18], 0x10
jb 0x14001822a
mov rcx, qword [rdi]
call fcn.140018d84
mov eax, ebp
mov rbp, qword [rsp + 0x230]
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], rsi
mov byte [rdi], sil
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14001c4b0
add rsp, 0x238
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001aa9c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001a904

Function at 0x1400219fc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140021a12
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140021a14
xor eax, eax
test eax, eax
je 0x140021a24
mov ecx, eax
call fcn.14001e3f4
or eax, 0xffffffff
jmp 0x140021a26
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14013f000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x14001121c
Capabilities:
Terminate process

Disassembly:
jmp 0x140013220
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014570
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014590
xor al, al
jmp 0x140014611
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400145a3
xor al, al
jmp 0x140014611
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400145cd
xor al, al
jmp 0x140014611
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400145e1
xor al, al
jmp 0x140014611
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400145f3
xor al, al
jmp 0x140014611
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001460f
xor al, al
jmp 0x140014611
mov al, 1
add rsp, 0x38
ret
Function at 0x180015ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x118]
mov rdi, rcx
mov ebx, dword [rcx + 0x130]
mov rbp, rdx
mov r9, qword [rax + 0x1d8]
mov rax, qword [rcx + 0x510]
or r9, 0x3655
mov qword [rax + 0x340], r9
mov rax, qword [rcx + 0x28]
xor rax, 0x378a
mov qword [rcx + 0x270], rax
mov rcx, qword [rcx + 0x510]
mov eax, dword [rcx + 0x4f8]
xor eax, 0x3a05
cmp ebx, eax
jne 0x180015f11
xor eax, eax
jmp 0x180016060
mov esi, dword [rcx + 0x280]
xor rsi, 0x3053
cmp qword [rdi + 0x230], 0x3415
je 0x180015f3c
mov rax, qword [rdi + 0x2c0]
or rax, r8
or qword [rdi + 0x250], rax
cmp qword [rdi + 0x250], 0x38e3
je 0x180015f5a
mov rax, qword [rdi + 0x2c0]
or rax, 0x37b1
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 0x3182
mov r9, rax
cmp qword [rdi + 0x28], rdx
ja 0x180015f86
mov rax, qword [rdi + 0xd8]
mov qword [rdi + 0x2a8], rax
dec rax
mov qword [rdi + 0xd8], rax
mov rax, qword [rdi + 0x118]
imul ecx, dword [rax + 0x280], 0xe4301783
cmp ecx, edx
jbe 0x180015fac
mov rax, qword [rdi + 0x210]
xor rax, 0x3c32
add qword [rdi + 0x70], rax
test r9, r9
je 0x180015ffb
mov rax, qword [rdi + 0xe8]
mov r8, rbx
movzx ecx, word [rsp + 0x50]
xor edx, edx
add rcx, qword [rax + 0x28]
mov qword [rdi + 0x360], rcx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, qword [rdi + 0x510]
lea rcx, [rbp + 0x378a]
mov r8, rbx
mov rsi, rax
add qword [rdx + 0x4e0], rcx
xor edx, edx
mov rcx, rax
call fcn.180005f30
mov rcx, qword [rdi + 0x210]
mov rdx, qword [rdi + 0x510]
mov rax, qword [rdi + 0x128]
add rdx, 0x328
imul rcx, rdx
mov edx, 0x32ec
mov qword [rdi + 0x210], rcx
mov ecx, dword [rax + 0x290]
add ecx, 0x299
cmp ecx, edx
jge 0x18001605d
mov rax, qword [rdi + 0x2c0]
sub edx, ecx
mov r8, qword [rdi + 0x30]
mov ecx, edx
xor r8, rax
dec rax
sub rcx, 1
jne 0x180016046
mov qword [rdi + 0x2c0], rax
mov qword [rdi + 0x30], r8
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180016630
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov eax, dword [rsp + 0x90]
mov r15d, ecx
mov r14d, dword [rsp + 0xb8]
