joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b970
Capabilities:
Get user security identifier

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0xaaaaaaaa
cmp byte [rdx + 0x17], 0
jns 0x14009b9bc
mov rdx, qword [rdi]
lea r12, [rsp + 0x44]
mov qword [rsp + 0x30], r12
lea r13, [rsp + 0x48]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x4c]
xor ecx, ecx
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov r14d, dword [rbx]
mov rcx, r14
xor edx, edx
call section..text
mov rbx, rax
test rax, rax
jne 0x14009ba1f
cmp byte [0x14032e540], 1
jne 0x14009ba1d
call fcn.1401a9dec
test rax, rax
je 0x14009ba1d
mov rcx, r14
call qword [0x1402cbd20]
test eax, eax
jne 0x14009b9eb
xor ebx, ebx
mov r15d, dword [rsp + 0x48]
add r15, r15
mov rcx, r15
xor edx, edx
call section..text
mov r14, rax
test rax, rax
jne 0x14009ba5c
cmp byte [0x14032e540], 1
jne 0x14009ba59
call fcn.1401a9dec
test rax, rax
je 0x14009ba59
mov rcx, r15
call qword [0x1402cbd20]
test eax, eax
jne 0x14009ba27
xor r14d, r14d
cmp byte [rdi + 0x17], 0
jns 0x14009ba65
mov rdi, qword [rdi]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x4c]
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x14009babf
lea rdi, [rsp + 0x38]
mov qword [rdi], 0
mov rcx, rbx
mov rdx, rdi
call sub.ADVAPI32.dll_ConvertSidToStringSidA
mov rdx, qword [rdi]
test rdx, rdx
je 0x14009babf
lea rcx, [rsp + 0x50]
call fcn.1401907b0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
xor edx, edx
call fcn.140001b10
mov rcx, r14
xor edx, edx
call fcn.140001b10
movsx rax, byte [rsp + 0x67]
mov rcx, rax
test rax, rax
jns 0x14009bae6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14009bb26
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14009bb13
call fcn.1401ac870
int3
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
mov byte [rsi + 0x17], cl
mov byte [rsi], cl
test al, al
jns 0x14009bafc
mov rcx, qword [rsp + 0x50]
call fcn.1401a9dc4
jmp 0x14009bafc
Function at 0x14009c0b0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsx rax, byte [rcx + 0x17]
test rax, rax
mov r8, qword [rcx + 8]
mov rdx, rax
cmovs rdx, r8
test rdx, rdx
je 0x14009c210
movsx rdx, byte [rsi + 0x17]
test rdx, rdx
jns 0x14009c0fa
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x14009c210
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], r15
movaps xmm0, xmmword [0x140299a90]
movaps xmmword [rsp + 0x50], xmm0
test al, al
js 0x14009c227
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x50], xmm0
lea rbx, [rsp + 0x50]
mov al, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
mov rdx, rbx
cmovs rdx, rcx
cmp word [rdx], 0x5c
jne 0x14009c16d
lea r14, [rsp + 0x50]
mov r8d, 1
mov rcx, r14
xor edx, edx
call fcn.1401199d0
mov al, byte [r14 + 0x17]
mov rcx, qword [r14]
lea rdx, [rsp + 0x48]
mov qword [rdx], r15
test al, al
cmovs rbx, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14009c1ff
movzx eax, byte [rdi + 0x17]
test al, al
cmovs eax, dword [rdi + 8]
cmovs rdi, qword [rdi]
lea eax, [rax*2 + 2]
cmp byte [rsi + 0x17], 0
jns 0x14009c1d4
mov rsi, qword [rsi]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0x67], 0
jns 0x14009c210
mov rcx, qword [rsp + 0x50]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14009c239
call fcn.1401ac870
int3
mov rdx, qword [rcx]
lea rcx, [rsp + 0x50]
call fcn.14015b370
jmp 0x14009c137
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a1630
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor eax, eax
mov qword [rsp + 0xf0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x70], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [0x140299a90]
movaps xmmword [rsp + 0x50], xmm0
cmp byte [0x1402ebdaf], 0
js 0x1400a17b7
mov rax, qword [0x1402ebda8]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [0x1402ebd98]
movaps xmmword [rsp + 0x50], xmm0
