joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140124d30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140124db5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140124df6
cmp dword [rsp + 0x2c], 0
je 0x140124dda
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140124e1e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140216138]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140216138], rsi
jne 0x140124d90
mov byte [0x140216130], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140124dec
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140124e6a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140124ddf
mov edi, dword [rsp + 0x28]
jmp 0x140124dec
mov edi, dword [rsi + 0x18]
jmp 0x140124dea
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x1401abc20]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140124ed0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x1401cf920]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140054a40
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x1401cf920]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140124f10
ud2

Function at 0x140125540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14016b188]
test ecx, ecx
je 0x1401255df
dec ecx
call fcn.140161594
cmp rax, 1
jbe 0x140125569
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1401255ce
mov ecx, dword [0x14016b188]
test ecx, ecx
je 0x1401255f2
dec ecx
call fcn.140161594
cmp rax, 1
je 0x1401255d4
mov rsi, rax
test rax, rax
jne 0x1401255c8
movzx eax, byte [0x1402161c8]
mov ecx, 0x10
mov edx, 8
call fcn.140016940
test rax, rax
je 0x140125615
mov rsi, rax
lea rax, [0x14016b170]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x14016b188]
test ecx, ecx
je 0x140125605
dec ecx
mov rdx, rsi
call fcn.14016158c
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1401255d6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14016b170]
call fcn.140124d30
mov ecx, eax
jmp 0x140125555
lea rcx, [0x14016b170]
call fcn.140124d30
mov ecx, eax
jmp 0x140125575
lea rcx, [0x14016b170]
call fcn.140124d30
mov ecx, eax
jmp 0x1401255c0
mov ecx, 8
mov edx, 0x10
call fcn.140031740
ud2
Function at 0x140125fc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1401ab5b0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140126031
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140126067
test eax, eax
js 0x140126042
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14012605a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1401ab610]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140124250
mov rcx, rax
call fcn.140124330
mov ecx, 7
int 0x29
ud2

Function at 0x1401264e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14016b148]
test ecx, ecx
je 0x14012659d
dec ecx
call fcn.140161594
cmp rax, 1
jbe 0x140126510
cmp qword [rax + 8], 0
je 0x140126510
add rax, 0x10
jmp 0x140126597
mov ecx, dword [0x14016b148]
test ecx, ecx
je 0x1401265b0
dec ecx
call fcn.140161594
cmp rax, 1
je 0x140126595
mov rsi, rax
test rax, rax
jne 0x14012657b
movzx eax, byte [0x1402161c8]
mov ecx, 0x20
mov edx, 8
call fcn.140016940
test rax, rax
je 0x1401265d3
mov rsi, rax
lea rax, [0x14016b130]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14016b148]
test ecx, ecx
je 0x1401265c3
dec ecx
mov rdx, rsi
call fcn.14016158c
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x140126597
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14016b130]
call fcn.140124d30
mov ecx, eax
jmp 0x1401264f5
lea rcx, [0x14016b130]
call fcn.140124d30
mov ecx, eax
jmp 0x140126520
lea rcx, [0x14016b130]
call fcn.140124d30
mov ecx, eax
jmp 0x140126573
mov ecx, 8
mov edx, 0x20
call fcn.140031740
ud2
Function at 0x1401277a0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x140127820
jmp 0x14012780f
jae 0x1401278c4
cmp r8, 0x201
jae 0x140127820
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x140127867
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x140127847
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.140127320
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x14012788b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140127919
mov r8d, ebx
cmp rbp, r8
jne 0x140127800
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140127939
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x14012780f
jmp 0x140127820
cmp r12, r8
jb 0x140127953
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1401286e0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rsi, rsi
je 0x140127904
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.1400169d0
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rsi, rsi
jne 0x1401278f5
jmp 0x140127904
lea rcx, str.internal_error:_entered_unreachable_codefailed_to_write_the_buffered_data
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140055d40
jmp 0x140127968
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.1400559b0
ud2
Function at 0x140129920
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.140142620
mov rsi, rdx
test rax, rax
je 0x1401299cf
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401299c3
test rax, rax
je 0x1401299c3
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x1401299b6
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.1400169d0
mov edx, 8
mov rcx, rsi
call fcn.1400169d0
mov qword [rdi], 0
jmp 0x140129b2f
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140142830
cmp dword [rsp + 0x40], 2
jne 0x140129a4d
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140129a2e
test rcx, rcx
je 0x140129a2e
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
cmp qword [r15 + 8], 0
je 0x140129a21
mov rdx, qword [r15 + 0x10]
mov rcx, r14
call fcn.1400169d0
mov edx, 8
mov rcx, rbx
call fcn.1400169d0
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x140129a9f
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x140129b1b
mov rbx, qword [rsp + 0x40]
jmp 0x140129aa1
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x140129b0a
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x140129b0a
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x140129b27
mov qword [rdi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x140129b27
call sub.KERNEL32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140145390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x1401453ec
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x1401454e1
test r15w, r15w
je 0x1401453ec
cmp r15w, 0x2e
jne 0x1401454e1
test r12w, r12w
jne 0x1401454e1
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x1401454c7
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
jmp 0x140145443
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x1401454c7
cmp word [rsp + 0xac], 0x2e
jne 0x14014546c
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x140145430
cmp ax, 0x2e
jne 0x14014546c
cmp word [rsp + 0xb0], 0
je 0x140145430
lock inc qword [r14]
jle 0x1401455c9
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x14014550c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
jne 0x140145558
mov qword [rsi], 0
jmp 0x1401455b7
lock inc qword [r14]
jle 0x1401455c9
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
jmp 0x14014556a
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x140147f70
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test dx, dx
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x140147fbe
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14014802e
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x140147fd1
cmp eax, 0x2739
jne 0x14014801b
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x140148016
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x140148035
mov qword [rsi + 8], rdi
jmp 0x140147fb5
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x38
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax

Function at 0x140148070
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov eax, eax
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
invalid
jg 0x1401480d6
cmovb eax, ecx
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_send
xchg edi, eax
add dword [rax], eax
cmp eax, 0xffffffff
je 0x1401480a9
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401480bf
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
or eax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x1401480d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
in al, dx
invalid
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
invalid
invalid
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140148103
cdqe
jmp 0x140148111
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140148119
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14014812a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x140148830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140148866
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x140143c90]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.140054a40
ud2
Function at 0x14014d6f0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x14014d712
mov qword [rsi + 8], rbx
mov qword [rsi], 1
jmp 0x14014d7de
mov rax, qword [0x140216120]
cmp rax, 3
jne 0x14014d7e7
movzx edx, word [rbx]
lea rcx, [rsp + 0x20]
call fcn.140147f70
cmp qword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x28]
je 0x14014d74d
mov qword [rsi + 8], rdi
mov qword [rsi], 1
jmp 0x14014d7de
cmp word [rbx], 0
je 0x14014d76e
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x14014d783
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x20], r9w
mov word [rsp + 0x22], cx
mov dword [rsp + 0x24], eax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
je 0x14014d7be
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x14014d7de
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call fcn.14016179c
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.140147dd0
jmp 0x14014d723

Function at 0x14014d840
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14016b1a8]
test ecx, ecx
je 0x14014d939
dec ecx
call fcn.140161594
cmp rax, 1
jbe 0x14014d870
cmp qword [rax + 8], 0
je 0x14014d870
add rax, 0x10
jmp 0x14014d933
mov ecx, dword [0x14016b1a8]
test ecx, ecx
je 0x14014d94c
dec ecx
call fcn.140161594
cmp rax, 1
je 0x14014d913
mov rsi, rax
test rax, rax
jne 0x14014d8e3
movzx eax, byte [0x1402161c8]
mov ecx, 0x20
mov edx, 8
call fcn.140016940
test rax, rax
je 0x14014d972
mov rsi, rax
lea rax, [0x14016b190]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14016b1a8]
test ecx, ecx
je 0x14014d95f
dec ecx
mov rdx, rsi
call fcn.14016158c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14014d917
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14014d91f
xor eax, eax
jmp 0x14014d933
call fcn.140148830
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14016b190]
call fcn.140124d30
mov ecx, eax
jmp 0x14014d855
lea rcx, [0x14016b190]
call fcn.140124d30
mov ecx, eax
jmp 0x14014d880
lea rcx, [0x14016b190]
call fcn.140124d30
mov ecx, eax
jmp 0x14014d8db
mov ecx, 8
mov edx, 0x20
call fcn.140031740
ud2

Function at 0x14014df03
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
cmp rdx, 0x20
jb fcn.14005a4a0
jmp fcn.140055220
Function at 0x140162320
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140163130
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140163130
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140162390
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140216254]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140162540
mov rax, qword [0x140216258]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1401623dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140162467
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1401623c0
mov rcx, r12
call fcn.140162e40
mov rbp, rax
test rax, rax
je 0x14016259d
mov rax, qword [0x140216258]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140162f70
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140216258]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140162582
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140162460
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1401624f0
add dword [0x140216254], 1
cmp ebx, 8
jae 0x140162498
test bl, 4
jne 0x140162550
test ebx, ebx
je 0x140162489
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140162570
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140162489
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1401624ca
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140216258]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140162460
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140162320
xor edi, edi
jmp 0x1401623e7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140162489
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140162489
mov rax, qword [0x140216258]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140162320
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140162320
nop
nop dword [rax]