joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
test rcx, rcx
jne 0x14013149a
mov ecx, dword [0x140354148]
test ecx, ecx
je 0x140131467
dec ecx
mov edx, 1
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [0x140354128]
test ecx, ecx
je 0x14013147a
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x14013148d
movzx eax, byte [0x140354188]
mov edx, 0x38
xor ecx, ecx
call fcn.1401574a0
test rax, rax
je 0x1401314d2
mov rsi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 2
mov qword [rax + 0x28], rdi
mov byte [rax + 0x30], 0
mov qword [rbp - 0x40], rax
mov rax, qword [0x140359040]
lock inc qword [rsi]
jle 0x1401314e1
mov ecx, dword [0x140354148]
test ecx, ecx
je 0x140131441
dec ecx
jmp 0x14013144f
lea rcx, [0x140354130]
call fcn.14012f090
mov ecx, eax
add rsi, 0x10
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, qword [rbp - 0x40]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140354130]
call fcn.14012f090
mov ecx, eax
jmp 0x1401313b5
lea rcx, [0x140354110]
call fcn.14012f090
mov ecx, eax
jmp 0x1401313cf
call fcn.1401308d0
mov rdi, rax
jmp 0x1401313e0
cmp rcx, 1
je 0x1401314e3
lea rax, str.use_of_std::thread::current___is_not_possible_after_the_threads_n_________local_data_has_been_destroyed
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.std_src_threadcurrent.rs
lea rcx, [rbp - 0x40]
call fcn.14003f140
mov ecx, 8
mov edx, 0x38
call fcn.14003be7d
ud2
mov dword [rbp - 0x10], 0
mov byte [rbp - 0xc], 0
lea rax, str.fatal_runtime_error:__n_n____________Attempted_to_access_thread_local_data_while_allocating_said_data._n_n____________Do_not_access_functions_that_allocate_in_the_global_allocator__n_n____________This_is_a_bug_in_the_global_allocator._n_n_________n
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [rbp - 8]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.14012f270
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call fcn.14012f380
mov ecx, 7
int 0x29
ud2

Function at 0x140131620
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140354148]
test ecx, ecx
je 0x140131652
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jbe 0x140131662
lock inc qword [rax - 0x10]
jle 0x14013166f
add rax, 0xfffffffffffffff0
add rsp, 0x20
pop rbp
ret
lea rcx, [0x140354130]
call fcn.14012f090
mov ecx, eax
jmp 0x140131636
mov rcx, rax
add rsp, 0x20
pop rbp
jmp fcn.140131390
ud2
Function at 0x140132160
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x140354148]
test ecx, ecx
je 0x14013217b
dec ecx
jmp 0x140132189
lea rcx, [0x140354130]
call fcn.14012f090
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
mov rsi, rax
cmp rax, 2
jbe 0x1401321a8
lock inc qword [rsi - 0x10]
jle 0x140132224
add rsi, 0xfffffffffffffff0
jmp 0x1401321b3
mov rcx, rsi
call fcn.140131390
mov rsi, rax
mov qword [rbp - 8], rsi
lock dec byte [rsi + 0x30]
jne 0x1401321da
mov rax, qword [rbp - 8]
lock dec qword [rax]
jne 0x1401321d0
lea rcx, [rbp - 8]
call fcn.14012f200
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
add rsi, 0x30
lea rdi, [rbp + 7]
xor ebx, ebx
jmp 0x1401321f8
mov al, 1
lock cmpxchg byte [rsi], bl
je 0x1401321bd
mov byte [rbp + 7], 0xff
mov r8d, 1
mov rcx, rsi
mov rdx, rdi
mov r9d, 0xffffffff
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x1401321f0
call sub.kernel32.dll_GetLastError
jmp 0x1401321f0
ud2

