joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400113c0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001d1d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x140011400
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001d1d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x1400114b0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001d1d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140011800
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x14001f300]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x14001f300]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x14001d1d0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x1400158d4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x14001f108], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x14001f118]
jne 0x140015921
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x14001f140], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x14001f108], 1
mov ecx, dword [0x14001f140]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400159f6
mov rcx, qword [0x14001e444]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140015a21
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14001f110]
test rax, rax
je 0x140015971
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x14001f110], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x140015a3c]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x14001f140]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14001e444]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140015a21
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1401323cd
Capabilities:
Execute syscall

Disassembly:
xor dword [rax - 0x3f], ecx
loop 0x140131ee3
invalid
mov rdx, rsi
mov dword [rsp + 0x36], 0x797c7c4f
mov byte [rsp + 0x34], 0xf6
mov word [rsp + 0x3a], 0x7c
jmp 0x140132778
mov dword [rbp - 0x47], 0x6f767370
mov dword [rbp - 0x76], 0xf6f6f6f6
mov dword [rbp - 0x4f], 0x73764d2a
mov dword [rbp - 0x72], 0xf6f6f6f6
mov dword [rbp - 0x4b], 0x2a7e786f
mov dword [rbp - 0x6e], 0xf6f6f6f6
jmp 0x140132309
mov r11d, r10d
mov r9d, esi
sub r11, 0x10
jmp 0x140132640
loope 0x140132413
lea esi, [rdx - 0x7f46]
jbe 0x1401323ef
ret 0x10
inc rdx
cmp rdx, 5
jb 0x140132780
xor eax, eax
mov dword [rsp + 0x72], 0xf6f6f6f6
div dh
mov byte [rbp - 0x41], al
xchg rsi, rdx
jne 0x140132404
je 0x140132404
cmp r11d, 0x94ea9dd9
movabs r15, 0x630b9a00000082e9
jl 0x1401326c9
jmp 0x14013248b
jb 0x140132db4
invalid
call rcx
test r8, rbx
push r12
syscall
ret
mov byte [rbp + rdx + 0x128], sil
inc rdx
cmp rdx, 0xc
jb 0x1401326c3
jne 0x140132473
je 0x140132473
lea r9d, [rbp + 0xeed9]
ror r9d, 0x6a
jmp 0x14013234d
mov rsi, rdx
xchg rsi, rdx
mov dword [rbp - 0x67], 0x6b6f765a
mov dword [rsp + 0x76], 0xf6f6f6f6
mov dword [rbp - 0x63], 0x6f2a6f7d
mov dword [rsp + 0x7a], 0xf6f6f6f6
mov dword [rbp - 0x5f], 0x6b7c7e82
je 0x1401324cd
jne 0x1401324cd
add r15d, 0x7c158766
ror ebp, 0xac
lea r12d, [rdx + 0xdb81]
movabs r13, 0x1facae0000019fe9
inc r13
ret
jmp 0x140132671
mov dl, 0xc0
add byte [rax], al
je 0x1401328f3
lea rax, [rbp + 0x136]
sub r8, rax
jne 0x14013265c
je 0x14013265c
lea ebx, [rbp + 0x1b3b]
movabs rdx, 0x6cf18d000000f0e9
pause
ror r9d, 0xd7
call rcx
call fcn.140132738
jmp 0x140132751
mov dword [rsp + 0x7e], 0xf6f6f6f6
mov dword [rbp - 0x5b], 0x7f397e6d
mov dword [rbp - 0x7e], 0xf6f6f6f6
mov dword [rbp - 0x57], 0x7a738478
mov dword [rbp - 0x7a], 0xf6f6f6f6
mov dword [rbp - 0x53], 0x76766b2a
jmp 0x140132325
jne 0x140132803
inc edx
sub rcx, 0xfffffffffffffffe
cmp edx, 0xc
jb 0x14013276b
mov dword [rsp + 0x30], 0xf6f6f6f6
jmp 0x1401322ed
movzx eax, word [rbp + rdx*2 + 0x136]
add byte [rax], al
movzx ecx, byte [rbp + rdx + 0x128]
add cx, ax
mov word [rbp + rdx*2 + 0x136], cx
jmp 0x14013242f
dec byte [rcx]
add byte [rax - 0x7b], cl
sti
ret 0x38
nop word [rax + rax]
mov edx, esi
lea rcx, [rbp + 0x136]
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jmp 0x1401326a1
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x30]
movzx ecx, byte [rsp + rdx + 0x36]
add cl, al
mov byte [rsp + rdx + 0x36], cl
mov byte [rsp + rdx + 0x30], sil
jmp 0x1401323da
inc r9d
neg r8
add r8, 0xfffffffffffffffe
neg r8
movsxd rax, r9d
jmp 0x1401328ea
mov rbp, qword [rax + 0x18]
nop
mov byte [rbp + rax + 0x136], sil
inc rax
cmp rax, 0x18
jb 0x140132837
jmp 0x140132968
mov r8d, esi
movsxd r13, dword [0x14000003c]
add r13, rdi
xchg rcx, rbp
jmp 0x140132818
cmp rax, r11
jb 0x14013275b
xchg r9, rsi
mov rax, r9
xchg rsi, r9
jne 0x140132914
je 0x140132914
push r8
int3
jmp 0x140132835
mov rax, qword gs:[0x60]
lea rdi, [0x140000000]
xchg rdx, r13
mov qword [rsp + 0x448], rdx
xchg r13, rdx
jmp 0x140132890
add byte [rax], al
ret
Function at 0x140134bc0
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r9
mov qword [rsp + 0x20], rcx
xchg rcx, r9
xchg r8, rcx
jmp 0x140134bfa
sub rsp, 0x28
lea rax, [0x140134db0]
mov qword [rsp + 0x18], rax
mov dword [rsp + 8], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
jmp 0x140134c9a
mov qword [rsp + 0x18], rcx
xchg r8, rcx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
jmp 0x140134bd3
Function at 0x14013a072
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x1401bef80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1406e8136]
call fcn.140143037
nop
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x14013ab9e
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401de470
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1406e80cb]
call fcn.140143037
nop
mov qword [rbp + 8], 0
jmp 0x1401de4af
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401de505
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401de4a4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14013b47c
Capabilities:
Terminate process

