joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e5e74
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400e5d07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e5d07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e5d07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e5d07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e5d07
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e5d07
cmp dword [rcx + 0xf8], 0
je 0x1400e5d07
mov ecx, ebx
call fcn.1400e5da8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400e5b98
cmp dword [rbp + 0x20], 0
je 0x1400e5d54
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400e5d5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400e5ca0
Function at 0x14010d704
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14010d724
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400edf50
or eax, 0xffffffff
jmp 0x14010d726
xor eax, eax
add rsp, 0x28
ret

Function at 0x140111d20
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea r8, [rsp + 0x80]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [rsp + 0x70], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.1400072d0
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x58], rax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x50], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_BitBlt]
mov edx, 0x18
lea rcx, [rsp + 0x90]
call fcn.1400045f0
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.140007570
nop
lea rdx, [rsp + 0xa8]
lea rcx, str.image_png
call fcn.140111f00
mov rcx, qword [rsp + 0xf0]
call fcn.140004a60
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400074b0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
lea rcx, [rsp + 0x90]
call fcn.1400076c0
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
nop
mov rcx, qword [rsp + 0xf0]
call fcn.1400167c0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0xe8
ret
Function at 0x140195f30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1c], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.14018cbb0
cmp dword [rsp + 0x60], 0
jne 0x140195fb0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.14018cbb0
add rsp, 0x48
ret
Function at 0x1401e21a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1401e21ff
mov rax, qword [rsp + 0x80]
movsx eax, word [rax + 0x3c]
test eax, eax
jne 0x1401e2214
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + 0x46]
test eax, eax
jne 0x1401e2214
mov rax, qword [rsp + 0x90]
mov dword [rax], 0
xor eax, eax
jmp 0x1401e235f
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x78]
call fcn.1401e5480
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x24]
call fcn.1401e5480
mov dword [rsp + 0x20], eax
jmp 0x1401e2241
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x20], eax
jl 0x1401e234f
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.1401e54c0
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x1401e2279
mov eax, dword [rsp + 0x3c]
jmp 0x1401e235f
mov dword [rsp + 0x30], 0x2000
mov ecx, dword [rsp + 0x88]
call fcn.1401e55b0
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x80]
call fcn.1401e63d0
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
movzx eax, ax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1401e2341
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
ja 0x1401e230a
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x78]
cmp dword [rsp + 0x2c], eax
jb 0x1401e230a
mov eax, dword [rsp + 0x28]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
cmp eax, dword [rsp + 0x88]
jne 0x1401e230a
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x44], 0
jne 0x1401e232f
mov ecx, 0x10855
call fcn.14011cbf0
jmp 0x1401e235f
mov ecx, dword [rsp + 0x34]
call fcn.1401e5590
mov dword [rsp + 0x34], eax
jmp 0x1401e229e
cmp dword [rsp + 0x38], 0
je 0x1401e234a
jmp 0x1401e234f
jmp 0x1401e2237
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x78
ret
Function at 0x1402000f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.140205f30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140200130
mov eax, 7
jmp 0x140200215
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x140200149
mov ecx, 0xc8
call fcn.1401ff010
test eax, eax
je 0x14020015d
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1400d9680
jmp 0x1402001c9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x140200220]
xor edx, edx
xor ecx, ecx
call fcn.1400e9d20
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1402001c9
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1400d9680
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x140200206
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
call qword [0x140213840]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret
Function at 0x1402002e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140121fb0
test eax, eax
je 0x140200305
jmp 0x140200540
mov ecx, 5
call fcn.140206920
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1402068a0
cmp dword [rsp + 0x50], 0
jle 0x14020032d
cmp qword [rsp + 0x58], 0
jne 0x140200353
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1402762f0]
mov dword [rcx + rax], 0
mov rcx, qword [rsp + 0x28]
call fcn.140206810
jmp 0x140200540
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1402762f0]
cmp dword [rcx + rax], 0
jne 0x140200441
xor ecx, ecx
call fcn.140206e80
mov qword [rsp + 0x30], rax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1402762f0]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.expand_32_byte_k
mov rcx, rax
call fcn.1400d8cf0
cmp qword [rsp + 0x30], 0
jne 0x1402003d4
mov eax, 4
imul rax, rax, 4
lea rcx, [0x1402762f0]
add rcx, rax
mov rax, rcx
mov r8d, 0x2c
xor edx, edx
mov rcx, rax
call fcn.1400d9680
jmp 0x1402003fc
mov eax, 4
imul rax, rax, 4
lea rcx, [0x1402762f0]
add rcx, rax
mov rax, rcx
mov r8, rax
mov edx, 0x2c
mov rcx, qword [rsp + 0x30]
call fcn.1402071b0
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1402762f0]
mov edx, 4
imul rdx, rdx, 0xf
lea r8, [0x1402762f0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1402762f0]
mov dword [rcx + rax], 0
mov byte [0x140276370], 0
xor eax, eax
cmp eax, 1
je 0x140200536
movzx eax, byte [0x140276370]
cmp dword [rsp + 0x50], eax
jg 0x14020049f
movsxd rax, dword [rsp + 0x50]
movzx ecx, byte [0x140276370]
sub ecx, dword [rsp + 0x50]
movsxd rcx, ecx
lea rdx, [0x140276330]
add rdx, rcx
mov rcx, rdx
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x20]
call fcn.1400d8cf0
movzx eax, byte [0x140276370]
sub eax, dword [rsp + 0x50]
mov byte [0x140276370], al
jmp 0x140200536
movzx eax, byte [0x140276370]
test eax, eax
jle 0x1402004ef
movzx eax, byte [0x140276370]
mov r8d, eax
lea rdx, [0x140276330]
mov rcx, qword [rsp + 0x20]
call fcn.1400d8cf0
movzx eax, byte [0x140276370]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
movzx eax, byte [0x140276370]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1402762f0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x1402762f0]
mov dword [rdx + rcx], eax
lea rdx, [0x1402762f0]
lea rcx, [0x140276330]
call fcn.140200550
mov byte [0x140276370], 0x40
jmp 0x140200441
mov rcx, qword [rsp + 0x28]
call fcn.140206810
add rsp, 0x48
ret
Function at 0x1400113c0
Capabilities:
Terminate process

Disassembly:
jmp 0x140017e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114a6
Capabilities:
Create tcp socket
Create thread
Create udp socket
Get hostname
Initialize winsock library
Resolve dns
Start tcp server

Disassembly:
jmp 0x140016060
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x700
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x124
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x140024018]
xor rax, rbp
mov qword [rbp + 0x6c8], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400116a9
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1c8], rax
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x308], rax
mov eax, 2
mov word [rbp + 0x328], ax
lea rcx, str.2222
call qword [sym.imp.ucrtbased.dll_atoi]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x32a], ax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x308]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
mov dword [rbp + 0x32c], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x328]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_bind]
mov edx, 0x7fffffff
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_listen]
movzx ecx, word [rbp + 0x32a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbp + 0x6c4], eax
mov ecx, dword [rbp + 0x32c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, dword [rbp + 0x6c4]
mov r8d, ecx
mov rdx, rax
lea rcx, str.Server_is_listening_on__s:_d_n
call fcn.140011339
lea rcx, [rbp + 0x358]
call fcn.1400111fe
nop
lea rdx, [0x140011271]
lea rcx, [rbp + 0x408]
call fcn.140011280
nop
xor eax, eax
cmp eax, 1
je 0x140016282
mov dword [rbp + 0x434], reloc.WS2_32.dll_recv
lea r8, [rbp + 0x434]
lea rdx, [rbp + 0x3b8]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbp + 0x398], rax
mov ecx, 0x18
call fcn.14001105a
mov qword [rbp + 0x6b8], rax
mov rax, qword [rbp + 0x6b8]
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x458]
mov rcx, qword [rbp + 0x398]
mov qword [rax], rcx
mov rax, qword [rbp + 0x458]
lea rcx, [rbp + 0x3b8]
lea rdi, [rax + 8]
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x458]
lea r8, [0x1400110b9]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400161ce
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
lea rcx, [rbp + 0x408]
call fcn.140011302
nop
lea rcx, [rbp + 0x358]
call fcn.140011109
lea rcx, [rbp - 0x30]
lea rdx, [0x140020480]
call fcn.1400115a0
mov rcx, qword [rbp + 0x6c8]
xor rcx, rbp
call fcn.14001135c
lea rsp, [rbp + 0x6d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400114ba
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019170
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019190
xor al, al
jmp 0x140019211
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400191a3
xor al, al
jmp 0x140019211
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400191cd
xor al, al
jmp 0x140019211
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400191e1
xor al, al
jmp 0x140019211
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400191f3
xor al, al
jmp 0x140019211
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001920f
xor al, al
jmp 0x140019211
mov al, 1
add rsp, 0x38
ret
Function at 0x140011613
Capabilities:
Create thread

Disassembly:
jmp 0x140013690
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
lea rcx, [0x14002a102]
call fcn.1400116a9
mov rcx, qword [rbp + 0x148]
call fcn.1400114fb
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.1400112d0
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.14001116d
nop
lea rcx, [rbp + 0x108]
call fcn.1400111b8
lea rax, [0x1400115ff]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x140]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400113e3
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x140]
mov qword [rcx], rax
mov rax, qword [rbp + 0x140]
cmp qword [rax], 0
je 0x140013779
lea rcx, [rbp + 8]
call fcn.140011154
jmp 0x140013792
mov rax, qword [rbp + 0x140]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400111a4
nop
lea rcx, [rbp + 8]
call fcn.1400111b8
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400115a0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400091a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140169600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140169bb8]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x140009207
cmp byte [rbx + 0x20d6], 0
jne 0x140009207
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140019b30
test sil, 1
je 0x14000933c
jmp 0x1400092a6
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400d7abc]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400d7ab4]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140169bb8]
mulss xmm0, dword [0x1400d7a4c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140019b30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400092f6
lea r11, [0x1400d0d50]
cmp r9b, 0x23
jne 0x1400092d9
cmp byte [r8], r9b
jne 0x1400092d9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400092c6
not ecx
call fcn.140017ed0
test rax, rax
je 0x14000933c
cmp byte [rax + 0xcf], 0
je 0x14000933c
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140019b30
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140004ee0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400cc080
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000c240
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14000c47e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140169600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400d0d50]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14000c446
mov rcx, rbp
call fcn.14000be60
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14000c311
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14000c301
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14000c2f9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14000c2fc
mov rdx, rcx
test rdx, rdx
jne 0x14000c2d0
cmp r8, r10
je 0x14000c311
cmp dword [r8], r9d
jne 0x14000c311
mov rcx, qword [r8 + 8]
jmp 0x14000c313
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14000c3a7
cmp qword [rcx + 0x18], 0
jne 0x14000c39c
mov qword [rcx + 0x18], rbx
jmp 0x14000c3a7
cmp qword [rcx + 0x20], 0
jne 0x14000c3a7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000c3dc
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000c3d0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140019b30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14000c438
cmp r9b, 0x23
jne 0x14000c41b
cmp byte [r8], r9b
jne 0x14000c41b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14000c408
not ecx
call fcn.140017ed0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14000c290
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cc080
add rsp, 0x58
pop rsi
pop rbp
ret