joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090064
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [section..data]
lea rsi, section..data
cmp rcx, rsi
je 0x1400900a4
test byte [rcx + 0x1c], 1
je 0x1400900a4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd678]
mov edx, 0x20
call fcn.1400062b0
xor edx, edx
mov rcx, rdi
call fcn.14008fb8c
mov ebx, eax
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x1400900e0
test byte [rcx + 0x1c], 2
je 0x1400900e0
cmp byte [rcx + 0x19], 4
jb 0x1400900e0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd678]
mov edx, 0x21
mov r9d, eax
call fcn.1400063c0
cmp ebx, 1
jne 0x14009013d
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 1
je 0x14009013d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14009013d
test byte [rcx + 0x1c], 2
je 0x14009013d
cmp byte [rcx + 0x19], 4
jb 0x14009013d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd678]
mov edx, 0x22
mov r9d, eax
call fcn.14000ad20
mov rcx, rdi
call fcn.14008f934
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140090175
test byte [rcx + 0x1c], 1
je 0x140090175
cmp byte [rcx + 0x19], 5
jb 0x140090175
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd678]
mov edx, 0x23
mov r9d, ebx
call fcn.1400063c0
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140091e58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [section..data]
lea rax, section..data
lea r12, [0x1400bd6b0]
cmp rcx, rax
je 0x140091eb1
test byte [rcx + 0x1c], 1
je 0x140091eb1
cmp byte [rcx + 0x19], 5
jb 0x140091eb1
mov rcx, qword [rcx + 0x10]
mov edx, 0x4a
mov r9, rbp
mov r8, r12
call fcn.1400062dc
mov rcx, qword [r14]
lea rax, [rsp + 0x70]
xor r15d, r15d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rsp + 0x70], r15d
mov rdx, rbp
mov dword [rsp + 0x88], r15d
mov edi, r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140091f14
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x140091f04
lea ebx, [r15 + 0xd]
jmp 0x140091f14
mov edi, dword [rsp + 0x70]
mov ebx, r15d
shr edi, 1
mov dword [rsp + 0x88], edi
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140091f50
test byte [r10 + 0x1c], 2
je 0x140091f50
cmp byte [r10 + 0x19], 4
jb 0x140091f50
mov rcx, qword [r10 + 0x10]
mov edx, 0x4b
mov r9d, ebx
mov r8, r12
call fcn.14000ad20
mov r10, qword [section..data]
test ebx, ebx
jne 0x140092037
mov r8, qword [rsi]
lea edx, [rdi + 2]
lea ecx, [rbx + 1]
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
sub eax, edx
or ecx, eax
jge 0x140091f7a
mov rcx, rsi
call fcn.140005c2c
mov r8, qword [rsi]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r14
call fcn.140013998
mov ebx, eax
mov rcx, qword [section..data]
lea rdi, section..data
cmp rcx, rdi
je 0x140091fc2
test byte [rcx + 0x1c], 2
je 0x140091fc2
cmp byte [rcx + 0x19], 4
jb 0x140091fc2
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r9d, eax
mov r8, r12
call fcn.14000ad20
mov rcx, qword [rsi]
test ebx, ebx
je 0x140091fce
mov eax, r15d
jmp 0x140091fe9
test rcx, rcx
je 0x140091fc9
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140091fd7
test eax, eax
js 0x14009208f
cmp eax, dword [rcx - 0xc]
jg 0x14009208f
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], r15w
mov r10, qword [section..data]
cmp r10, rdi
je 0x140092073
test byte [r10 + 0x1c], 2
je 0x14009203e
cmp byte [r10 + 0x19], 4
jb 0x14009203e
mov r9, qword [rsi]
mov edx, 0x4d
mov rcx, qword [r10 + 0x10]
mov r8, r12
call fcn.1400062dc
mov r10, qword [section..data]
jmp 0x14009203e
lea rdi, section..data
cmp r10, rdi
je 0x140092073
test byte [r10 + 0x1c], 1
je 0x140092073
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140092073
mov rcx, qword [r10 + 0x10]
mov edx, 0x4e
mov r9d, ebx
mov r8, r12
call fcn.14000ad20
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.1400055a0
int3
Function at 0x140094008
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x1400cd220]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r8
mov esi, edx
mov rdi, rcx
mov rax, qword [section..data]
lea r12, section..data
cmp rax, r12
je 0x14009407d
test byte [rax + 0x1c], 1
je 0x14009407d
cmp byte [rax + 0x19], 5
jb 0x14009407d
mov r9, rcx
mov dword [rsp + 0x20], esi
mov rcx, qword [rax + 0x10]
lea r8, [0x1400bd770]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1400348dc
mov rax, qword [section..data]
xor ebx, ebx
lea ebp, [rbx + 2]
lea r15d, [rbx + 0x17]
cmp bp, word [rdi]
je 0x14009409b
cmp r15w, word [rdi]
je 0x14009409b
mov ebx, 0x80070057
jmp 0x14009417c
mov dword [rsp + 0x30], ebp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
mov r9d, 0x401
mov edx, 0x80
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getnameinfo]
nop dword [rax + rax]
test eax, eax
je 0x14009412b
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
jg 0x1400940e2
mov ecx, eax
jmp 0x1400940ec
movzx ecx, r9w
or ecx, 0x80070000
test ecx, ecx
mov eax, 0x80004005
cmovns ecx, eax
mov ebx, ecx
mov rax, qword [section..data]
cmp rax, r12
je 0x1400941ba
test byte [rax + 0x1c], bpl
je 0x14009417c
cmp byte [rax + 0x19], bpl
jb 0x14009417c
mov rcx, qword [rax + 0x10]
lea r8, [0x1400bd770]
mov edx, SafeArrayUnlock
call fcn.14000ad20
jmp 0x140094175
test esi, esi
je 0x140094168
cmp r15w, word [rdi]
jne 0x140094168
mov edx, 0x25
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strchr]
nop dword [rax + rax]
test rax, rax
je 0x140094152
mov byte [rax], bl
lea r8, [rsp + 0x40]
mov rcx, r14
lea rdx, str.__hs_
call fcn.140007774
jmp 0x140094175
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14002e0e8
mov rax, qword [section..data]
cmp rax, r12
je 0x1400941ba
test byte [rax + 0x1c], 1
je 0x1400941ba
movzx ecx, byte [rax + 0x19]
mov edx, ebx
sar edx, 0x1f
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x1400941ba
mov rcx, qword [r14]
lea r8, [0x1400bd770]
mov qword [rsp + 0x20], rcx
mov edx, SafeArrayUnlock
mov rcx, qword [rax + 0x10]
mov r9d, ebx
call fcn.1400195b0
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140003680
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400941f0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [section..data]
lea r14, section..data
lea r15, [0x1400bd770]
cmp rcx, r14
je 0x140094248
test byte [rcx + 0x1c], 1
je 0x140094248
cmp byte [rcx + 0x19], 5
jb 0x140094248
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, r15
call fcn.14003274c
xor edx, edx
mov r8d, 0x80
mov rcx, rsi
xor ebx, ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and qword [rsp + 0x90], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [section..data]
cmp rcx, r14
je 0x1400942a6
test byte [rcx + 0x1c], 2
je 0x1400942a6
cmp byte [rcx + 0x19], 5
jb 0x1400942a6
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rdi
mov r8, r15
call fcn.1400062dc
lea r9, [rsp + 0x90]
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14009431f
jg 0x1400942ce
mov ebx, eax
jmp 0x1400942d7
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov ecx, 0x80004005
cmovns ebx, ecx
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009439d
test byte [rcx + 0x1c], 2
je 0x14009439d
cmp byte [rcx + 0x19], 2
jb 0x14009439d
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r9d, ebx
mov dword [rsp + 0x20], eax
mov r8, r15
call fcn.140019560
jmp 0x14009439d
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x10]
cmp r9, 0x80
jbe 0x14009435c
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094355
test byte [rcx + 0x1c], 2
je 0x140094355
cmp byte [rcx + 0x19], 2
jb 0x140094355
mov rcx, qword [rcx + 0x10]
call fcn.140096234
mov ebx, 0x80004005
jmp 0x14009439d
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094385
test byte [rcx + 0x1c], 2
je 0x140094385
cmp byte [rcx + 0x19], 5
jb 0x140094385
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r8, r15
call fcn.14004a97c
mov rdx, qword [rsp + 0x90]
mov rcx, rsi
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
nop dword [rax + rax]
mov r10, qword [section..data]
cmp r10, r14
je 0x1400943fd
test byte [r10 + 0x1c], 1
je 0x1400943fd
movzx eax, byte [r10 + 0x19]
mov ecx, ebx
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x1400943fd
test ebx, ebx
js 0x1400943e1
movzx eax, word [rsi]
jmp 0x1400943e4
or eax, 0xffffffff
mov rcx, qword [r10 + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, ebx
mov word [rsp + 0x20], ax
mov r8, r15
call fcn.1400963f8
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140094a74
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rcx, qword [section..data]
lea r14, section..data
mov ebp, 1
cmp rcx, r14
je 0x140094ab0
test byte [rcx + 0x1c], bpl
je 0x140094ab0
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x16]
lea r8, [0x1400bd770]
call fcn.1400062b0
and qword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsMediaPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140094b7c
and dword [rsp + 0x60], eax
lea r9, [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.PreventLibrarySharing
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rbx, rsi
test eax, eax
jne 0x140094b7e
cmp dword [rsp + 0x70], 4
mov edi, ebp
mov r9d, ebp
jne 0x140094b83
cmp dword [rsp + 0x60], ebp
jne 0x140094b83
mov rcx, qword [section..data]
xor edi, edi
cmp rcx, r14
je 0x140094bb0
xor r9d, r9d
test byte [rcx + 0x1c], 2
je 0x140094b8a
cmp byte [rcx + 0x19], 3
jb 0x140094b8a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x18]
lea r8, [0x1400bd770]
call fcn.1400062b0
xor r9d, r9d
jmp 0x140094b83
xor ebx, ebx
mov r9d, ebp
mov edi, ebp
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094bb0
test byte [rcx + 0x1c], bpl
je 0x140094bb0
cmp byte [rcx + 0x19], 5
jb 0x140094bb0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd770]
mov edx, DispGetParam
call fcn.14000637c
test rbx, rbx
je 0x140094bc4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400988ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
lea rax, section..data
mov rcx, qword [section..data]
cmp rcx, rax
je 0x140098912
test byte [rcx + 0x1c], 1
je 0x140098912
cmp byte [rcx + 0x19], 5
jb 0x140098912
mov edx, 0x4a
mov qword [r11 - 0x58], r8
mov r9, rsi
lea r8, [0x1400bd838]
mov rcx, qword [rcx + 0x10]
call fcn.140019374
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
mov rbx, qword [rbp - 0x28]
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.140099454
mov edi, eax
test eax, eax
jne 0x1400989db
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x1400989cc
cmp eax, 2
jne 0x140098a05
mov edi, 0x490
mov r10, qword [section..data]
lea rsi, section..data
cmp r10, rsi
je 0x140098a4d
test byte [r10 + 0x1c], al
je 0x140098a13
cmp byte [r10 + 0x19], 4
jb 0x140098a13
lea edx, [rax + 0x49]
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.1400062b0
jmp 0x140098a0c
mov eax, dword [rbp - 0x2c]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
jmp 0x140098a05
cmp eax, 2
jne 0x140098a05
mov rax, qword [r15]
movabs r10, 0x9f351e90765dd070
mov r9, r12
mov r8, r14
mov rdx, rsi
mov rcx, r15
mov rax, qword [rax + 0x38]
call qword [case.0x140071786.0]
mov edi, eax
lea rsi, section..data
mov r10, qword [section..data]
cmp r10, rsi
je 0x140098a4d
test byte [r10 + 0x1c], 1
je 0x140098a4d
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140098a4d
mov edx, 0x4c
mov r9d, edi
lea r8, [0x1400bd838]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140098a79
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140098a8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14009cd90
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov ebp, ecx
mov r10, qword [section..data]
lea r13, section..data
cmp r10, r13
je 0x14009cdee
test byte [r10 + 0x1c], 2
je 0x14009cdee
cmp byte [r10 + 0x19], 5
jb 0x14009cdee
mov r9d, ecx
lea r8, [0x1400bd9e8]
mov rcx, qword [r10 + 0x10]
mov edx, 0x1c
call fcn.14000637c
mov r10, qword [section..data]
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov edi, ebx
mov ecx, ebx
test rsi, rsi
jne 0x14009ce07
mov edi, 0x80070057
jmp 0x14009cf21
xor r9d, r9d
mov qword [rsi], rbx
lea rax, [rsp + 0x68]
xor r8d, r8d
mov ecx, ebp
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
mov r15d, 0xa
cmp eax, 0x6f
jne 0x14009ce73
mov rcx, qword [rsi]
call fcn.140003b28
mov ecx, dword [rsp + 0x68]
call fcn.140003b34
lea rcx, [rsp + 0x68]
mov qword [rsi], rax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov r9, rax
mov ecx, ebp
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
add r15d, 0xffffffff
jne 0x14009ce32
test eax, eax
je 0x14009ced3
jg 0x14009ce7d
mov edi, eax
jmp 0x14009ce86
movzx edi, ax
or edi, 0x80070000
test edi, edi
mov ecx, 0x80004005
cmovns edi, ecx
mov r10, qword [section..data]
cmp r10, r13
je 0x14009cf0b
test byte [r10 + 0x1c], 0x20
je 0x14009cecd
cmp byte [r10 + 0x19], 2
jb 0x14009cecd
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400bd9e8]
mov edx, 0x1e
mov dword [rsp + 0x20], eax
mov r9d, edi
call fcn.140019560
mov r10, qword [section..data]
test edi, edi
js 0x14009cf0b
jmp 0x14009ceda
mov r10, qword [section..data]
mov ecx, dword [rsp + 0x68]
cmp ecx, 0x1c0
jae 0x14009cf21
mov edi, 0x8000ffff
cmp r10, r13
je 0x14009cf0b
test byte [r10 + 0x1c], 0x20
je 0x14009cf0b
cmp byte [r10 + 0x19], 2
jb 0x14009cf0b
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
call fcn.14009d7e0