Disassembly:
jmp 0x1401c73b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1406e815f]
call fcn.140143037
nop
cmp qword [rbp + 0xe8], 0
je 0x1401c7402
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x1401c7402
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x1401c7422
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x1401c7456
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14013c697
Capabilities:
Resolve dns

Disassembly:
jmp 0x140212430
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x112
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6e8]
mov rax, qword [0x1406af1c0]
xor rax, rbp
mov qword [rbp + 0x670], rax
lea rcx, [0x1406e8136]
call fcn.140143037
nop
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 2
jne 0x1402124b6
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1402124eb
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 0x17
jne 0x1402124e4
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1402124eb
xor al, al
jmp 0x140212577
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x401
rep stosb byte [rdi], al
lea rcx, [rbp + 0x10]
call fcn.140143398
mov dword [rbp + 0x664], eax
lea rcx, [rbp + 0x10]
call fcn.14013d448
mov qword [rbp + 0x668], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x664]
mov r8, qword [rbp + 0x668]
mov edx, dword [rbp + 0x6a8]
mov rcx, qword [rbp + 0x6a0]
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x14021255c
xor al, al
jmp 0x140212577
lea rcx, [rbp + 0x10]
call fcn.14013d448
mov rdx, rax
mov rcx, qword [rbp + 0x6b0]
call fcn.1401395a5
nop
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1403d8c60]
call fcn.1401414cb
mov rax, rdi
mov rcx, qword [rbp + 0x670]
xor rcx, rbp
call fcn.14013dc90
lea rsp, [rbp + 0x688]
pop rdi
pop rbp
ret

Function at 0x14013c782
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402a3d60
push rdi
sub rsp, 0x30
call fcn.14013ecd5
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1402a3d8c
mov eax, 2
jmp 0x1402a3df9
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov r9d, 2
lea r8, [rsp + 0x24]
mov edx, 0x22
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x30
je 0x1402a3de2
cmp dword [rsp + 0x20], 0x31
je 0x1402a3de9
cmp dword [rsp + 0x20], 0x32
je 0x1402a3df0
jmp 0x1402a3df7
mov eax, 2
jmp 0x1402a3df9
mov eax, 1
jmp 0x1402a3df9
mov eax, 3
jmp 0x1402a3df9
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14013d70e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1403b9ae0
mov rax, rcx
neg rcx
test rax, 7
je 0x1403b9afd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1403b9b58
test al, 7
jne 0x1403b9af0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1403b9b11
mov rdx, qword [rax - 8]
test dl, dl
je 0x1403b9b82
test dh, dh
je 0x1403b9b7c
shr rdx, 0x10
test dl, dl
je 0x1403b9b76
test dh, dh
je 0x1403b9b70
shr rdx, 0x10
test dl, dl
je 0x1403b9b6a
test dh, dh
je 0x1403b9b64
shr edx, 0x10
test dl, dl
je 0x1403b9b5e
test dh, dh
jne 0x1403b9b11
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14013d772
Capabilities:
Query environment variable