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1400a16e9
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.140174f40
lea rdx, [0x14029ee93]
mov r8d, 1
mov rcx, rdi
call fcn.140174f40
cmp byte [rdi + 0x17], 0
jns 0x1400a1719
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400a1782
mov rcx, qword [rsp + 0x70]
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x70]
call rsi
cmp byte [rsp + 0x67], 0
jns 0x1400a1793
mov rcx, qword [rsp + 0x50]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400a17ad
call fcn.1401ac870
int3
add rsp, 0x108
pop rdi
pop rsi
ret
mov r8, qword [0x1402ebda0]
mov rdx, qword [0x1402ebd98]
lea rcx, [rsp + 0x50]
call fcn.140118510
jmp 0x1400a16d8
Function at 0x1400a1960
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140299a90]
movaps xmmword [rsp + 0x70], xmm0
movsx rax, byte [rcx + 0x17]
mov rbx, rcx
test rax, rax
jns 0x1400a19ba
mov rbx, qword [rdi]
mov rax, qword [rdi + 8]
lea r14, [rax + rax]
test r14, r14
je 0x1400a1a9c
movzx ecx, word [rbx + r14 - 2]
add r14, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x1400a1a27
cmp ecx, 0x2f
jne 0x1400a19be
jmp 0x1400a1a27
mov rax, r14
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r12d, Ordinal_14
cmovne r12, rcx
test r12, r12
js 0x1400a1ba2
lea rcx, [r12 + r12]
call fcn.1401a9d88
mov rcx, rax
mov qword [rsp + 0x70], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r14
jmp 0x1400a1a59
cmp r14, 0xfffffffffffffffe
je 0x1400a1a9c
movabs r15, 0x7ffffffffffffff7
sar r14, 1
cmp rax, r14
cmovb r14, rax
cmp r14, r15
ja 0x1400a1b96
cmp r14, 0xa
ja 0x1400a19dd
lea rcx, [rsp + 0x70]
mov byte [rcx + 0x17], r14b
lea r15, [rcx + r14*2]
cmp rbx, rcx
jb 0x1400a1a6b
cmp rbx, r15
jb 0x1400a1ba0
test r14, r14
je 0x1400a1a7e
add r14, r14
mov rdx, rbx
mov r8, r14
call fcn.1401e56b0
mov word [r15], 0
cmp byte [rsp + 0x87], 0
js 0x1400a1a95
lea rcx, [rsp + 0x70]
jmp 0x1400a1aaa
mov rcx, qword [rsp + 0x70]
jmp 0x1400a1aaa
lea rcx, [rsp + 0x70]
mov byte [rcx + 0x17], 0
mov word [rcx], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
test cl, al
jne 0x1400a1ae1
cmp byte [rsp + 0x87], 0
js 0x1400a1ad1
lea rdx, [rsp + 0x70]
jmp 0x1400a1ad6
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, rdi
mov rdx, rsi
call fcn.1401fb930
mov ebx, eax
test al, al
jne 0x1400a1b55
xorps xmm0, xmm0
lea r9, [rsp + 0x50]
movaps xmmword [r9], xmm0
xor eax, eax
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x30]
mov qword [r8 + 0x10], rax
movaps xmmword [r8], xmm0
lea rsi, [rsp + 0x90]
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm0
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov edx, 0x86
call fcn.140098460
cmp byte [rsi + 0x17], 0
jns 0x1400a1b44
mov rcx, qword [rsp + 0x90]
call fcn.1401a9dc4
cmp byte [rsp + 0x47], 0
jns 0x1400a1b55
mov rcx, qword [rsp + 0x30]
call fcn.1401a9dc4
cmp byte [rsp + 0x87], 0
jns 0x1400a1b69
mov rcx, qword [rsp + 0x70]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400a1b83
call fcn.1401ac870
int3
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
call fcn.1401e97e0
ud2
call fcn.1401e9820
int3
Function at 0x1400ab3c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
cmp word [rax], 0x5a4d
jne 0x1400ab3ec
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400ab3ec
cmp word [rax + rcx + 0x14], 0xf0
jne 0x1400ab3ec
cmp word [rax + rcx + 0x18], 0x20b
sete al
ret
xor eax, eax
jmp 0x1400ab3eb
Function at 0x1400b1080
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402ea130]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
jne 0x1400b10ab
call fcn.1401ac008
mov eax, dword [0x1402ea130]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x198], 1
je 0x1400b10d2
mov ecx, dword [rsi + 0x1d30]
test ecx, ecx
je 0x1400b10df
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 1
lock xadd dword [rsi + 0x1d30], ecx