mov r10d, dword [rsp + 0x98]
add r14d, 0x28e
add r10d, 0x188
lea edi, [rax - 0x761]
lea esi, [rax - 0x7f0]
mov eax, dword [rsp + 0xb0]
add eax, 0xfffffd67
cmp edi, eax
jle 0x1800168c8
mov ebp, dword [rsp + 0xa8]
lea eax, [rbp + 0x132]
cmp edi, eax
jge 0x1800168c8
lea eax, [rsi + 0x158]
cmp r14d, eax
je 0x180016859
mov rbx, qword [rsp + 0xd0]
add edi, 0xc9
mov r8d, 0x1ef4
mov rax, qword [rbx + 0x190]
mov ecx, dword [rax + 0x168]
mov rax, qword [rbx + 0x128]
add ecx, 0x28de3b
mov dword [rbx + 0x20], ecx
imul edx, dword [rax + 0x4f8], 0x2aa875e5
jmp 0x180016714
mov rcx, qword [rbx + 0x510]
mov rax, qword [rcx + 0x90]
sub qword [rbx + 0x1e0], rax
dec qword [rcx + 0x90]
inc edx
mov rax, qword [rbx + 0x118]
mov ecx, dword [rax + 0x168]
xor rcx, r8
movsxd rax, edx
cmp rax, rcx
jb 0x1800166f6
mov rax, qword [rbx + 0x190]
mov ecx, dword [rax + 0x168]
mov eax, dword [rbx + 0x280]
xor ecx, 0x4ae
add eax, 0xbdf
cmp ecx, eax
jbe 0x18001675a
imul rax, qword [rbx + 0x30], 0xab30824
mov qword [rbx + 0x30], rax
mov eax, dword [rbx + 0x4f8]
mov edx, 0x3523
add eax, 0x28d5c3
mov r12d, 0x30f3
mov qword [rbx + 0x130], rax
mov r9d, 0x3182
mov rax, qword [rbx + 0x510]
mov r8d, 0x3c12
xor rax, rdx
mov word [rsp + 0x20], r12w
or qword [rbx + 0x28], rax
mov rcx, rbx
call fcn.180015ea0
mov ecx, dword [rsp + 0xc0]
lea r10d, [r15 + 0x122]
lea r9d, [rsi + 0xb1f]
mov qword [rbx + 0x18], rax
lea eax, [r14 - 0x838]
add ecx, 0xc99
mov dword [rsp + 0x38], eax
lea r8d, [r14 + 0x254]
mov dword [rsp + 0x30], r8d
mov edx, ebp
mov dword [rsp + 0x28], r10d
mov r8, rbx
mov dword [rsp + 0x20], r9d
mov r9d, r10d
call sym.uomm805zl62.dll_HeNuB21N3
mov rax, qword [rbx + 0x510]
mov r10d, 0x3a05
mov edx, 0x32ec
mov r9d, r12d
imul r8d, dword [rax + 0x168], 0x722a6bcf
mov rax, qword [rbx + 0xe8]
mov ecx, dword [rax + 0x168]
lea rax, [0x180049fd0]
mov qword [rsp + 0x48], rax
xor ecx, 0x15ae2d
mov byte [rsp + 0x40], 0xc0
mov byte [rsp + 0x38], 0x80
mov dword [rsp + 0x30], r8d
mov r8, rbx
mov dword [rsp + 0x28], ecx
mov ecx, 0x378a
mov word [rsp + 0x20], r10w
call fcn.180017234
mov dword [rbx + 0x34c], eax
jmp 0x1800168c8
mov r9, qword [rsp + 0xd0]
mov rax, qword [r9 + 0xd8]
or rax, 0x338c
xor rax, qword [r9 + 0x30]
cmp qword [r9 + 0x280], rax
jae 0x1800168a5
mov rax, qword [r9 + 0x2c0]
and rax, qword [r9 + 0x210]
sub qword [r9 + 0x510], rax
mov eax, dword [r9 + 0x1e0]
sub eax, 0x1087
and eax, 0x362a
xor edi, eax
jmp 0x1800168c8
mov rcx, qword [r9 + 0xa0]
mov edx, r10d
and rcx, qword [r9]
or edx, 0x2f79
imul r8d, esi, 0x378a
add edx, r10d
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
lea eax, [rdi + 0x3df]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140003570
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x20]
mov rsi, rcx
test dword [rdi + 0x18c], 0x2000
jne 0x1400035af
mov rcx, qword [0x1400c1658]
lea r9, str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov r8d, 0xb13
lea rdx, [0x1400b6850]
call qword [0x1400c1670]
int3
lea rcx, [rdi + 0x128]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsi + 0x178], 1
lea rcx, [rdi + 0x128]
mov byte [rdi + 0x173], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rdi + 0x160], 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
je 0x140003626
mov rcx, qword [rdi + 0x168]
lea rdx, [0x1400b5af4]
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x140003626
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140003626
lea rdx, str.Failed_to_signal_resume_via_inter_thread_communication_channel.