Function at 0x140132290
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, edx
mov rbx, rcx
mov ecx, dword [0x140354148]
test ecx, ecx
je 0x1401322b0
dec ecx
jmp 0x1401322be
lea rcx, [0x140354130]
call fcn.14012f090
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
mov rsi, rax
cmp rax, 2
jbe 0x1401322dd
lock inc qword [rsi - 0x10]
jle 0x140132380
add rsi, 0xfffffffffffffff0
jmp 0x1401322e8
mov rcx, rsi
call fcn.140131390
mov rsi, rax
mov qword [rbp - 8], rsi
lock dec byte [rsi + 0x30]
je 0x14013235e
add rsi, 0x30
mov byte [rbp + 7], 0xff
mov ecx, 0x3e8
mov rax, rbx
mul rcx
mov r9d, 0xffffffff
jo 0x14013233e
mov ecx, edi
imul rcx, rcx, 0x431bde83
shr rcx, 0x32
add rax, rcx
jb 0x14013233e
imul ecx, ecx, 0xf4240
xor edx, edx
sub edi, ecx
setne dl
add rax, rdx
jb 0x14013233e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
lea rdx, [rbp + 7]
mov r8d, 1
mov rcx, rsi
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x14013235a
call sub.kernel32.dll_GetLastError
xor eax, eax
xchg byte [rsi], al
mov rax, qword [rbp - 8]
lock dec qword [rax]
jne 0x140132371
lea rcx, [rbp - 8]
call fcn.14012f200
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
ud2
Function at 0x140132930
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d8], rcx
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x3e8], 2
mov qword [rbp + 0x3f0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3d0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1401329c0
jmp 0x1401329af
jae 0x140132a8a
cmp r8, 0x201
jae 0x1401329c0
mov r14d, 0x200
lea r15, [rbp - 0x50]
mov r12, r8
jmp 0x140132a26
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1401329fe
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3e0]
mov rdx, rbx
call fcn.1401348a0
mov rsi, qword [rbp + 0x3e0]
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x3d0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3f0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3d0]
mov r12, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140132a4c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140132aee
mov r8d, r13d
cmp r12, r8
jne 0x1401329a0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x140132b1f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1401329af
jmp 0x1401329c0
cmp r14, r8
jb 0x140132b39
lea rcx, [rbp + 0x3b0]
mov rdx, r15
call fcn.1401333a0
movups xmm0, xmmword [rbp + 0x3b0]
movups xmm1, xmmword [rbp + 0x3c0]
mov rax, qword [rbp + 0x3d8]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3e0], 0
je 0x140132ad9
mov rcx, qword [rbp + 0x3e8]
mov edx, 2
call fcn.140019a50
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3d8]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rbp + 0x3e0], 0
jne 0x140132ac8
jmp 0x140132ad9
lea rcx, str.internal_error:_entered_unreachable_code_rustc_90b35a6239c3d8bdabc530a6a0816f7ff89a0aaflibrary_std_src_threadmod.rs
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14003fe40
jmp 0x140132b4e
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14003f980
ud2
Function at 0x140134b50
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov rax, r8
mov rdi, rcx
mov dword [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 7
mov qword [rbp - 0x2c], 0
mov word [rbp - 0x24], 0
mov byte [rbp - 0x28], 1
lea r8, [rbp - 0x48]
mov rcx, rdx
mov rdx, rax
call fcn.140150e10
mov rsi, rdx
test rax, rax
je 0x140134bfe
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x140134bf2
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x140134bd2
mov rcx, rbx
call rax
cmp qword [r14 + 8], 0
je 0x140134be5
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.140019a50
mov edx, 8
mov rcx, rsi
call fcn.140019a50
mov qword [rdi], 0
jmp 0x140134d55
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.140151080
cmp dword [rbp - 0x48], 2
jne 0x140134c77
mov rax, qword [rbp - 0x40]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x140134c57
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rax, qword [r15]
test rax, rax
je 0x140134c37
mov rcx, r14
call rax
cmp qword [r15 + 8], 0
je 0x140134c4a
mov rdx, qword [r15 + 0x10]
mov rcx, r14
call fcn.140019a50
mov edx, 8
mov rcx, rbx
call fcn.140019a50
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140173dfc
mov r12, qword [rbp - 0x10]
test rsi, rsi
je 0x140134cc5
mov qword [rbp - 0x48], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x140134d41
mov rbx, qword [rbp - 0x48]
jmp 0x140134cc7
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x140134d30
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.140173dfc
test r15, r15
je 0x140134d30
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x140134d4d
mov qword [rdi], 0
mov rcx, rbx
call fcn.140173dfc
jmp 0x140134d4d
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call fcn.140173dfc
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x140152940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rsi, r9
mov rdi, r8
mov qword [rbp - 8], rdx
mov qword [rbp], rcx
add rsi, r8
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x20], 0x81

Function at 0x140152dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x140152e2c
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x140152e2c
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x140152e2c
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
and esi, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x140152ed8
cmp byte [rdx], 0xed
jne 0x140152ee1
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x140152ee1
movzx r13d, byte [rdx + 2]
cmp rbx, 3
cmp ebx, 3
jb 0x140152e71
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x140152fcb
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.140134780
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x140152ff0
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x140152f7e
test rdi, rdi
je 0x140152f70
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x140152f08
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x140152f70
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x140152f00
cmp r10b, 0xe0
jb 0x140152eea
cmp r10b, 0xed
jne 0x140152f3f
cmp r8, rax
je 0x140152f70
lea r8, [r9 + 2]
cmp r8, rax
je 0x140152f70
cmp byte [r9 + 1], 0x9f
ja 0x140152f6c
add r9, 3
mov r8, r9
jmp 0x140152f00
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x140152f00
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x140152f00
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x140152f9e
add rcx, rbx
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.1401348a0
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x140152f7b
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.1401348a0
mov rdx, r15
jmp 0x140152e8c
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.1401348a0
mov rbx, qword [rsi + 0x10]
jmp 0x140152ec9
Function at 0x1401531a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1403108e8]
movaps xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x20
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x140153200
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14015320d
xor edx, edx
xor eax, eax
jmp 0x140153249
cmp eax, 0x103
je 0x140153253
test eax, eax
js 0x140153220
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140153249
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov rsi, rax
shl rsi, 0x20
or rsi, 2
mov ecx, eax
call fcn.140131b10
mov ecx, eax
xor edx, edx
xor eax, eax
cmp cl, 0xb
stc
or ecx, dword [rdi]
xchg ebp, eax
ror byte [rax + 0xf], 0x45
invalid
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str._t_t1_
mov qword [rbp - 0x38], rax
enter 0xffffffffffffc748, 0x45
rol byte [rcx], 1
add byte [rax], al
add byte [rax - 0x73], cl
and byte [r8 - 0x77], r9b
fmul dword [r15]
push rdi
ror byte [rdi], 0x11
loopne 0x1401532c9
lea ecx, [rbp + 0x18]
Function at 0x140154be0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.140151190
mov rax, qword [rbp - 0x10]
mov eax, dword [rbp - 0x10]

Function at 0x140155a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140234170]
test esi, esi
je 0x140155af0
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140155ae7
je 0x140155ae5
movzx eax, byte [0x140354188]
mov edx, 0x10
xor ecx, ecx
call fcn.1401574a0
test rax, rax
je 0x140155b03
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x140155ae0
mov rax, qword [rdi]
test rax, rax
je 0x140155ad3
lock dec qword [rax]
jne 0x140155ad3
mov rcx, qword [rdi]
call fcn.140155b20
mov edx, 8
mov rcx, rdi
call fcn.140019a50
mov rax, rsi
jmp 0x140155ae7
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140234158]
call fcn.14012f090
mov esi, eax
jmp 0x140155a6d
mov ecx, 8
mov edx, 0x10
call fcn.14003be7d
int3
Function at 0x140155f00
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov eax, dword [0x1403540f0]
cmp eax, 3
jne 0x1401560ec
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1401560fc
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x140155f98
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140156054
inc rdx
cmp rax, rdx
jne 0x140155f80
jmp 0x1401560b7
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x140155fce
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140156054
inc rdx
cmp rcx, rdx
jne 0x140155fb0
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x140155fd2
jmp 0x140156020
lea rdx, [rdi - 0xf]
movabs r8, 0x8080808080808080
movabs r9, 0x101010101010100
nop word cs:[rax + rax]
mov r10, qword [rbp + rcx - 0x60]
mov r11, qword [rbp + rcx - 0x58]
mov rbx, r9
sub rbx, r11
or rbx, r11
mov r11, r9
sub r11, r10
or r11, r10
and r11, r8
and r11, rbx
cmp r11, r8
jne 0x140156020
add rcx, 0x10
cmp rcx, rdx
jbe 0x140155ff0
sub rax, rcx
je 0x1401560b7
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x140156051
inc rdx
cmp rax, rdx
jne 0x140156040
jmp 0x1401560b7
add rdx, rcx
cmp rdx, rdi
jne 0x1401560b7
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1401560cb
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401560e3
lea rax, [0x140310080]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14015610e
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x14015610e
mov rbx, rdx
call fcn.140156472
mov rdx, rbx
jmp 0x140155f3a
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1401564d0
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401564d0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov rbx, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14003c000
mov rax, qword [rbp - 0x28]
neg rax
jno 0x14015654d
mov rdi, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x14015657c
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140156590
lea rax, [0x140310080]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jae 0x1401565ac
mov rcx, qword [rbp - 0x20]
mov edx, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140019a50
mov rcx, qword [rbx]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test r14, r14
je 0x1401565ac
mov edx, 1
mov rcx, rdi
call fcn.140019a50
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140156a60
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x140354188]
mov edx, 0x10
xor ecx, ecx
call fcn.1401574a0
test rax, rax
je 0x140156b23
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140156b80]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140156b15
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, qword [r14]
test rax, rax
je 0x140156ae1
mov rcx, rbx
call rax
cmp qword [r14 + 8], 0
je 0x140156af4
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.140019a50
mov edx, 8
mov rcx, rsi
call fcn.140019a50
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 8
mov edx, 0x10
call fcn.14003be7d
ud2
Function at 0x14015a370
Capabilities:
Set file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov edi, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.140151190
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rcx, rax
neg rcx
jo 0x14015a3d5
movabs r14, 0x8000000000000000
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
call fcn.140151450
mov rbx, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
cmp rbx, r14
jne 0x14015a3e3
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rcx, rsi
mov edx, edi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x14015a407
test rbx, rbx
je 0x14015a42b
mov edx, 2
mov rcx, rsi
call fcn.140019a50
xor eax, eax
jmp 0x14015a3d8
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
test rbx, rbx
je 0x14015a3d8
mov edx, 2
mov rcx, rsi
mov rsi, rax
call fcn.140019a50
jmp 0x14015a3d5
xor eax, eax
jmp 0x14015a3d8

Function at 0x14015a450
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
mov r9, rcx
mov ecx, 0xfffffff4
pop rbp
jmp fcn.14012f740

Function at 0x14015b1e5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [0x1402341b0]
test esi, esi
je 0x14015b274
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
cmp rax, 1
ja 0x14015b267
je 0x14015b21f
test rdi, rdi
je 0x14015b223
test byte [rdi], 1
je 0x14015b228
mov r14, qword [rdi + 4]
jmp 0x14015b22b
xor ebx, ebx
jmp 0x14015b267
xor r14d, r14d
jmp 0x14015b22e
xor r14d, r14d
and dword [rdi], 0
mov ecx, 0xc
mov edx, 4
call fcn.1400476ad
mov rbx, rax
mov qword [rax], r14
mov dword [rax + 8], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14015b267
mov rcx, rdi
call fcn.14007e3e5
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140234198]
call fcn.14012f090
mov esi, eax
jmp 0x14015b1fd

Function at 0x14015b514
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [0x140234190]
test esi, esi
je 0x14007f07d
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
cmp rax, 1
ja 0x14007f070
je 0x14007f030
test rdi, rdi
je 0x14007f034
mov r14, qword [rdi]
and qword [rdi], 0
test r14, r14
je 0x14007f037
mov r14, qword [rdi + 8]
jmp 0x14007f037
xor ebx, ebx
jmp 0x14007f070
xor r14d, r14d
mov ecx, 0x10
mov edx, 8
call fcn.1400476ad
mov rbx, rax
mov qword [rax], r14
mov dword [rax + 8], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14007f070
mov rcx, rdi
call fcn.14007e9fc
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140234178]
call fcn.14012f090
mov esi, eax
jmp 0x14007f007
jmp 0x14007efef