cmp ecx, 0x7fffffff
je 0x1400b113e
test rsi, rsi
je 0x1400b1141
lea rbx, [rax + 0x198]
call fcn.1400cd9c0
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.1400af630
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400b18b0
mov ecx, dword [0x14032e8a8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1d30]
jmp 0x1400b10d4
int3
int3

Function at 0x1400b1750
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [rcx + 0xdb0], 0x8000
jne 0x1400b188a
mov rsi, rcx
movzx eax, word [0x1402dd838]
lea rax, [rax + rax*2]
shl eax, 4
cmp dword [rcx + rax + 0x60], 0x200
jne 0x1400b188d
lea rcx, [0x1402dd7f0]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400b181b
cmp byte [0x14032e8f8], 0
jne 0x1400b17e0
cmp qword [0x140334df0], 0
jne 0x1400b1893
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400b1896
mov dword [0x14032e8a8], eax
mov dword [0x140334df8], eax
lea rax, [0x1400b1580]
mov qword [0x140334df0], rax
mov byte [0x14032e8f8], 1
lea rcx, [0x1402dd7f0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg qword [0x14032e900], rsi
jne 0x1400b1890
add rsi, 0x48
lea rax, [0x1400b18a0]
mov qword [0x140334e00], rax
xor eax, eax
lea rcx, [0x14032e8b0]
jmp 0x1400b1852
lea rcx, [0x1402dd7f0]
call fcn.14001e950
cmp byte [0x14032e8f8], 0
jne 0x1400b17e0
jmp 0x1400b17a2
xor edx, edx
mov byte [rax + rcx], dl
inc rax
add rsi, 0x30
cmp rax, 0x48
je 0x1400b1884
cmp qword [rsi], 0
je 0x1400b1840
mov r8d, dword [rsi + 0x18]
mov dl, 0x80
cmp r8d, 0x81
jb 0x1400b1842
mov dl, 0x40
cmp r8d, 0x101
jb 0x1400b1842
cmp r8d, 0x201
setb dl
shl dl, 4
add dl, 0x10
jmp 0x1400b1842
add rsp, 0x20
pop rsi
ret
int3
int3
int3
int3
int3
Function at 0x1400b7b20
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, 1
lea rdx, [0x1402b5fa0]
cmp qword [0x1402e9840], rdx
jne 0x1400b7b4e
test rcx, rcx
je 0x1400b7b98
mov qword [0x1402e9840], rcx
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [fcn.140058110]
mov rcx, rsi
call qword [0x1402cbd20]
xor esi, esi
lea rax, [0x1402baf08]
mov qword [0x1402e9840], rax
mov rax, qword [fcn.140058110]
mov rcx, rsi
call qword [0x1402cbd20]
jmp 0x1400b7b4c
mov rax, qword [fcn.140058110]
mov rcx, r14
jmp 0x1400b7b64
mov edi, 1
xor r14d, r14d
lea rbx, str.CURL_SSL_BACKEND
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [fcn.1400ab5c0]
mov edx, edi
mov rcx, r14
call qword [0x1402cbd20]
test rax, rax
je 0x1400b7b8c
mov rsi, rax
mov rcx, rbx
mov rdx, rax
mov r8d, edi
call r15
test eax, eax
je 0x1400b7b5a
cmp eax, edi
je 0x1400b7b5a
cmp eax, 0x8001
jae 0x1400b7b5a
mov r14, rsi
cmp eax, edi
mov edi, eax
jae 0x1400b7bae
mov rdx, qword [str.schannel]
mov rcx, rsi
call fcn.1400bdff0
test eax, eax
je 0x1400b7b6c
mov rax, qword [fcn.140058110]
lea rcx, [0x1402baf08]
mov qword [0x1402e9840], rcx
jmp 0x1400b7b81
Function at 0x1400bcd00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x1400bcd45
mov rsi, rcx
lea r8, [rsp + 0x2c]
mov dword [r8], 0xaaaaaaaa
movaps xmm0, xmmword [0x140299a90]
movaps xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov rdx, rsi
call fcn.1400dca40
test eax, eax
je 0x1400bcd67
xor edx, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400bcd5e
call fcn.1401ac870
int3
mov rax, rdx
add rsp, 0x50
pop rsi
ret
lea r8, [rsp + 0x30]
mov ecx, Ordinal_26
mov rdx, rsi
call fcn.1400dca40
test eax, eax
jne 0x1400bcd45
mov rcx, rsi
call fcn.1401ce1a0
mov edx, 5
test rax, rax
je 0x1400bcd47
lea r10, [rax + rsi]
dec r10
mov r8, 0xffffffffffffffff
xor ecx, ecx
cmp r10, rsi
jb 0x1400bcde5
inc r8
lea r9, [r10 - 1]
cmp byte [r10], 0x2e
mov r10, r9
jne 0x1400bcd9f
mov rcx, r8
sub rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x1400bcde3
xor ecx, ecx
cmp r9, rsi
jb 0x1400bcde5
lea r10, [r9 - 1]
inc r8
cmp byte [r9], 0x2e
mov r9, r10
jne 0x1400bcdc2
add r10, 2
mov rax, r8
mov rcx, r10
jmp 0x1400bcde5
