joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400125f4
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rsp + 0x20], InitCommonControls
mov rcx, qword [str._b0_n_]
lea rbp, str._b0_n_
cmp rcx, rbp
je 0x140012651
test byte [rcx + 0x1c], 2
je 0x140012651
cmp byte [rcx + 0x19], 5
jb 0x140012651
mov rcx, qword [rcx + 0x10]
lea r8, [0x140084ff8]
mov edx, 0x27
call fcn.1400043e4
xor edi, edi
test rbx, rbx
je 0x1400126fd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140012660
test rax, rax
je 0x1400126fd
mov eax, 0x2e
cmp ax, word [rbx]
jne 0x140012682
cmp di, word [rbx + 2]
je 0x1400126fd
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1400126e1
mov rax, qword [str._b0_n_]
cmp rax, rbp
je 0x1400126f9
test byte [rax + 0x1c], 2
je 0x1400126f9
cmp byte [rax + 0x19], 2
jb 0x1400126f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._b0_n_]
lea r8, [0x140084ff8]
mov r9d, eax
mov edx, 0x28
mov rcx, qword [rcx + 0x10]
call fcn.140004410
jmp 0x1400126f9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400126fd
xor eax, eax
jmp 0x140012702
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006e550
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400129d0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rax - 0x778]
sub rsp, 0x860
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rbp + 0x750], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call sub.msvcrt.dll_memset
xor edi, edi
cmp dword [0x1400a59f8], edi
jne 0x140012ad6
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftFaxClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140012a5d
mov eax, edi
jmp 0x140012abd
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DebugLevel
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140012aa4
cmp dword [rsp + 0x38], 4
je 0x140012aa8
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rbp + 0x780]
mov dword [0x1400a490c], eax
mov dword [0x1400a59f8], 1
jmp 0x140012adc
mov eax, dword [0x1400a490c]
test eax, eax
jle 0x140012b66
lea r9, [rbp + 0x788]
mov r8, rbx
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.14000ea28
test eax, eax
js 0x140012b66
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140012b0a
mov edx, COleDataSource::XDataObject::AddRef
mov r8d, 0xa
cmp rax, rdx
cmovb edx, eax
lea eax, [rdx - 1]
cmp word [rsp + rax*2 + 0x50], r8w
je 0x140012b55
lea ecx, [r8 + 3]
mov word [rsp + rdx*2 + 0x50], cx
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
mov word [rsp + rax*2 + 0x50], r8w
add rcx, rcx
cmp rcx, 0x800
jae 0x140012b81
mov word [rsp + rcx + 0x50], di
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x750]
xor rcx, rsp
call fcn.14006e550
add rsp, 0x860
pop rdi
pop rbx
pop rbp
ret
call fcn.14006e938
int3
Function at 0x140012be0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebp, r8d
mov rsi, rdx
mov edi, ecx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
xor ebx, ebx
call sub.msvcrt.dll_memset
mov rcx, qword [str._b0_n_]
lea r12, str._b0_n_
cmp rcx, r12
je 0x140012c4e
test byte [rcx + 0x1c], 2
je 0x140012c4e
cmp byte [rcx + 0x19], 5
jb 0x140012c4e
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xa]
lea r8, [0x1400852f0]
call fcn.1400043e4
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x140012cb5
mov rcx, qword [str._b0_n_]
cmp rcx, r12
je 0x140012ca4
test byte [rcx + 0x1c], 2
je 0x140012ca4
cmp byte [rcx + 0x19], 2
jb 0x140012ca4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400852f0]
mov edx, VariantTimeToDosDateTime
mov r9d, eax
call fcn.140004410
movzx ecx, di
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140012d03
mov rdx, rbp
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.14000e8c4
mov edi, eax
test eax, eax
jns 0x140012cfe
mov rcx, qword [str._b0_n_]
cmp rcx, r12
je 0x140012ca4
test byte [rcx + 0x1c], 2
je 0x140012ca4
cmp byte [rcx + 0x19], 2
jb 0x140012ca4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400852f0]
movzx r9d, di
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140004410
jmp 0x140012ca4
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006e550
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014930
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
mov rcx, qword [str._b0_n_]
lea rax, str._b0_n_
cmp rcx, rax
je 0x140014976
test byte [rcx + 0x1c], 2
je 0x140014976
cmp byte [rcx + 0x19], 5
jb 0x140014976
mov rcx, qword [rcx + 0x10]
lea r8, [0x140085398]
mov edx, 0x25
call fcn.1400043e4
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400149f2
lea r8, [rsp + 0x30]
mov edx, 4
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400149e0
mov r8, qword [rsp + 0x30]
xor r9d, r9d
mov edx, 0x3000
mov ecx, 0x2000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x14000c28f.0]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14000c28f.0]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140014bd8
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, reloc.MFC42u.dll_CDocObjectServerItem::CDocObjectServerItem
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rcx, qword [str._b0_n_]
lea rdi, str._b0_n_
cmp rcx, rdi
je 0x140014c27
test byte [rcx + 0x1c], 2
je 0x140014c27
cmp byte [rcx + 0x19], 5
jb 0x140014c27
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400853a8]
mov edx, InitCommonControls
call fcn.1400043e4
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x140014c9f
mov rax, qword [str._b0_n_]
cmp rax, rdi
je 0x140014c9b
test byte [rax + 0x1c], 2
je 0x140014c9b
cmp byte [rax + 0x19], 2
jb 0x140014c9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._b0_n_]
lea r8, [0x1400853a8]
mov r9d, eax
mov edx, InitCommonControls
mov rcx, qword [rcx + 0x10]
call fcn.140004410
xor eax, eax
jmp 0x140014ca9
cmp dword [rsp + 0x24], 6
setae cl
mov eax, ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006e550
add rsp, reloc.MFC42u.dll_CDocObjectServerItem::CDocObjectServerItem
pop rdi
ret
Function at 0x140016984
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xa70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rsp + COleControl::XDataObject::EnumFormatEtc], rax
mov r15, rdx
lea r12, str._b0_n_
mov rcx, qword [str._b0_n_]
cmp rcx, r12
je 0x1400169f1
test dword [rcx + 0x1c], 0x100
je 0x1400169f1
cmp byte [rcx + 0x19], 4
jb 0x1400169f1
mov edx, AtlComQIPtrAssign
lea r8, [0x140085890]
mov rcx, qword [rcx + 0x10]
call fcn.1400043e4
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x140016a5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._b0_n_]
cmp rcx, r12
je 0x140016a54
test dword [rcx + 0x1c], 0x100
je 0x140016a54
cmp byte [rcx + 0x19], 2
jb 0x140016a54
mov edx, AtlComQIPtrAssign
lea r9, str.GetTempPath
mov dword [rsp + 0x20], ebx
lea r8, [0x140085890]
mov rcx, qword [rcx + 0x10]
call fcn.140004454
mov eax, ebx
jmp 0x140016b83
call qword [sym.imp.msvcrt.dll_rand]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.msvcrt.dll_rand]
nop dword [rax + rax]
imul ebx, eax
call qword [sym.imp.msvcrt.dll_rand]
nop dword [rax + rax]
mov r14d, eax
imul r14d, ebx
lea esi, [r14 + 1]
cmp esi, r14d
je 0x140016b7e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [rax + rax]
lea rcx, [0x140084d60]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
lea r9, str.MSFaxConsoleTempPreview_
lea r8, [rsp + 0x50]
lea rdx, str._s_s_08x_08x._s
mov rcx, r15
call qword [sym.imp.MFC42u.dll_CPtrList::FreeNode]
nop dword [rax + rax]
nop
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], CInternetFile::CInternetFile
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x140016b64
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x50
jne 0x140016b2c
inc esi
jmp 0x140016a8f
mov rcx, qword [str._b0_n_]
cmp rcx, r12
je 0x140016a54
test dword [rcx + 0x1c], 0x100
je 0x140016a54
cmp byte [rcx + 0x19], 2
jb 0x140016a54
mov edx, AtlComQIPtrAssign
lea r9, str.CreateFile
jmp 0x140016a40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor eax, eax
jmp 0x140016b83
mov eax, reloc.ATL.DLL_AtlComQIPtrAssign
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.14006e550
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140016e54
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rsi
push r14
push r15
sub rsp, 0x1b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rsi, rdx
mov rbx, rcx
lea r15, str._b0_n_
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x140016ebf
test dword [rcx + 0x1c], 0x100
je 0x140016ebf
cmp byte [rcx + 0x19], 4
jb 0x140016ebf
mov edx, 0x2d
lea r8, [0x140085890]
mov rcx, qword [rcx + 0x10]
call fcn.1400043e4
lea rax, [rbx - 1]
cmp rax, 0x3fe
ja 0x140016ed2
mov ebx, 1
jmp 0x140016ed6
shr rbx, 0xa
mov r8, rbx
lea rdx, str._I64d
mov rcx, rsi
call qword [sym.imp.MFC42u.dll_CPtrList::FreeNode]
nop dword [rax + rax]
nop
mov dword [rsp + 0x28], 0x64
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsi]
xor edx, edx
mov ebx, 0x400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jne 0x140016f76
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x140016f6f
test dword [rcx + 0x1c], 0x100
je 0x140016f6f
cmp byte [rcx + 0x19], 2
jb 0x140016f6f
lea edx, [r14 + 0x2f]
lea r9, str.GetNumberFormat
mov dword [rsp + 0x20], ebx
lea r8, [0x140085890]
mov rcx, qword [rcx + 0x10]
call fcn.140004454
mov eax, ebx
jmp 0x1400170aa
mov r9d, 0xa
lea r8, [rsp + 0x38]
lea edx, [r9 + 4]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x140016fce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x140016f6f
test dword [rcx + 0x1c], 0x100
je 0x140016f6f
cmp byte [rcx + 0x19], 2
jb 0x140016f6f
mov edx, 0x30
lea r9, str.GetLocaleInfo
jmp 0x140016f5b
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x140016ff0
mov word [rax], r14w
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
cmp dword [0x1400a5700], r14d
je 0x140017015
mov eax, 0x202d
mov word [rsp + 0x50], ax
lea r8, str._s_KB
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.14000e950
mov ebx, eax
test eax, eax
jns 0x140017084
mov ecx, eax
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
cmove ebx, eax
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x140017080
test dword [rcx + 0x1c], 0x100
je 0x140017080
cmp byte [rcx + 0x19], 2
jb 0x140017080
mov edx, 0x31
mov dword [rsp + 0x20], ebx
lea r9, str.StringCchCat
lea r8, [0x140085890]
mov rcx, qword [rcx + 0x10]
call fcn.140004454
mov eax, ebx
jmp 0x1400170aa
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.MFC42u.dll_CPtrList::FreeNode]
nop dword [rax + rax]
nop
xor eax, eax
jmp 0x1400170aa
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14006e550
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1b0
pop r15
pop r14
pop rsi
ret
Function at 0x140021000
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [str._b0_n_]
lea r14, str._b0_n_
cmp rcx, r14
je 0x140021055
test dword [rcx + 0x1c], 0x100
je 0x140021055
cmp byte [rcx + 0x19], 4
jb 0x140021055
mov rcx, qword [rcx + 0x10]
lea r8, [0x140086c68]
mov edx, AtlComQIPtrAssign
call fcn.1400043e4
and qword [rbx], 0
mov rbx, qword [rsi + 0x88]
cmp qword [rdi + 0xe8], rbx
jne 0x1400210aa
mov rcx, qword [str._b0_n_]
cmp rcx, r14
je 0x140021192
test dword [rcx + 0x1c], 0x100
je 0x140021192
cmp byte [rcx + 0x19], 5
jb 0x140021192
mov rcx, qword [rcx + 0x10]
lea r8, [0x140086c68]
mov edx, reloc.ATL.DLL_AtlComQIPtrAssign
call fcn.1400043e4
jmp 0x140021192
call qword [sym.imp.MFC42u.dll_Ordinal_1471]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x1400210d1
mov rcx, qword [rax]
mov rax, qword [rcx + 0xf8]
mov rcx, rdx
call qword [case.0x14000c28f.0]
test rax, rax
je 0x140021192
mov rdx, rbx
mov rcx, rax
call fcn.14001a2b8
mov qword [rdi + 0xe8], rbx
test rbx, rbx
jne 0x1400210fb
call fcn.140021b44
jmp 0x140021192
mov rcx, qword [rdi + 0x80]
mov ebx, dword [rbx + 0x10c]
mov edx, ebx
mov rcx, qword [rcx + 0xa0]
call fcn.14002b0f0
call fcn.140021b44
cmp ebx, 1
jne 0x140021192
mov rcx, qword [str._b0_n_]
cmp rcx, r14
je 0x14002114e
test dword [rcx + 0x1c], 0x100
je 0x14002114e
cmp byte [rcx + 0x19], 4
jb 0x14002114e
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x18]
lea r8, [0x1400835a8]
call fcn.1400043e4
call qword [sym.imp.KERNEL32.dll_GetVersion]
nop dword [rax + rax]
cmp al, 5
jb 0x140021192
xor edx, edx
lea rcx, str.FaxMonWinClass3FD224BA_8556_47fb_B260_3E451BAE2793
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
test rax, rax
je 0x140021192
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4d5
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14002cf54
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rbp + 0x540], rax
mov rbx, rdx
mov dword [rsp + 0x40], AtlComQIPtrAssign
xor r12d, r12d
lea rdx, [rbp - 0x80]
mov ecx, 0x202
mov qword [r8], r12
mov r15, r9
mov rsi, r8
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x14002cfc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14002d134
xor r8d, r8d
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r8 + 0x17]
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
nop dword [rax + rax]
test eax, eax
je 0x14002d02c
xor r8d, r8d
mov dword [rsp + 0x40], InitCommonControls
lea rax, [rsp + 0x40]
mov rcx, rbx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea edx, [r8 + 2]
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14002d139
lea rcx, [rsp + 0x48]
jmp 0x14002d031
lea rcx, [rsp + 0x58]
mov edx, dword [rsp + 0x40]
lea rax, [rbp + 0x330]
mov r9d, 0x104
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], r9d
lea r8, [rbp + 0x120]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_GetNameInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14002d07e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14002d139
mov edx, 0x2e
lea rcx, [rbp + 0x120]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
nop dword [rax + rax]
test rax, rax
je 0x14002d09f
mov word [rax], r12w
mov edx, 0x7fffffff
lea rax, [rbp + 0x120]
mov ecx, edx
cmp word [rax], r12w
je 0x14002d0bd
add rax, 2
sub rcx, 1
jne 0x14002d0ad
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x14002d0d7
sub rdx, rcx
jmp 0x14002d0da
mov rdx, r12
mov rax, rcx
neg rax
sbb rdi, rdi
and rdi, rdx
test rcx, rcx
je 0x14002d131
inc rdi
lea rcx, [rdi + rdi]
call fcn.140010904
mov qword [rsi], rax
test rax, rax
je 0x14002d12c
lea r8, [rbp + 0x120]
mov rdx, rdi
mov rcx, rax
call fcn.14000e8c4
mov rcx, qword [rsi]
test eax, eax
js 0x14002d122
call fcn.1400125f4
mov dword [r15], eax
jmp 0x14002d131
call fcn.140010a58
mov qword [rsi], r12
jmp 0x14002d131
mov ebx, 0x8007000e
movzx ebx, bx
test r14d, r14d
jne 0x14002d145
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.14006e550
add rsp, 0x650
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002f370
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [str._b0_n_]
lea r15, str._b0_n_
cmp rcx, r15
je 0x14002f3c3
test dword [rcx + 0x1c], 0x100
je 0x14002f3c3
cmp byte [rcx + 0x19], 4
jb 0x14002f3c3
mov r9, qword [rdi + 0x28]
lea r8, [0x140088948]
mov rcx, qword [rcx + 0x10]
mov edx, 0x50
call fcn.14000faac
mov edx, 1
mov rcx, rdi
call fcn.14002fa70
lea rsi, [rdi + 0x310]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
test ebx, ebx
je 0x14002f425
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x14002f4b4
test dword [rcx + 0x1c], 0x100
je 0x14002f4b4
cmp byte [rcx + 0x19], 2
jb 0x14002f4b4
mov edx, 0x51
mov dword [rsp + 0x20], ebx
lea r9, str.CServerNode::StopBuildThread
jmp 0x14002f4a4
and dword [rdi + 0x340], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x14002f9f0]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
mov dword [rdi + 0x344], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov qword [rdi + 0x338], rax
test rax, rax
jne 0x14002f4b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._b0_n_]
cmp rcx, r15
je 0x14002f4b4
test dword [rcx + 0x1c], 0x100
je 0x14002f4b4
cmp byte [rcx + 0x19], 2
jb 0x14002f4b4
mov edx, 0x52
mov dword [rsp + 0x20], eax
lea r9, [0x140088788]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140088948]
call fcn.140004454
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test ebx, ebx
je 0x14002f4ce
and dword [rdi + 0x344], 0
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x140033b60
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1400a48d0]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor eax, eax
lea r8, str.__s_
mov r12, rdx
mov dword [rsp + 0x54], eax
mov r15, rcx
mov dword [rsp + 0x7c], eax
mov r9, rdx
lea rcx, [rbp - 0x70]
mov edx, 0x208
xor ebx, ebx
call fcn.140006aa0
mov edi, eax
test eax, eax
jns 0x140033c10
mov rcx, qword [str._b0_n_]
lea r14, str._b0_n_
cmp rcx, r14
je 0x140033bf5
test dword [rcx + 0x1c], 0x100
je 0x140033bf5
cmp byte [rcx + 0x19], 2
jb 0x140033bf5
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x2e]
mov r9d, eax
lea r8, [0x140088ed8]
call fcn.140004410
mov ecx, edi
movzx eax, di
and ecx, 0x1fff0000
mov ebx, edi
cmp ecx, 0x70000
cmove ebx, eax
jmp 0x140033d28
and qword [rsp + 0x28], rbx
lea rax, str.printto
and qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x20]
and qword [rsp + 0x58], rbx
xorps xmm0, xmm0
and qword [rsp + 0x70], rbx
and dword [rsp + 0x78], ebx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], WSAStartup
mov dword [rsp + 0x24], Ordinal_1284
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x50], 7
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
test eax, eax
jne 0x140033d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._b0_n_]
lea r14, str._b0_n_
cmp rcx, r14
je 0x140033cd0
test dword [rcx + 0x1c], 0x100
je 0x140033cd0
cmp byte [rcx + 0x19], 2
jb 0x140033cd0
mov rcx, qword [rcx + 0x10]
lea r8, [0x140088ed8]
mov edx, 0x2f
mov r9d, eax
call fcn.140004410
mov rcx, qword [str._b0_n_]
cmp ebx, 0x483
jne 0x140033cf8
mov rcx, r15
call fcn.14006b35c
test eax, eax
je 0x140033d52
mov rdx, r15
mov rcx, r12
call fcn.140033d64
mov rcx, qword [str._b0_n_]
mov ebx, eax
test ebx, ebx
je 0x140033d28
cmp rcx, r14
je 0x140033d28
test dword [rcx + 0x1c], 0x100
je 0x140033d28
cmp byte [rcx + 0x19], 2
jb 0x140033d28
mov rcx, qword [rcx + 0x10]
lea r8, [0x140088ed8]
mov edx, 0x30
mov r9d, ebx
call fcn.140004410
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14006e550
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [str._b0_n_]
jmp 0x140033cfc