mov rcx, rdi
call fcn.14000f5a0
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400038d0
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov dword [rsp + 0x30], 0x1c
mov rbx, rcx
mov qword [r11 - 0x30], rax
mov rcx, qword [rcx + 0x150]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x140003ac1
movzx eax, byte [rbx + 0x171]
test al, al
jne 0x140003ac1
mov qword [r11 + 0x10], rsi
lea r8, [r11 - 0x38]
lea rdx, [r11 - 0x30]
mov qword [r11 + 0x18], rdi
call qword [sym.imp.WS2_32.dll_accept]
xor dil, dil
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003a02
cmp dword [rsp + 0x30], 0
jle 0x140003a02
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140003995
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.14000ec40
mov r8, rax
lea rdx, str.Failed_to_set_nonblocking_mode_on_incoming_connection_socket:__s_n
mov rcx, rbx
call fcn.14000f5a0
jmp 0x140003998
mov dil, 1
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400039bb
lea rdx, str.Failed_to_set_noninheritable_mode_on_incoming_connection_socket._n
mov rcx, rbx
call fcn.14000f5a0
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov byte [rsp + 0x28], dil
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 0
call fcn.140002cc0
mov eax, 1
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140087840
add rsp, 0x60
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2726
je 0x140003aba
cmp eax, 0x2746
je 0x140003aba
cmp eax, 0x2733
je 0x140003a40
mov ecx, eax
call fcn.14000ec40
mov r8, rax
lea rdx, str.Error_accepting_connection:__s_n
mov rcx, rbx
call fcn.14000f5a0
cmp rsi, 0xffffffffffffffff
je 0x140003a75
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x140003a75
mov rcx, qword [0x1400c1658]
lea r9, [0x1400b6418]
mov r8d, 0xc19
lea rdx, [0x1400b6c80]
call qword [0x1400c1670]
int3
cmp edi, 0x2728
je 0x140003a85
cmp edi, 0x2747
jne 0x140003aba
mov r8d, dword [rbx + 0x178]
mov rcx, rbx
test r8d, r8d
jne 0x140003aa7
lea rdx, str.Hit_process_or_system_resource_limit_at_FIRST_connection._This_is_really_bad_as_there_is_no_sane_way_to_proceed._Will_try_busy_waiting_for_system_resources_to_become_magically_available._n
call fcn.14000f5a0
xor eax, eax
jmp 0x1400039e2
lea rdx, str.Hit_process_or_system_resource_limit_at__u_connections__temporarily_suspending_accept__._Consider_setting_a_lower_MHD_OPTION_CONNECTION_LIMIT._n
mov byte [rbx + 0x172], 1
call fcn.14000f5a0
xor eax, eax
jmp 0x1400039e2
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140087840
add rsp, 0x60
pop rbx
ret