joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c7c0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [0x140285110]
mov edx, dword [rcx + 8]
mov r9d, 1
mov rbx, rcx
mov ecx, dword [rcx + 4]
mov r8d, dword [rbx + 0xc]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
call sym.libvlccore.dll_vlc_socket
cmp eax, 0xffffffff
mov esi, eax
je 0x14008c6e9
movsxd r13, eax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 4
mov edx, 0xffff
mov rcx, r13
mov rdi, qword [sym.imp.WS2_32.dll_setsockopt]
call rdi
movabs rax, 0x600000001
cmp qword [rbx + 8], rax
je 0x14008c6f0
mov rdi, qword [rbx + 0x10]
mov r14, qword [rbx + 0x20]
movsxd r12, edi
lea rcx, [r12 + 0x38]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14008c6e0
lea rdx, [0x14008c3a0]
lea rcx, [0x14008c450]
lea r8, [0x14008c3f0]
lea r9, [0x14008c3d0]
lea r10, [0x14008c3b0]
test edi, edi
mov rbx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], r9
mov qword [rax + 0x20], r10
mov qword [rax + 0x28], 0
mov dword [rax + 0x30], esi
mov dword [rax + 0x34], edi
jle 0x14008c6be
lea rcx, [rax + 0x38]
mov r8, r12
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0x38]
xor rsi, qword [rbp]
mov rax, rbx
jne 0x14008c71a
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
xor ebx, ebx
jmp 0x14008c6be
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, r13
call rdi
jmp 0x14008c646
call fcn.1400c4ec0
nop
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, qword [0x140285110]
mov rbx, rcx
mov rbp, rdx
lea rdx, [rcx + 0x38]
mov r12d, r8d
mov r8d, dword [rbx + 0x34]
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rax, [0x14008c3f0]
mov qword [rcx + 0x10], rax
movsxd rcx, dword [rcx + 0x30]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x14008c7a4
lea rdx, [rsp + 0x20]
mov ecx, 7
xor eax, eax
mov r8d, r12d
mov rdi, rdx
rep stosq qword [rdi], rax
mov ecx, dword [rbx + 0x30]
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov qword [rsp + 0x30], rbp
call fcn.1400c5bc0
mov rdi, qword [rsp + 0x58]
xor rdi, qword [rsi]
jne 0x14008c7ba
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call fcn.14008c4b0
test rax, rax
je 0x14008c765
mov rax, 0xffffffffffffffff
jmp 0x14008c78f
call fcn.1400c4ec0
nop
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.libvlccore.dll_vlc_savecancel
mov esi, eax
mov rcx, rbx
call qword [rbx + 0x20]
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.libvlccore.dll_vlc_restorecancel

Function at 0x14008c990
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.libvlccore.dll_vlc_savecancel
mov esi, eax
mov rcx, rbx
call qword [rbx + 0x20]
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.libvlccore.dll_vlc_restorecancel
Function at 0x14008d150
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x140285110]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x38], r8
mov rbp, r8
mov r8d, edx
mov edx, 1
mov rsi, qword [rax]
mov qword [rsp + 0x58], rsi
xor esi, esi
mov r9, rbx
mov dword [rsp + 0x20], 1
call sym.libvlccore.dll_vlc_socketpair
test eax, eax
mov edi, eax
jne 0x14008d2c0
lea r9, [rsp + 0x4c]
lea r14, [0x14008c3a0]
lea r13, [0x14008c450]
lea r12, [0x14008c3f0]
xor r15d, r15d
mov qword [rsp + 0x30], r9
movsxd rcx, dword [rbx + r15*4]
mov r8d, 4
mov edx, 0xffff
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, 0x38
mov esi, dword [rbx + r15*4]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14008d270
lea rdx, [0x14008c3d0]
lea rcx, [0x14008c3b0]
add r15, 1
mov qword [rbp], rax
add rbp, 8
cmp r15, 2
mov qword [rax], r14
mov qword [rax + 8], r13