Disassembly:
jmp 0x140394e10
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140394990
lea rcx, [rsp + 0x20]
call fcn.1403949e0
movzx eax, al
test eax, eax
jne 0x140394e55
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1403949c0
mov rax, qword [rsp + 0x40]
jmp 0x140394f4f
lea rcx, [rsp + 0x20]
call fcn.140394ae0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140394a80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14013de8e
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14013cad9
lea rcx, [rsp + 0x28]
call fcn.14013e816
movzx eax, al
test eax, eax
jne 0x140394eef
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14014107f
lea rcx, [rsp + 0x20]
call fcn.1403949c0
mov rax, qword [rsp + 0x50]
jmp 0x140394f4f
lea rcx, [rsp + 0x20]
call fcn.140394ae0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140142e61
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14013dd0d
lea rcx, [rsp + 0x28]
call fcn.1401440ef
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14014107f
lea rcx, [rsp + 0x20]
call fcn.1403949c0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x14013e08c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x1402025b0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x268]
mov rax, qword [0x1406af1c0]
xor rax, rbp
mov qword [rbp + 0x200], rax
lea rcx, [0x1406e8136]
call fcn.140143037
nop
mov rax, qword [rbp + 0x230]
add rax, 0x99
mov rcx, rax
call fcn.140141b42
movzx eax, al
test eax, eax
je 0x14020262f
mov eax, 0xffffffff
jmp 0x140202772
mov rax, qword [rbp + 0x230]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x230]
call qword [rax + 8]
movzx eax, al
test eax, eax
jne 0x140202654
mov eax, 0xffffffff
jmp 0x140202772
lea rax, [rbp + 0x188]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x230]
add rax, 0x408
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call fcn.1401396d1
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x248]
mov r8d, dword [rbp + 0x240]
mov rdx, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x230]
call fcn.1401432a3
mov rcx, qword [rbp + 0x230]
add rcx, 0x48
mov rdx, rax
call fcn.1401427fe
nop
mov rax, qword [rbp + 0x230]
add rax, 0x48
mov rcx, rax
call fcn.14013f905
cmp rax, 0xffffffffffffffff
jne 0x1402026e9
mov eax, 0xffffffff
jmp 0x140202772
cmp dword [rbp + 0x240], 0
jne 0x14020276c
mov dword [rbp + 0xa4], 0x80
mov rax, qword [rbp + 0x230]
add rax, 0x48
mov rcx, rax
call fcn.14013f905
lea r8, [rbp + 0xa4]
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14020272f
mov eax, 0xffffffff
jmp 0x140202772
movzx eax, word [rbp + 0x10]
cmp eax, 2
jne 0x140202749
movzx ecx, word [rbp + 0x12]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
jmp 0x140202772
movzx eax, word [rbp + 0x10]
cmp eax, 0x17
jne 0x140202763
movzx ecx, word [rbp + 0x12]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
jmp 0x140202772
mov eax, 0xffffffff
jmp 0x140202772
mov eax, dword [rbp + 0x240]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401414cb
mov rax, rdi
mov rcx, qword [rbp + 0x200]
xor rcx, rbp
call fcn.14013dc90
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret

Function at 0x14013e16d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1402c8f70
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402c88f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402c8faf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1406ea020]
jmp 0x1402c8fb9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14013e690
Capabilities:
Query environment variable

Disassembly:
jmp 0x140394b60
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140394990
lea rcx, [rsp + 0x40]
call fcn.140394b10
movzx eax, al
test eax, eax
jne 0x140394ba8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1403949c0
mov rax, qword [rsp + 0x70]
jmp 0x140394d79
lea rcx, [rsp + 0x40]
call fcn.140394ae0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140394a80
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140394ae0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140140936
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140394c4e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1403949c0
mov rax, qword [rsp + 0x80]
jmp 0x140394d79
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14013de8e
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14013da33
lea rcx, [rsp + 0x48]
call fcn.14013ced0
movzx eax, al
test eax, eax
jne 0x140394cb5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14013a8a6
lea rcx, [rsp + 0x40]
call fcn.1403949c0
mov rax, qword [rsp + 0x88]
jmp 0x140394d79
lea rcx, [rsp + 0x48]
call fcn.14013f036
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140394ae0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140140936
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140394d4b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14013a8a6
lea rcx, [rsp + 0x40]
call fcn.1403949c0
mov rax, qword [rsp + 0xa0]
jmp 0x140394d79
lea rcx, [rsp + 0x48]
call fcn.14013d993
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14013a8a6
lea rcx, [rsp + 0x40]
call fcn.1403949c0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x14013e6b3
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402c8ea0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1402c8870
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402c8ee1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1406ea020]
jmp 0x1402c8ee7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x14013e81b
Capabilities:
Get geographical location

Disassembly:
jmp 0x1403680c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140366f60
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14036811c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call fcn.1401440c2
jmp 0x14036813e
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14013cdc7
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x14013e852
Capabilities:
Terminate process

Disassembly:
jmp 0x1402a6d50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14013ef5f
Capabilities:
Print debug messages

Disassembly:
jmp 0x1403a3100
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1406af1c0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1403a3129
jmp 0x1403a31ae
mov rcx, qword [rbp + 0x30]
call fcn.14013d70e
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1403a3142
jmp 0x1403a31ae
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1403a315f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14013acd9
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14013b8be
test eax, eax
jne 0x1403a31ae
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14013dc90
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14013f5ef
Capabilities:
Get geographical location

Disassembly:
jmp 0x140259550
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14025958d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140142fce
add rsp, 0x58
ret

Function at 0x14013f80b
Capabilities:
Set environment variable

Disassembly:
jmp 0x140396cc0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret