joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002dbf0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 8], r8
jne 0x14002dd4f
mov rsi, r8
test r8, r8
je 0x14002dd4f
mov rdi, rdx
mov rbx, qword [rcx]
xor eax, eax
cmp rsi, 4
jb 0x14002dc70
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x20
jb 0x14002dc70
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x14002dc40
cmp rax, rsi
je 0x14002dcee
mov r8, rax
not r8
add r8, rsi
mov r9, rsi
and r9, 3
je 0x14002dd40
nop word cs:[rax + rax]
lea rdx, [rax + 1]
mov r10, qword [rbx + rax*8]
not r10
mov qword [rdi + rax*8], r10
mov rax, rdx
dec r9
jne 0x14002dc90
cmp r8, 3
jb 0x14002dcee
nop dword [rax]
mov rax, qword [rbx + rdx*8]
not rax
mov qword [rdi + rdx*8], rax
mov rax, qword [rbx + rdx*8 + 8]
not rax
mov qword [rdi + rdx*8 + 8], rax
mov rax, qword [rbx + rdx*8 + 0x10]
not rax
mov qword [rdi + rdx*8 + 0x10], rax
mov rax, qword [rbx + rdx*8 + 0x18]
not rax
mov qword [rdi + rdx*8 + 0x18], rax
lea rax, [rdx + 4]
mov rdx, rax
cmp rsi, rax
jne 0x14002dcb0
test rsi, rsi
je 0x14002dd4f
or byte [rdi], 1
mov r14, rsi
shl r14, 6
sub r14, qword [rcx + 0x20]
je 0x14002dd36
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.1401933c0
dec r14
jne 0x14002dd20
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdx, rax
cmp r8, 3
jae 0x14002dcb0
jmp 0x14002dcee
ud2
Function at 0x140038bd0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140038c30
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x140038bf8
add rdi, rbx
sub rsi, rbx
je 0x140038c30
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140038bf0
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140038bf0
mov al, 1
jmp 0x140038c32
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140056de0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140056e22
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140056e2a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140056e3b
jmp 0x140056e52
xor r10d, r10d
jmp 0x140056edd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140056e52
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140056e69
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140056e89
add r11, r8
jmp 0x140056fba
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140056f52
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140056f00
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140056f70
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140056f82
jmp 0x140056f9c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140056f9c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140056fb6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140063fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140063fe2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140063fea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140063ffb
jmp 0x140064012
xor r10d, r10d
jmp 0x14006409d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140064012
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140064029
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140064049
add r11, r8
jmp 0x14006417a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140064112
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400640c0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140064130
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140064142
jmp 0x14006415c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14006415c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140064176
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140064970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400649b3
cmp qword [rbx + 0x10], 0x11
jb 0x1400649a2
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
movabs rbx, 0x8000000000000000
mov rdi, qword [rsi + 0x20]
mov r14, qword [rsi + 0x28]
mov rcx, rdi
call qword [r14]
cmp qword [r14 + 8], 0
je 0x1400649ee
cmp qword [r14 + 0x10], 0x11
jb 0x1400649dd
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsi + 0x2d8]
cmp rax, rbx
je 0x140064a14
test rax, rax
je 0x140064a14
mov r8, qword [rsi + 0x2e0]
mov rcx, qword [0x14024a138]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsi + 0x2f0]
cmp rax, rbx
je 0x140064a8b
mov rdi, qword [rsi + 0x300]
test rdi, rdi
je 0x140064a71
mov r14, qword [rsi + 0x2f8]
add r14, 8
jmp 0x140064a49
add r14, 0x18
dec rdi
je 0x140064a6a
mov rax, qword [r14 - 8]
cmp rax, rbx
je 0x140064a40
test rax, rax
je 0x140064a40
mov r8, qword [r14]
mov rcx, qword [0x14024a138]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140064a40
mov rax, qword [rsi + 0x2f0]
test rax, rax
je 0x140064a8b
mov r8, qword [rsi + 0x2f8]
mov rcx, qword [0x14024a138]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r15, qword [rsi + 0x70]
test r15, r15
je 0x140064b13
mov rax, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x58]
mov rdi, qword [rsi + 0x60]
xor r8d, r8d
cmp rax, rdx
mov rcx, rdx
cmovb rcx, r8
mov r9, rax
sub r9, rcx
mov r12, rdx
sub r12, r9
lea r13, [r9 + r15]
cmp r12, r15
cmovb r13, rdx
mov r14, r15
sub r14, r12
cmovb r14, r8
sub r13, r9
jne case.0x1400607ce.121
Function at 0x140071df0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x14024a149]
mov edx, 0x10
xor ecx, ecx
call fcn.140080d30
test rax, rax
je 0x140071eb8
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140071ec0]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140071eab
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140071e86
cmp qword [rbx + 0x10], 0x11
jb 0x140071e75
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x1400729e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1401a7060]
test ecx, ecx
je 0x140072a10
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140072a29
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140072a29
add rdi, 0x10
jmp 0x140072ae5
lea rcx, [0x1401a7048]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400729fd
mov ecx, dword [0x1401a7060]
test ecx, ecx
je 0x140072ac6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140072ae3
mov rsi, rax
test rax, rax
jne 0x140072a95
movzx eax, byte [0x14024a149]
mov edx, 0x18
xor ecx, ecx
call fcn.140080d30
test rax, rax
je 0x140072aff
mov rsi, rax
lea rax, [0x1401a7048]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1401a7060]
test ecx, ecx
je 0x140072aef
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140072ae5
test rcx, rcx
je 0x140072ae5
lock dec qword [rcx]
jne 0x140072ae5
call fcn.1400833d0
jmp 0x140072ae5
lea rcx, [0x1401a7048]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140072a48
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401a7048]
call fcn.140082e00
mov ecx, eax
jmp 0x140072a8d
ud2

Function at 0x140072b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1401a70a8]
test ecx, ecx
je 0x140072b40
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140072b59
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140072b59
add rdi, 0x10
jmp 0x140072c15
lea rcx, [0x1401a7090]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140072b2d
mov ecx, dword [0x1401a70a8]
test ecx, ecx
je 0x140072bf6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140072c13
mov rsi, rax
test rax, rax
jne 0x140072bc5
movzx eax, byte [0x14024a149]
mov edx, 0x18
xor ecx, ecx
call fcn.140080d30
test rax, rax
je 0x140072c2f
mov rsi, rax
lea rax, [0x1401a7090]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1401a70a8]
test ecx, ecx
je 0x140072c1f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140072c15
test rcx, rcx
je 0x140072c15
lock dec qword [rcx]
jne 0x140072c15
call fcn.1400c5730
jmp 0x140072c15
lea rcx, [0x1401a7090]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140072b78
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401a7090]
call fcn.140082e00
mov ecx, eax
jmp 0x140072bbd
ud2
Function at 0x140073c90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140073cee
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140073cee
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140073cee
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140073cee
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140073d2e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140073d1c
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
add rsp, 0x38
ret

Function at 0x140073d40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140073d9e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140073d9e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140073d9e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140073d9e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140073dde
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140073dcc
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
add rsp, 0x38
ret
Function at 0x14007d010
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x14007d032
mov qword [rsi + 8], rbx
mov qword [rsi], 1
jmp 0x14007d0fe
mov rax, qword [0x14024a0f0]
cmp rax, 3
jne 0x14007d107
movzx edx, word [rbx]
lea rcx, [rsp + 0x20]
call fcn.140081150
cmp qword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x28]
je 0x14007d06d
mov qword [rsi + 8], rdi
mov qword [rsi], 1
jmp 0x14007d0fe
cmp word [rbx], 0
je 0x14007d08e
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x14007d0a3
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x20], r9w
mov word [rsp + 0x22], cx
mov dword [rsp + 0x24], eax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
je 0x14007d0de
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x14007d0fe
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14007ff80
jmp 0x14007d043

Function at 0x14007e150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.14007ed10
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, r14
je 0x14007e1b3
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14007bfe0
mov rbx, qword [rsp + 0x28]
cmp rbx, r14
jne 0x14007e21c
mov rax, qword [rsp + 0x30]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x14007e20d
test rcx, rcx
je 0x14007e20d
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, rbx
call qword [r15]
cmp qword [r15 + 8], 0
je 0x14007e1fc
cmp qword [r15 + 0x10], 0x11
jb 0x14007e1eb
mov rbx, qword [rbx - 8]
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov qword [rsi], r14
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14007e240
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14007e210
mov qword [rsi], r14
test rbx, rbx
je 0x14007e210
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
Function at 0x14007ffe0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140003c80
mov rax, qword [rsp + 0x30]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140080078
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1400800ae
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x1400800cc
jmp 0x1400800dd
lea rcx, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rcx
mov qword [rsi], 1
test rax, rax
je 0x1400800dd
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x14024a138]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x1400800dd
mov rcx, qword [0x14024a138]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400800f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1401a7080]
test ecx, ecx
je 0x14008018d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140080119
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x140080187
mov ecx, dword [0x1401a7080]
test ecx, ecx
je 0x1400801af
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400801cc
mov rsi, rax
test rax, rax
jne 0x140080181
movzx eax, byte [0x14024a149]
mov edx, 0x10
xor ecx, ecx
call fcn.140080d30
test rax, rax
je 0x1400801e7
mov rsi, rax
lea rax, [0x1401a7068]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1401a7080]
test ecx, ecx
je 0x1400801d7
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400801ce
lea rcx, [0x1401a7068]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140080110
jmp 0x140080119
lea rcx, [0x1401a7068]
call fcn.140082e00
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140080138
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401a7068]
call fcn.140082e00
mov ecx, eax
jmp 0x140080179
ud2
Function at 0x140080e40
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1401cc9a0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x140080eaa
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140080eb9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140080ef0
cmp eax, 0x103
je 0x140080efa
test eax, eax
js 0x140080ed6
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140080ef0
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400772c0
mov rcx, rax
call fcn.1400b05b0
mov ecx, 7
int 0x29
ud2

Function at 0x140081040
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1401cc9a0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1400810b1
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400810e7
test eax, eax
js 0x1400810c2
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400810da
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400772c0
mov rcx, rax
call fcn.1400b05b0
mov ecx, 7
int 0x29
ud2
Function at 0x140081150
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test dx, dx
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008119e
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008120e
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x1400811b1
cmp eax, 0x2739
jne 0x1400811fb
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400811f6
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x140081215
mov qword [rsi + 8], rdi
jmp 0x140081195
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x38
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp sub.ws2_32.dll_closesocket