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], 0
mov dword [rax + 0x30], esi
mov dword [rax + 0x34], 0
jne 0x14008d263
mov r10, qword [0x140285110]
mov eax, edi
mov rsi, qword [rsp + 0x58]
xor rsi, qword [r10]
jne 0x14008d2ca
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9, qword [rsp + 0x30]
jmp 0x14008d1c2
mov qword [rbp], 0
movsxd rcx, esi
mov rdi, qword [sym.imp.WS2_32.dll_closesocket]
call rdi
test r15, r15
je 0x14008d2b0
mov r8, qword [rsp + 0x38]
mov edi, 0xffffffff
mov rbp, qword [r8]
call sym.libvlccore.dll_vlc_savecancel
mov ebx, eax
mov rcx, rbp
call qword [rbp + 0x20]
mov ecx, ebx
call sym.libvlccore.dll_vlc_restorecancel
jmp 0x14008d23f
movsxd rcx, dword [rsp + 0x54]
call rdi
mov edi, 0xffffffff
jmp 0x14008d23f
mov edi, 0xffffffff
jmp 0x14008d23f
call fcn.1400c4ec0
nop
Function at 0x14008d2d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x140285110]
mov r9d, 1
mov rbx, rcx
mov r14d, edx
mov edx, dword [rcx + 8]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [rcx + 4]
mov rdi, qword [rax]
mov qword [rsp + 0x38], rdi
xor edi, edi
call sym.libvlccore.dll_vlc_socket
cmp eax, 0xffffffff
mov edi, eax
je 0x14008d459
movsxd r12, eax
mov edx, 0xffff
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 4
mov rcx, r12
mov rsi, qword [sym.imp.WS2_32.dll_setsockopt]
call rsi
movabs rdx, 0x600000001
cmp qword [rbx + 8], rdx
je 0x14008d460
mov rsi, qword [rbx + 0x10]
mov r15, qword [rbx + 0x20]
movsxd rbp, esi
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x14008d450
lea rcx, [0x14008c3a0]
lea r8, [0x14008c450]
lea r9, [0x14008c3f0]
lea r10, [0x14008c3d0]
lea r11, [0x14008c3b0]
test esi, esi
mov r13, rax
mov qword [rax], rcx
mov qword [rax + 8], r8
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], r10
mov qword [rax + 0x20], r11
mov qword [rax + 0x28], 0
mov dword [rax + 0x30], edi
mov dword [rax + 0x34], esi
jle 0x14008d3d4
lea rcx, [rax + 0x38]
mov r8, rbp
mov rdx, r15
call sub.msvcrt.dll_memcpy
test r14b, r14b
je 0x14008d410
lea rax, [0x14008c720]
mov qword [rbx + 0x10], rax
mov rdi, qword [0x140285110]
mov rax, r13
mov rsi, qword [rsp + 0x38]
xor rsi, qword [rdi]
jne 0x14008d48a
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rbx + 0x38]
mov r8d, esi
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14008d3e4
mov rcx, rbx
call fcn.14008c4b0
test rax, rax
je 0x14008d3e4
call sym.libvlccore.dll_vlc_savecancel
mov r14d, eax
mov rcx, rbx
xor r13d, r13d
call qword [rbx + 0x20]
mov ecx, r14d
call sym.libvlccore.dll_vlc_restorecancel
jmp 0x14008d3e4
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
xor r13d, r13d
jmp 0x14008d3e4
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, r12
call rsi
jmp 0x14008d35a
call fcn.1400c4ec0
nop
Function at 0x14008d490
Capabilities:
Connect socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r12, qword [0x140285110]
lea r9, str._builds_videolan_vlc_extras_package_win32_.._.._.._src_network_tls.c
lea rsi, [rsp + 0x60]
mov rbp, rcx
mov ecx, 6
mov rbx, rdx
mov r13d, r8d
mov r8, qword [str.main]
mov rax, qword [r12]
mov qword [rsp + 0x98], rax
xor eax, eax
mov rdi, rsi
rep stosq qword [rdi], rax
mov qword [rsp + 0x38], rdx
lea rdi, str.vlc_tls_SocketOpenTCP
lea rdx, str.resolving__s_...
mov rcx, rbp
mov dword [rsp + 0x20], 0x255
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdi
mov edx, 3
mov dword [rsp + 0x6c], 6
call sym.libvlccore.dll_vlc_Log
lea r9, [rsp + 0x58]
mov r8, rsi
mov edx, r13d
mov rcx, rbx
call sym.libvlccore.dll_vlc_getaddrinfo_i11e
test eax, eax
jne 0x14008d671
lea r8, str.connecting_to__s_port__u_...
lea r9, str._builds_videolan_vlc_extras_package_win32_.._.._.._src_network_tls.c
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rdi
mov edx, 3
mov qword [rsp + 0x30], r8
mov r8, qword [str.main]
mov rcx, rbp
mov dword [rsp + 0x20], 0x25f
call sym.libvlccore.dll_vlc_Log
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x14008d6c2
mov r13, qword [sym.imp.WS2_32.dll_connect]
lea r14, str.connection_error:__s
mov rcx, rsi
call fcn.14008c5c0
test rax, rax
mov rbx, rax
je 0x14008d613
movsxd rcx, dword [rax + 0x30]
lea rdx, [rax + 0x38]
mov r8d, dword [rax + 0x34]
call r13
test eax, eax
jne 0x14008d5f0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rdi, qword [rsp + 0x98]
xor rdi, qword [r12]
mov rax, rbx
jne 0x14008d6c6
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.14008c4b0
test rax, rax
je 0x14008d5b9
call sym.libvlccore.dll_vlc_savecancel
mov r15d, eax
mov rcx, rbx
call qword [rbx + 0x20]
mov ecx, r15d
call sym.libvlccore.dll_vlc_restorecancel
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sym.libvlccore.dll_vlc_strerror_c
mov r8, qword [str.main]
lea r9, str._builds_videolan_vlc_extras_package_win32_.._.._.._src_network_tls.c
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov edx, 1
mov dword [rsp + 0x20], 0x267
mov rcx, rbp
call sym.libvlccore.dll_vlc_Log
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x14008d596
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
jmp 0x14008d5c4
mov ecx, eax
call fcn.1400e7ef0
lea r9, str.cannot_resolve__s_port__u:__s
mov r8, qword [str.main]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov edx, 1
mov qword [rsp + 0x30], r9
lea r9, str._builds_videolan_vlc_extras_package_win32_.._.._.._src_network_tls.c
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x25b
mov rcx, rbp
xor ebx, ebx
call sym.libvlccore.dll_vlc_Log
jmp 0x14008d5c4
xor ecx, ecx
jmp 0x14008d664
call fcn.1400c4ec0
nop
nop dword [rax]
Function at 0x14008e3b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rsi
push rbx
test rdx, rdx
mov r11, rcx
je 0x14008e4a2
movzx eax, byte [r8]
test al, al
je 0x14008e4a2
lea r10, [0x14018bc80]
mov esi, dword [r10 + rax*4]
cmp esi, 0xffffffff
jne 0x14008e490
jmp 0x14008e4a2
movzx r9d, byte [r8 + 1]
test r9b, r9b
je 0x14008e49f
mov ebx, dword [r10 + r9*4]
cmp ebx, 0xffffffff
je 0x14008e49f
mov eax, ebx
shl esi, 2
sar eax, 4
and eax, 3
or eax, esi
mov byte [rcx], al
lea rax, [rcx + 1]
sub rax, r11
cmp rdx, rax
jbe 0x14008e49f
movzx esi, byte [r8 + 2]
test sil, sil
je 0x14008e49f
mov r9d, dword [r10 + rsi*4]
cmp r9d, 0xffffffff
je 0x14008e49f
mov eax, r9d
shl ebx, 4
sar eax, 2
and eax, 0xf
or eax, ebx
mov byte [rcx + 1], al
lea rax, [rcx + 2]
sub rax, r11
cmp rdx, rax
jbe 0x14008e49f
movzx ebx, byte [r8 + 3]
test bl, bl
je 0x14008e49f
mov esi, dword [r10 + rbx*4]
cmp esi, 0xffffffff
je 0x14008e49f
add rcx, 3
shl r9d, 6
add r8, 4
mov rax, rcx
or r9d, esi
sub rax, r11
mov byte [rcx - 1], r9b
cmp rdx, rax
jbe 0x14008e49f
movzx r9d, byte [r8]
test r9b, r9b
je 0x14008e49f
mov esi, dword [r10 + r9*4]
cmp esi, 0xffffffff
je 0x14008e49f
mov rax, rcx
sub rax, r11
cmp rdx, rax
ja 0x14008e3e3
pop rbx
pop rsi
ret
xor eax, eax
jmp 0x14008e49f

Function at 0x14008e4b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call sub.msvcrt.dll_strlen
movsxd rbx, eax
mov rcx, rbx
call sub.msvcrt.dll_malloc
mov r8, rax
mov qword [rsi], rax
xor eax, eax
test r8, r8
je 0x14008e5c7
test rbx, rbx
mov r10, r8
je 0x14008e5c7
movzx ecx, byte [rdi]
test cl, cl
je 0x14008e5c7
lea r9, [0x14018bc80]
mov esi, dword [r9 + rcx*4]
cmp esi, 0xffffffff
jne 0x14008e5b8
jmp 0x14008e5c7
movzx edx, byte [rdi + 1]
test dl, dl
je 0x14008e5c7
mov r11d, dword [r9 + rdx*4]
cmp r11d, 0xffffffff
je 0x14008e5c7
mov eax, r11d
shl esi, 2
sar eax, 4
and eax, 3
or eax, esi
mov byte [r8], al
lea rax, [r8 + 1]
sub rax, r10
cmp rbx, rax
jbe 0x14008e5c7
movzx esi, byte [rdi + 2]
test sil, sil
je 0x14008e5c7
mov ecx, dword [r9 + rsi*4]
cmp ecx, 0xffffffff
je 0x14008e5c7
mov edx, ecx
lea rax, [r8 + 2]
shl r11d, 4
sar edx, 2
and edx, 0xf
sub rax, r10
or edx, r11d
cmp rbx, rax
mov byte [r8 + 1], dl
jbe 0x14008e5c7
movzx r11d, byte [rdi + 3]
test r11b, r11b
je 0x14008e5c7
mov esi, dword [r9 + r11*4]
cmp esi, 0xffffffff
je 0x14008e5c7
add r8, 3
shl ecx, 6
add rdi, 4
mov rax, r8
or ecx, esi
sub rax, r10
mov byte [r8 - 1], cl
cmp rbx, rax
jbe 0x14008e5c7
movzx ecx, byte [rdi]
test cl, cl
je 0x14008e5c7
mov esi, dword [r9 + rcx*4]
cmp esi, 0xffffffff
je 0x14008e5c7
mov rax, r8
sub rax, r10
cmp rbx, rax
ja 0x14008e511
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14008e5d0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
call sub.msvcrt.dll_strlen
lea ecx, [rax + 1]
mov rbx, rax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14008e704
movsxd r9, ebx
test r9, r9
je 0x14008e720
movzx edx, byte [rdi]
test dl, dl
je 0x14008e720
lea rbx, [0x14018bc80]
mov r10d, dword [rbx + rdx*4]
cmp r10d, 0xffffffff
je 0x14008e720
lea rsi, [rax + 2]
lea r8, [rax + 1]
mov rcx, rdi
mov r11, rax
jmp 0x14008e6f0
movzx edx, byte [rcx + 1]
test dl, dl
je 0x14008e700
mov edi, dword [rbx + rdx*4]
cmp edi, 0xffffffff
je 0x14008e700
mov edx, edi
shl r10d, 2
sar edx, 4
and edx, 3
or edx, r10d
mov r10, r8
sub r10, rax
mov byte [r8 - 1], dl
cmp r9, r10
jbe 0x14008e710
movzx edx, byte [rcx + 2]
test dl, dl
je 0x14008e710
mov edx, dword [rbx + rdx*4]
cmp edx, 0xffffffff
je 0x14008e710
mov r10d, edx
shl edi, 4
sar r10d, 2
and r10d, 0xf
or r10d, edi
mov rdi, rsi
sub rdi, rax
mov byte [r8], r10b
cmp r9, rdi
jbe 0x14008e715
movzx r10d, byte [rcx + 3]
test r10b, r10b
je 0x14008e715
mov edi, dword [rbx + r10*4]
cmp edi, 0xffffffff
je 0x14008e715
shl edx, 6
add r11, 3
add rcx, 4
or edx, edi
mov byte [r8 + 1], dl
mov rdx, r11
sub rdx, rax
cmp r9, rdx
jbe 0x14008e700
movzx r10d, byte [rcx]
test r10b, r10b
je 0x14008e700
mov r10d, dword [rbx + r10*4]
add rsi, 3
add r8, 3
cmp r10d, 0xffffffff
je 0x14008e700
mov rdi, r11
sub rdi, rax
cmp r9, rdi
ja 0x14008e635
nop
mov byte [r11], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r11, r8
jmp 0x14008e700
mov r11, rsi
jmp 0x14008e700
mov r11, rax
jmp 0x14008e700
Function at 0x1400959d0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rax, qword [0x140285110]
mov ebp, ecx
mov rdx, qword [rax]
mov qword [rsp + 0xc8], rdx
xor edx, edx
lea rdx, [rsp + 0x90]
call qword [sym.imp.msvcrt.dll__fstat64]
test eax, eax
jne 0x140095bd7
movzx edx, word [rsp + 0x96]
and dx, 0xf000
cmp dx, 0x4000
je 0x140095c00
cmp dx, 0x8000
jne 0x140095be0
mov rsi, qword [rsp + 0xa8]
cmp rsi, 0xffffffffffffffff
je 0x140095bf0
mov r15, rsi
shr r15, 0x1b
test r15, r15
jne 0x140095bcb
lea rcx, [rsi + 0xb0]
cmp rsi, rcx
jae 0x140095bd7
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x140095bd7
lea r8, [rax + 0x8f]
lea rcx, [rax + 0x50]
lea r9, [0x1400952f0]
lea rdi, [rsi + 0x60]
lea r10, [0x1400952e0]
lea rdx, [rsp + 0x50]
and r8, 0xffffffffffffffe0
mov qword [rax + 0x18], rcx
mov qword [rax], 0
xor ecx, ecx
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x40], 0
mov qword [rax + 8], r8
mov qword [rax + 0x10], rsi
mov qword [rax + 0x48], r9
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x60], rax
call sym.libvlccore.dll_vlc_control_cancel
test rsi, rsi
je 0x140095b8b
lea r11, [rsp + 0x4c]
mov r12, qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r14, [rsp + 0x70]
mov qword [rsp + 0x38], r11
mov rdi, rsi
mov r13, r15
mov ecx, ebp
add r13, qword [rbx + 8]
sub rdi, r15
call r12
cmp rax, 0xffffffffffffffff
je 0x140095bc1
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov r8d, edi
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x80], r15d
mov rdx, r13
mov dword [rsp + 0x84], 0
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r9, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140095bc1
mov eax, dword [rsp + 0x4c]
add r15, rax
cmp rsi, r15
ja 0x140095b15
mov ecx, 1
call sym.libvlccore.dll_vlc_control_cancel
mov rbp, qword [0x140285110]
mov rax, rbx
mov rsi, qword [rsp + 0xc8]
xor rsi, qword [rbp]
jne 0x140095c13
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call qword [rbx + 0x48]
xor ebx, ebx
jmp 0x140095b8b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x77
xor ebx, ebx
jmp 0x140095b95
call qword [sym.imp.msvcrt.dll__errno]
xor ebx, ebx
mov dword [rax], 0x1d
jmp 0x140095b95
call qword [sym.imp.msvcrt.dll__errno]
xor ebx, ebx
mov dword [rax], 0xc
jmp 0x140095b95
call qword [sym.imp.msvcrt.dll__errno]
xor ebx, ebx
mov dword [rax], 0x15
jmp 0x140095b95
call fcn.1400c4ec0
nop
nop dword [rax]
Function at 0x140098740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rsi, rcx
mov ecx, dword [rcx]
cmp ecx, dword [rdx]
mov rbx, rdx
je 0x140098760
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
mov edx, dword [rsi + 4]
call sym.libvlccore.dll_vlc_fourcc_GetCodec
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
mov edi, eax
call sym.libvlccore.dll_vlc_fourcc_GetCodec
cmp edi, eax
jne 0x140098753
mov eax, dword [rsi]
cmp eax, 1
je 0x140098830
cmp eax, 2
jne 0x140098820
mov eax, dword [rsi + 0x38]
mov edx, dword [rbx + 0x38]
mov r9d, dword [rsi + 0x3c]
movzx edi, word [rsi + 0x40]
movzx r11d, word [rsi + 0x42]
mov r8d, dword [rsi + 0x44]
test eax, eax
movzx r10d, byte [rsi + 0x58]
setne cl
cmp eax, edx
setne al
test cl, al
je 0x1400987ba
test edx, edx
jne 0x140098753
cmp dword [rbx + 0x3c], r9d
setne r9b
cmp dword [rbx + 0x44], r8d
setne r8b
or r9b, r8b
jne 0x140098753
cmp byte [rbx + 0x58], r10b
jne 0x140098753
movzx r10d, word [rbx + 0x40]
movzx edx, word [rbx + 0x42]
mov word [rsp + 0x28], di
mov word [rsp + 0x2a], r11w
mov word [rsp + 0x58], r10w
mov word [rsp + 0x5a], dx
mov edi, dword [rsp + 0x58]
cmp dword [rsp + 0x28], edi
jne 0x140098753
mov ebx, dword [rbx + 0xec]
cmp dword [rsi + 0xec], ebx
sete al
jmp 0x140098755
mov eax, 1
jmp 0x140098755
mov r11d, dword [rsi + 0x38]
mov edi, dword [rbx + 0x38]
test r11d, r11d
je 0x140098854
test edi, edi
je 0x140098863
lea rdx, [rbx + 0x38]
lea rcx, [rsi + 0x38]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
jmp sym.libvlccore.dll_video_format_IsSimilar
mov edx, dword [rsi + 4]
mov ecx, 1
call sym.libvlccore.dll_vlc_fourcc_GetCodec
jmp 0x14009883c
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call sym.libvlccore.dll_vlc_fourcc_GetCodec
jmp 0x140098840

Function at 0x14009c260
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__read
cdqe
add rsp, 0x28
ret

Function at 0x14009c280
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x140285110]
mov r12, qword [rsp + 0xa0]
mov dword [rsp + 0x30], ecx
mov ebx, ecx
lea rcx, [rsp + 0x30]
mov rdi, rdx
mov rbp, r8
mov edx, 1
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov r8d, 0xffffffff
mov eax, 0x300
mov r14d, r9d
mov r13, qword [rsp + 0xa8]
mov word [rsp + 0x34], ax
call sym.libvlccore.dll_vlc_poll_i11e
test eax, eax
js 0x14009c340
movsxd rcx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9d, r14d
mov r8d, ebp
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rbx, eax
test rbx, rbx
js 0x14009c321
mov rdi, qword [rsp + 0x38]
xor rdi, qword [rsi]
mov rax, rbx
jne 0x14009c349
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14009c305
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xb
jmp 0x14009c305
mov rbx, 0xffffffffffffffff
jmp 0x14009c305
call fcn.1400c4ec0
nop
nop
Function at 0x14009c350
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [0x140285110]
mov r12, qword [rsp + 0xa0]
mov dword [rsp + 0x30], ecx
mov ebx, ecx
lea rcx, [rsp + 0x30]
mov rdi, rdx
mov rbp, r8
mov edx, 1
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov r8d, 0xffffffff
mov eax, 0x30
mov r13d, r9d
mov word [rsp + 0x34], ax
call sym.libvlccore.dll_vlc_poll_i11e
test eax, eax
js 0x14009c410
mov edx, dword [rsp + 0xa8]
movsxd rcx, ebx
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8d, ebp
mov dword [rsp + 0x28], edx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rbx, eax
test rbx, rbx
js 0x14009c3f0
mov rdi, qword [rsp + 0x38]
xor rdi, qword [rsi]
mov rax, rbx
jne 0x14009c419
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14009c3d1
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xb
jmp 0x14009c3d1
mov rbx, 0xffffffffffffffff
jmp 0x14009c3d1
call fcn.1400c4ec0
nop
nop
Function at 0x1400a14d0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [rsp + 0xb0]
mov rsi, qword [0x140285110]
mov rdi, r9
movsxd r12, ecx
mov r14, rdx
xor ecx, ecx
xor edx, edx
mov r13, r8
mov r9, rbp
mov r8, rdi
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
call fcn.140160900
test eax, eax
mov ebx, eax
jle 0x1400a1650
lea ecx, [rax + 2]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
test rax, rax
mov r15, rax
je 0x1400a1650
lea edx, [rbx + 1]
mov r9, rbp
mov r8, rdi
mov rcx, rax
movsxd rdx, edx
call fcn.140160900
test eax, eax
jle 0x1400a162b
cdqe
cmp byte [r15 + rax - 1], 0xa
je 0x1400a1566
mov byte [r15 + rax], 0xa
mov byte [r15 + rax + 1], 0
lea r8, [0x14019b160]
lea rax, [r12 + r12*8]
mov qword [rsp + 0x28], r15
lea rcx, [rsp + 0x30]
lea rdx, str._s__s_s:__s
mov qword [rsp + 0x30], 0
add rax, r8
mov qword [rsp + 0x20], rax
mov r9, qword [r14]
mov r8, qword [r13]
call fcn.1400a1480
test eax, eax
jle 0x1400a162b
mov r12, qword [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
mov r8, r12
call r14
test eax, eax
mov r13d, eax
je 0x1400a1610
movsxd rcx, eax
add rcx, rcx
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x1400a1610
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.14016b6d8
mov rcx, qword [rsp + 0x30]
call fcn.14016b6d8
mov rax, qword [rsp + 0x38]
xor rax, qword [rsi]
jne 0x1400a166b
mov rcx, r15
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14016b6d8
mov rax, qword [rsp + 0x38]
xor rax, qword [rsi]
jne 0x1400a166b
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400c4ec0
nop
nop dword [rax + rax]
nop word cs:[rax + rax]