xor ecx, ecx
test rcx, rcx
cmovne rsi, rcx
test rax, rax
jle 0x1400bcd47
add rax, rsi
mov ecx, 0x1505
mov rdx, rcx
shl rdx, 5
add rdx, rcx
movzx ecx, byte [rsi]
inc rsi
lea r8d, [rcx - 0x61]
lea r9d, [rcx - 0x20]
cmp r8b, 0x1a
movzx r8d, r9b
cmovae r8d, ecx
movzx ecx, r8b
xor rcx, rdx
cmp rsi, rax
jb 0x1400bcdfd
movzx edx, cl
jmp 0x1400bcd47
Function at 0x1400bf710
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx]
mov rcx, rbx
mov edx, 3
call fcn.1400d0d60
mov rax, qword [rsi + 0x698]
test byte [rax + 0x80], 0x10
jne 0x1400bf993
xor eax, eax
mov byte [rdi], al
mov byte [rsi + 0x66b], al
cmp qword [rbx + 0xd08], 0
je 0x1400bf7a4
mov rax, qword [fcn.140058110]
mov rcx, qword [rsi + 0x6e0]
call qword [0x1402cbd20]
mov qword [rsi + 0x6e0], 0
mov rdx, qword [rbx + 0xd08]
lea rcx, str.User_Agent:__s_r_n
call fcn.1400d2820
mov qword [rsi + 0x6e0], rax
test rax, rax
je 0x1400bf7db
mov qword [rbx + 0x108], 0
cmp byte [0x140331500], 1
je 0x1400bf7e5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400bf81e
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1400bf998
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x38]
mov qword [r14], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r14]
mov r8, qword [0x140331508]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movabs r14, 0xaaaaaaaa00000000
mov eax, eax
or rax, r14
mov qword [rsi + 0x490], rcx
mov qword [rsi + 0x498], rax
cmp qword [rsi + 0x4c0], 0xffffffffffffffff
je 0x1400bf929
mov rcx, rbx
mov edx, 4
call fcn.1400d0d60
cmp byte [rsi + 0x558], 0
jne 0x1400bf86c
mov rax, qword [rsi + 0x698]
test byte [rax + 0x7c], 0x30
je 0x1400bf879
mov rcx, rbx
mov edx, 5
call fcn.1400d0d60
mov bl, 1
mov byte [rsi + 0x652], bl
mov byte [rdi], bl
mov rdx, qword [rsi + 0x4c0]
mov rcx, rsi
call fcn.1400ca9d0
mov rcx, qword [rsi]
cmp byte [rcx + 0xf1e], bl
jne 0x1400bf8fd
mov eax, dword [rsi + 0x2d0]
mov edx, dword [rsi + 0x3f0]
lea r9, [rsi + 0x2f8]
mov r8d, 0x398
cmp byte [rsi + 0x65b], 0
jne 0x1400bf8e5
mov r8d, 0x3d0
cmp byte [rsi + 0x65a], 0
jne 0x1400bf8e5
cmp byte [rsi + 0x657], 0
mov r10d, 0x378
mov r8d, 0x348
cmovne r8, r10
mov r8, qword [rsi + r8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str.Connected_to__s___s__port__ld___ld__n
call fcn.1400c5520
cmp byte [0x140331500], 1
je 0x1400bf945
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400bf97e
mov byte [rsi + 0x652], 0
mov rdx, qword [rsi + 0x2d8]
mov rcx, rsi
call fcn.1400cb960
test eax, eax
jne 0x1400bf998
jmp 0x1400bf8fd
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x140331508]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
mov eax, eax
or rax, r14
mov qword [rsi + 0x490], rcx
mov qword [rsi + 0x498], rax
jmp 0x1400bf996
mov byte [rdi], 1
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400bf9af
call fcn.1401ac870
int3
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400c4da0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1c8
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
test cl, 2
je 0x1400c4e22
lea rsi, [rsp + 0x28]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.1401e5d50
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400c4e11
mov esi, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400c4e05
call fcn.1401ac870
int3
mov eax, esi
add rsp, 0x1c8
pop rdi
pop rsi
ret
cmp word [rsp + 0x28], 0x202
je 0x1400c4e22
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400c4de6
call fcn.1401018f0
mov esi, eax
test eax, eax
jne 0x1400c4deb
lea rcx, str.iphlpapi.dll
call fcn.1400c4f10
mov qword [0x1403314f8], rax
test rax, rax
je 0x1400c4e61
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c4e61
mov qword [0x1403314f0], rax
lea rdi, [rsp + 0x34]
xor esi, esi
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1401e5d50
movabs rax, 0x60000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov dword [rdi + 4], 2
