joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4f9b
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, rcx
mov eax, dword [0x140154a00]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x1b8]
test rax, rax
je 0x1400c4fdc
cmp eax, 1
je 0x1400c5009
xor esi, esi
jmp 0x1400c5193
mov eax, dword [0x140154a00]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 0x150]
lea rdx, [0x1400c5477]
mov rcx, rsi
call fcn.14009c290
mov byte [rsi + 0x68], 1
test rbx, rbx
je 0x1400c50d3
lea rax, [rsp + 0x60]
mov ecx, 0xd
mov rdi, rax
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 0
cmp qword [rax], 0
je 0x1400c50c9
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x88]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov r10, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xbc]
mov bl, byte [rsp + 0xc0]
mov cl, byte [rsp + 0xc1]
mov byte [rsp + 0x27], cl
mov r11b, byte [rsp + 0xc2]
mov ecx, dword [rsp + 0xc3]
mov dword [rsp + 0x28], ecx
mov cl, byte [rsp + 0xc7]
mov byte [rsp + 0x2c], cl
jmp 0x1400c50f4
lea rcx, [rsp + 0x60]
call fcn.1400c5335
call fcn.1400c51aa
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov r10d, 2
mov r11b, 2
xor ebx, ebx
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
mov ecx, dword [0x140154a00]
mov r8, qword gs:[0x58]
mov r12, qword [r8 + rcx*8]
lea r8, [r12 + 0x150]
lea r9, [rsp + 0x60]
mov ecx, 0xd
mov rsi, r8
mov rdi, r9
rep movsq qword [rdi], qword [rsi]
mov qword [r8], 1
mov qword [r8 + 8], r14
lea rsi, [r12 + 0x158]
mov qword [rsi + 8], rbp
mov qword [rsi + 0x10], r13
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], r15
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x40], r10
mov rcx, qword [rsp + 0x38]
mov qword [rsi + 0x48], rcx
mov dword [rsi + 0x50], eax
mov dword [rsi + 0x54], edx
mov byte [rsi + 0x58], bl
mov al, byte [rsp + 0x27]
mov byte [rsi + 0x59], al
mov byte [rsi + 0x5a], r11b
mov eax, dword [rsp + 0x28]
mov dword [rsi + 0x5b], eax
mov al, byte [rsp + 0x2c]
mov byte [rsi + 0x5f], al
mov rcx, r9
call fcn.1400c5335
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400ca59a
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400ca5a1
test al, 1
je 0x1400ca5c0
test al, 2
jne 0x1400ca5d5
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14013fde8]
mov edx, 0x23
jmp 0x1400ca5e8
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14013fe28]
mov edx, 0x25
call fcn.14010bf50
ud2
Function at 0x1400cb466
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
cmp rdx, 0xffffffffffffffff
je 0x1400cb479
add rsp, 0x28
jmp fcn.1400a8300
lea rcx, str.called__Option::unwrap____on_a__None__valueC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.5_srcwin.rs
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.2_srciopoll_evented.rs
mov edx, 0x2b
call fcn.14010bf50
ud2
Function at 0x1400cb73c
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], r9
mov rbx, r8
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0xc0]
lea rcx, [rdx + 0x10]
mov qword [rsp + 0x48], rcx
mov rdi, qword [rdx]
mov r15, qword [rdx + 8]
mov r12, qword [rdx + 0x20]
mov r13d, 0x7fffffff
cmp rax, r13
cmovb r13, rax
lea rbp, [rsp + 0x28]
mov rcx, rbp
mov rdx, r12
mov r8, rbx
mov r9b, 1
call fcn.1400cac97
mov al, byte [rsp + 0x31]
cmp al, 3
je 0x1400cb8cc
mov rcx, qword [rsp + 0x28]
cmp al, 2
je 0x1400cb8da
mov dl, byte [rsp + 0x30]
lea r9, [rsp + 0x32]
movzx r8d, word [r9 + 4]
lea r10, [rsp + 0x42]
mov word [r10 + 4], r8w
mov r8d, dword [r9]
mov dword [r10], r8d
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x40], dl
mov byte [rsp + 0x41], al
cmp r15, 0xffffffffffffffff
je 0x1400cb91e
mov rcx, r15
mov rdx, qword [rsp + 0x50]
mov r8d, r13d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400cb8e8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rsi, rax
shl rsi, 0x20
or rsi, 2
mov ecx, eax
call fcn.14009d240
cmp al, 0xd
jne 0x1400cb86e
test rdi, rdi
je 0x1400cb86e
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
lock inc qword [rdx]
jle 0x1400cb938
add rcx, 0x10
mov r8, qword [rdi]
mov r9b, byte [rdi + 0x18]
call fcn.140076f70
test rax, rax
je 0x1400cb86e
mov r14, rax
mov rcx, rsi
call fcn.1400751f6
mov eax, r14d
and eax, 3
lea rcx, [0x1400cb93c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
mov rsi, r14
jmp rax
mov eax, esi
and eax, 3
lea rcx, [0x1400cb93c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov al, byte [rsi + 0x10]
jmp 0x1400cb899
mov al, byte [rsi + 0xf]
jmp 0x1400cb899
mov rcx, rsi
shr rcx, 0x20
call fcn.14009d240
cmp al, 0xd
je 0x1400cb8ab
jmp 0x1400cb8fd
mov rax, rsi
shr rax, 0x20
cmp eax, 0xd
jne 0x1400cb8fd
mov qword [rsp + 0x28], rsi
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x38]
call fcn.1400cb030
mov rcx, rbp
call fcn.1400c4f31
jmp 0x1400cb787
mov rax, qword [rsp + 0x20]
mov qword [rax], 2
jmp 0x1400cb90d
mov rax, qword [rsp + 0x20]
mov qword [rax], 1
jmp 0x1400cb8f7
movsxd rcx, eax
mov rax, qword [rsp + 0x20]
mov qword [rax], 0
mov qword [rax + 8], rcx
jmp 0x1400cb90d
mov rax, qword [rsp + 0x20]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.5_srcwin.rs
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.2_srciopoll_evented.rs
mov edx, 0x2b
call fcn.14010bf50
ud2
ud2
Function at 0x1400db299
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x1e0]
mov rbx, qword [r14 + 8]
mov r15d, dword [r14]
mov r12d, dword [r14 + 4]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400539a2
mov dil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400539a2
mov sil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400539a2
mov rbp, qword [rax + 0x88]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400539a2
cmp dil, 5
ja 0x1400db351
cmp dil, 3
jne 0x1400db388
mov edi, dword [rax + 0xb8]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.140053f00
lea rcx, [rax + 0x60]
mov edx, edi
mov r8d, dword [rsp + 0x34]
mov r9d, r13d
call fcn.14005f086
cmp sil, 5
ja 0x1400db39c
test rbp, rbp
jne 0x1400db39c
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov r8, r14
call fcn.1400db41a
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400539a2
mov eax, dword [rax + 0xb8]
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdx + 8], eax
mov byte [rdx], 8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r8, rdi
mov r9, r14
call fcn.1400d975c
mov rcx, rsi
mov rdx, r14
mov r8, qword [rsp + 0x48]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14005d550
Function at 0x1401095b2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140109664
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi + 0x18]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call fcn.14002034b
test rdi, rdi
je 0x1401096dd
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x1401096f3
movabs rcx, 0x100000001b3
mov rdx, qword [rsi + 0x18]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x14010968c
test rdx, rdx
je 0x1401097e8
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140109808
mov r8, qword [rsi]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x1401096c1
jmp 0x140109808
movzx eax, byte [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.14002034b
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140109808
movzx edx, byte [rsi]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x1401097f2
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x14010af14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14010af5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14010af5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14010af5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14010af5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14010af5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14010af60
xor al, al
add rsp, 0x28
ret
Function at 0x1401101d4
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14011022d
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011022d
mov rbx, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011022d
mov rsi, rax
mov r15d, 1
jmp 0x1401102b5
lea rcx, [0x1401372e0]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14011031f
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011031f
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011031f
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011031f
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14011031f
mov rbx, qword [rsp + 0x28]
xor r15d, r15d
mov ecx, 0x20
mov edx, 8
call fcn.1400430d0
test rax, rax
je 0x140110339
mov r14, rax
mov qword [rax], r15
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor eax, eax
lock cmpxchg qword [0x140154850], r14
je 0x140110310
mov rsi, rax
cmp qword [r14], 0
jne 0x1401102fb
mov rcx, qword [r14 + 8]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x140154958]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov r14, rsi
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x1401373e8]
mov edx, 0x5b
call fcn.14011034a
ud2
mov ecx, 0x20
mov edx, 8
call fcn.14010bac0
ud2
Function at 0x140111c10
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x140154960]
cmp rax, 3
jne 0x1400a7bcd
cmp rbx, 0x17f
ja 0x1400a7bdf
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.14004c510
cmp qword [rsp + 0x28], 0
je 0x1400a7b51
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400a7bbe
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400a7ba8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400a7bbb
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140111bb0
cmp rbx, 0x17f
jbe 0x1400a7b0a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140111c10
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1400433b0
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140111c70
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x140111cff