mov rcx, qword [rsi]
call fcn.140003b28
mov ecx, dword [rsp + 0x68]
mov r10, qword [section..data]
mov qword [rsi], rbx
test r14, r14
je 0x14009cf37
test edi, edi
mov eax, ebx
cmovns eax, ecx
mov dword [r14], eax
mov r10, qword [section..data]
cmp r10, r13
je 0x14009cf8c
test byte [r10 + 0x1c], 2
je 0x14009cf8c
movzx eax, byte [r10 + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x14009cf8c
test r14, r14
je 0x14009cf61
mov eax, dword [r14]
jmp 0x14009cf63
mov eax, ebx
test rsi, rsi
je 0x14009cf6b
mov rbx, qword [rsi]
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400bd9e8]
mov dword [rsp + 0x28], eax
mov edx, 0x20
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.140019a08
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14009e150
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [section..data]
lea r15, section..data
cmp rcx, r15
je 0x14009e193
test byte [rcx + 0x1c], 2
je 0x14009e193
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd9f8]
mov edx, 0xa
call fcn.1400062b0
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
mov ecx, eax
lea rdx, [0x1400be828]
call fcn.140004f18
mov rsi, rax
test rax, rax
je 0x14009e265
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0x7a
je 0x14009e1e6
cmp eax, 0x6f
jne 0x14009e1fd
mov rcx, rsi
call fcn.140003b28
xor esi, esi
inc ebx
cmp ebx, 3
jae 0x14009e212
mov eax, dword [rsp + 0x58]
jmp 0x14009e19e
test edi, edi
jg 0x14009e205
mov ebx, edi
jmp 0x14009e20e
movzx ebx, di
or ebx, 0x80070000
test ebx, ebx
js 0x14009e26a
test edi, edi
jg 0x14009e21a
mov ebx, edi
jmp 0x14009e223
movzx ebx, di
or ebx, 0x80070000
test ebx, ebx
js 0x14009e26a
mov qword [rbp + 0x10], rsi
xor esi, esi
call fcn.140004e38
test al, al
je 0x14009e26a
call qword [sym.imp.ext_ms_win_casting_receiver_l1_1_0.dll_GetXboxWirelessNetworkInterfaceIndex]
nop dword [rax + rax]
test eax, eax
je 0x14009e26a
mov rcx, qword [rbp + 0x10]
jmp 0x14009e255
cmp dword [rcx + 4], eax
je 0x14009e25c
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14009e24c
jmp 0x14009e26a
mov dword [rcx + 0x64], 0x47
jmp 0x14009e26a
mov ebx, 0x8007000e
mov rcx, rsi
call fcn.140003b28
mov rcx, qword [section..data]
cmp rcx, r15
je 0x14009e2b4
test byte [rcx + 0x1c], 2
je 0x14009e2b4
movzx edx, byte [rcx + 0x19]
mov r9d, ebx
sar r9d, 0x1f
and r9d, 0xfffffffd
add r9d, 5
cmp edx, r9d
jl 0x14009e2b4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd9f8]
mov edx, SafeArrayDestroy
mov r9d, ebx
call fcn.14000637c
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x1400084e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140008579
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x58]
mov edi, eax
mov eax, 4
mov dword [rsp + 0x24], 0
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x1400e7520], ecx
jle 0x140008560
lea rcx, [0x1400e7520]
call fcn.14008ccb0
cmp dword [0x1400e7520], 0xffffffff
jne 0x140008560
lea rcx, [0x140092c70]
call fcn.14008d2fc
lea rcx, [0x1400e7520]
call fcn.14008cc44
lea rax, [0x1400bc0d0]
mov dword [rsp + 0x20], edi
test edi, edi
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x50]
jne 0x14000858e
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008cbe0
add rsp, 0x40
pop rbx
ret
lea rdx, [0x140095c40]
lea rcx, [rsp + 0x20]
call fcn.1400083b0
int3

Function at 0x140008960
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov qword [rsp + 0x20], rbx
lea r8, str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.140003f30
lea r8, [rsp + 0x40]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x1400089d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140008a52
cmp eax, 0xb7
jne 0x1400089e8
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rbx], 0
jne 0x140008a21
lea rcx, [rbx + 8]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x140008a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140008a52
mov byte [rbx], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140008a52
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14008cbe0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140008ad0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400e7348], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x140008b4d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008cbe0
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.140008870]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008cbe0
add rsp, 0x40
pop rbx
ret