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 8
mov r8b, 1
call rdi
lea rcx, [rsp + 0x28]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
setne byte [0x140331500]
lea rcx, [0x140331508]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
jmp 0x1400c4deb
Function at 0x1400c4f10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c4f82
mov rbx, rax
lea rdx, [0x1402b6fa8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x1402b6fb8]
mov rcx, rdi
call fcn.1401cf9b4
test rax, rax
je 0x1400c4f94
test rsi, rsi
je 0x1400c4fc2
mov r9, qword [0x1402cbd20]
mov rcx, rdi
xor edx, edx
mov r8d, 8
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp r9
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test rsi, rsi
je 0x1400c4fec
lea rdx, str.AddDllDirectory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c4fec
mov r9, qword [0x1402cbd20]
mov rcx, rdi
xor edx, edx
mov r8d, 0x800
jmp 0x1400c4f71
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rax, qword [fcn.140058110]
mov rcx, rbx
call qword [0x1402cbd20]
jmp 0x1400c4f85
xor r14d, r14d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400c4f85
mov r15d, eax
mov rcx, rdi
call fcn.1401aa1e8
mov rdx, qword [fcn.1400ab570]
lea ecx, [r15 + 1]
add rcx, rax
add rcx, rcx
mov rax, rdx
call qword [0x1402cbd20]
mov rbx, rax
test rax, rax
je 0x1400c4fd7
mov rcx, rbx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400c4fd7
mov rcx, rbx
call fcn.1401aa1e8
lea rcx, [rbx + rax*2]
lea rdx, [0x1402a0c64]
call fcn.1401cf8e4
mov rcx, rbx
call fcn.1401aa1e8
lea rcx, [rbx + rax*2]
mov rdx, rdi
call fcn.1401cf8e4
mov rcx, rbx
test rsi, rsi
je 0x1400c5087
xor edx, edx
mov r8d, 8
mov rax, rsi
call qword [0x1402cbd20]
mov r14, rax
jmp 0x1400c4fda
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1400c507f
Function at 0x1400c5bf0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rdi, r9
mov rbx, r8
mov rsi, rcx
mov r12, qword [rsp + 0x190]
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rbp, edx
mov r14, qword [rcx + rbp*8 + 0x4c0]
mov rax, qword [rcx + 0x698]
test byte [rax + 0x7c], 3
je 0x1400c5c53
lea rax, [0x1400c5df0]
cmp qword [rsi + rbp*8 + 0x4e8], rax
je 0x1400c5d11
mov rcx, r14
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [r12], 0
cmp eax, 0xffffffff
je 0x1400c5ca2
cdqe
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400c5c8e
call fcn.1401ac870
int3
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400c5cbb
mov dword [r12], 0x51
xor eax, eax
jmp 0x1400c5c74
mov edi, eax
lea rbx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
mov dl, 0xaa
call fcn.1401e5d50
mov r8d, 0x100
mov ecx, edi
mov rdx, rbx
call fcn.1400df3c0
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400c5820
mov rax, qword [rsi]
mov dword [rax + 0x11b0], edi
mov dword [r12], 0x37
mov rax, 0xffffffffffffffff
jmp 0x1400c5c74
shl rbp, 5
lea r13, [rsi + rbp]
add r13, 0x508
mov r15, qword [r13 + 8]
sub r15, qword [r13 + 0x10]
cmp qword [r13], 0
sete al
test r15, r15
setne cl
or cl, al
cmp cl, 1
jne 0x1400c5c53
mov rcx, r14
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r9d, r9d
call fcn.1400e5530
cmp eax, 0xffffffff
sete cl
test al, 1
sete al
or al, cl
jne 0x1400c5c53
add rbp, rsi
add rbp, 0x518
mov rax, qword [r13]
test rax, rax
je 0x1400c5da9
mov rdx, qword [rbp]
add rdx, rax
mov rcx, r14
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1400c5c53
mov eax, eax
add qword [rbp], rax
jmp 0x1400c5c53
mov rax, qword [rsi]
movsxd rcx, dword [rax + 0xb70]
add rcx, rcx
mov qword [r13 + 8], rcx
mov rax, qword [fcn.1400ab570]
call qword [0x1402cbd20]
mov qword [r13], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
test rax, rax
je 0x1400c5ddf
mov r15, qword [r13 + 8]
xor edx, edx
jmp 0x1400c5d84
mov qword [r13 + 8], 0
jmp 0x1400c5c53