mov rcx, qword [0x140154958]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140111ccf
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140111ce2
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x140111cff
mov rcx, qword [0x140154958]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x402790
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00453900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004538e0]
test rbx, rbx
je 0x4027e4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4027db
test r12, r12
je 0x4027db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4027c0
lea rcx, [0x00453900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402b20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004503b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402b99
mov rcx, r10
call fcn.004029f0
test eax, eax
je 0x402b99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402b96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402b99
add r8, 0x28
cmp r8, r9
jne 0x402b78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x14001dc20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140292920]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 0x18]
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rax + 0x80]
mov eax, dword [rdx + 0x24]
cmp qword [rbx + 0x40], 0
mov dword [rbx + 0xf0], eax
jne 0x14001dd63
mov rax, qword [rcx]
call qword [rax + 0x98]
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + LoadRegTypeLib]
mov ecx, dword [rdi + 0x10]
lea r8, [rsp + 0x30]
mov edx, dword [rdi + 0x14]
mov eax, dword [rdi + 0x20]
mov r9, qword [rdi]
mov dword [rsp + 0x30], ecx
add ecx, dword [rdi + 0x18]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rdi + 0x1c]
add ecx, edx
mov dword [rsp + 0x34], edx
mov edx, dword [rdi + 0x28]
mov dword [rsp + 0x3c], ecx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140041f50
test eax, eax
je 0x14001dd63
mov r8d, dword [rdi + 0x2c]
mov rcx, rbx
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], r14
call fcn.140032d60
mov rax, qword [rbx + 0x110]
mov edx, 0x401
mov r14, qword [rbx + 0x108]
mov rcx, qword [rbx + 0x40]
cmp r14, rax
mov ebp, r14d
cmovle r14d, eax
cmovge ebp, eax
movzx eax, bp
xor r8d, r8d
movzx r9d, r14w
shl r9, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbx + 0x118]
cmp eax, ebp
jl 0x14001dd1e
cmp eax, r14d
mov ebp, eax
cmovg ebp, r14d
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
movsxd r8, ebp
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rbx + 0x40], 0
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
je 0x14001dd5c
mov rax, qword [rsi]
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0xa8]
mov eax, 1
jmp 0x14001dd65
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401ce2d0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001fe40
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x1c8], 0
mov ebx, edx
mov rdi, rcx
jne 0x14001fe68
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14004694c
test ebx, ebx
jne 0x14001fe83
mov qword [0x1402933d0], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1402a109c], eax
cmp qword [0x1402933d0], 0
je 0x14001feb1
mov edx, ebx
mov rcx, rdi
call fcn.14004694c
movsxd rcx, eax
mov qword [0x1402933d0], rcx
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 2
jl 0x14001fea1
lea rcx, [0x1402a1250]
call fcn.14002b570
mov rax, qword [rdi + 0x1c8]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1402a109c]
mov rcx, qword [rdi + 0x1c8]
mov edx, eax
mov rax, qword [rbx + 0xa0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x140026130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x140026300
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x1400261a0
cmp edi, 3
je 0x1400261a0
sub edi, 1
je 0x14002618f
cmp edi, 1
jne 0x140026300
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140026302
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140026302
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x140026300
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140026300
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x140026266
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140024000
test rax, rax
je 0x14002623f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140026266
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x140026300
cmp edi, 3
jne 0x1400262fb
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x1400262ed
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x1400262ed
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x1400262ed
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x1400262ea
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140026302
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140026302
mov rax, rsi
jmp 0x140026302
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret