joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084ea0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov ebx, ecx
mov dword [rsp + 0x20], 0
mov r8d, 1
cmp ecx, 5
jle 0x140084c2a
lea ebx, [r8 + 4]
jmp 0x140084c31
cmp ebx, r8d
cmovl ebx, r8d
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.14006abc0
nop
movsxd rdx, ebx
lea rax, section..data
mov rdx, qword [rax + rdx*8]
lea rcx, [rsp + 0x40]
call fcn.14000ae60
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
lea rdx, [0x1400e8e90]
lea rcx, [rsp + 0x40]
call fcn.14000ae60
mov rcx, rax
mov edx, ebx
call fcn.14000e310
mov rcx, rax
lea rdx, [0x140101354]
call fcn.14000ae60
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x140084c99
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.14000e8c0
mov rcx, rax
mov dl, 0xa
call fcn.14001d0e0
nop
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x130], 0
mov dword [rsp + 0x20], 2
mov rcx, qword [rsp + 0xb8]
test cl, 2
jne 0x140084d0b
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
test r8, r8
je 0x140084d0b
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xb0]
cmovb r8, qword [rsp + 0xb0]
sub r8, rdx
jmp 0x140084d39
test cl, 4
jne 0x140084d47
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
test rcx, rcx
je 0x140084d47
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x98]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x130]
call fcn.140007260
nop
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 0x10
cmovae rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x140084da7
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084da1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084dd2
call fcn.14009ab24
nop
lea rcx, [rsp + 0x30]
call fcn.140064490
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
call fcn.1400bcf00
nop
int3
sub rsp, 0x28
mov eax, ecx
mov rcx, qword [0x14014a508]
test rcx, rcx
je 0x140084ec9
mov dword [rsp + 0x40], eax
mov r8, rdx
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
add rsp, 0x28
ret
mov ecx, eax
add rsp, 0x28
jmp 0x140084be0
Function at 0x140089a70
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x90]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x140089ad5
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x60
pop rbx
ret
test rbx, rbx
je 0x140089ae7
lea rcx, [rsp + 0x40]
call fcn.1400c3594
mov word [rbx], ax
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x60
pop rbx
ret

Function at 0x140089b00
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, r8
movzx ebp, dx
mov rsi, rcx
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x40]
mov rdi, r9
call fcn.1400b93c0
mov qword [rsp + 0x30], 0
test rsi, rsi
jne 0x140089b52
test rbx, rbx
je 0x140089b52
or dword [rbx], 1
mov edx, 0x7f
movzx eax, bp
lea r9, [0x140101168]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
lea r8, [rdx - 0x80]
call fcn.14001dd80
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test eax, eax
jne 0x140089bd3
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140089be3
mov r8, qword [rbx + 0x10]
cmp r8, qword [rsp + 0x120]
jbe 0x140089bb5
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea eax, [rsi - 1]
jmp 0x140089be5
test rdi, rdi
je 0x140089bc6
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.1400b8f60
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
jmp 0x140089be5
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140089be3
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0xd8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140089c10
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140089c40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 6
mov dword [rsp + 0x48], 1
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x14008ed60
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14008edaf
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008edc7
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x10], 0xffffffffffffffff
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x80]
call fcn.1400b93c0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x5c], xmm1
xor edi, edi
mov dword [rsp + 0x6c], edi
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 0x404
xor edx, edx
mov qword [rsp + 0x20], 0x80
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x40]
lea rcx, str.127.0.0.1
call fcn.140089b00
test eax, eax
je 0x14008ee33
xor al, al
jmp 0x14008ef44
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x78], rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x14008ef34
mov dword [rsp + 0x34], 0x80
lea r8, [rsp + 0x34]
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14008ef34
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp]
call fcn.1400b93c0
mov word [rsp + 0x30], di
movsxd rdx, dword [rsp + 0x34]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x80
lea r8, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140089a70
mov qword [rsp + 0x20], 0x80
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x40]
movzx edx, word [rsp + 0x30]
lea rcx, str.127.0.0.1
call fcn.140089b00
test eax, eax
jne 0x14008ef34
lea edx, [rax + 1]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x14008ef34
xor r8d, r8d
lea edx, [rax + 1]
lea ecx, [rax + 2]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x10], rax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14008ef68
mov rcx, rbx
call fcn.14008ecc0
xor bl, bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_closesocket]
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14008ef2c
mov rcx, rax
call fcn.140089c10
mov rcx, qword [rbx + 0x10]
call fcn.140089c10
mov rcx, qword [rbx + 8]
call fcn.140089c40
mov rcx, qword [rbx + 0x10]
call fcn.140089c40
mov bl, 1
jmp 0x14008ef36
Function at 0x14008efb0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov byte [rsp + 0x30], 1
nop
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14008efe4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x14008efc0
add rsp, 0x20
pop rbx
ret

Function at 0x14008eff0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, rcx
nop word [rax + rax]
mov rdi, qword [rsi + 8]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14008f059
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x14008f030
cmp rbx, 0x400
je 0x14008f020
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140093bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.140093e10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x140093cda
mov rax, qword [0x14013f098]
cmp qword [rsp + 0x20], rax
jb 0x140093c24
mov rax, qword [0x14013f0a0]
cmp qword [rsp + 0x20], rax
ja 0x140093c24
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x140093be6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b93c0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x140093c55
jmp 0x140093cda
cmp dword [rsp + 0x50], 0x10000
jne 0x140093cbd
cmp qword [rsp + 0x48], 0x10000
jb 0x140093cbd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140093c9b
mov rax, qword [rsp + 0x28]
jmp 0x140093cdc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x140093cab
xor eax, eax
jmp 0x140093cdc
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140093cd5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.140093e10
mov qword [rsp + 0x20], rax
jmp 0x140093be6
xor eax, eax
add rsp, 0x68
ret
Function at 0x140093cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.140093e50
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x140093e06
mov rax, qword [0x14013f098]
cmp qword [rsp + 0x20], rax
jb 0x140093d4b
mov rax, qword [0x14013f0a0]
cmp qword [rsp + 0x20], rax
ja 0x140093d4b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x140093d0d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b93c0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x140093d7c
jmp 0x140093e06
cmp dword [rsp + 0x50], 0x10000
jne 0x140093de4
cmp qword [rsp + 0x48], 0x10000
jb 0x140093de4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140093dc2
mov rax, qword [rsp + 0x28]
jmp 0x140093e08
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x140093dd2
xor eax, eax
jmp 0x140093e08
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140093e01
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140093e50
mov qword [rsp + 0x20], rax
jmp 0x140093d0d
xor eax, eax
add rsp, 0x68
ret
Function at 0x140093ea0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140094430
mov qword [rsp + 0x28], 0
cmp qword [0x14014b8a8], 0
jne 0x140093ee8
cmp qword [0x14014b8a0], 0
je 0x140093ee8
mov rax, qword [0x14014b8a0]
mov qword [0x14014b8a8], rax
cmp qword [0x14014b8a8], 0
je 0x140093f8e
mov rax, qword [0x14014b8a8]
cmp qword [rax + 0x10], 0
je 0x140093f8e
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x140093f8e
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x140093f8e
mov rax, qword [0x14014b8a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x140093f54
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x140093f5b
xor eax, eax
jmp 0x140094105
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.1400b93c0
mov rax, qword [rsp + 0x28]
jmp 0x140094105
mov rax, qword [0x14014b8a0]
mov qword [0x14014b8a8], rax
jmp 0x140093fb0
mov rax, qword [0x14014b8a8]
mov rax, qword [rax + 8]
mov qword [0x14014b8a8], rax
cmp qword [0x14014b8a8], 0
je 0x140093ffd
cmp qword [0x14014b8a8], 0
je 0x140093ffb
mov rax, qword [0x14014b8a8]
cmp qword [rax + 0x10], 0
je 0x140093ffb
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x140093ffb
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x140093ffb
jmp 0x140093f2c
jmp 0x140093f9e
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140094110
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140094103
mov rax, qword [rsp + 0x48]
mov qword [0x14014b8a8], rax
mov rax, qword [0x14014b8a8]
mov dword [rax], 0x52727464
mov rax, qword [0x14014b8a8]
mov qword [rax + 0x10], 0
mov rax, qword [0x14014b8a8]
mov rcx, qword [0x14014b8a0]
mov qword [rax + 8], rcx
mov rax, qword [0x14014b8a8]
mov qword [0x14014b8a0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x14014b8a8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1400940b4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1400940ee
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1400940aa
mov rax, qword [0x14014b8a8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x140093f2c
xor eax, eax
add rsp, 0x58
ret
Function at 0x140094e20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140094e67
xor al, al
jmp 0x140094f09
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140094e91
xor al, al
jmp 0x140094f09
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x140094f01
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x140094f01
mov al, 1
jmp 0x140094f09
jmp 0x140094f07
xor al, al
add rsp, 0x78
ret

Function at 0x140095210
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14014b8a0]
mov qword [rsp + 0x28], rax
jmp 0x140095230
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14009525f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14009525d
call sub.KERNEL32.dll_GetLastError
jmp 0x140095261
jmp 0x140095222
xor eax, eax
add rsp, 0x38
ret
Function at 0x140095920
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x14014b8b8], eax
je 0x14009593b
mov eax, 0x10dd
jmp 0x140095a60
mov rax, qword [0x14014b8d0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400959e5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1400959b0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1400959b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.140094570
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.14009ab24
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x140095947
mov qword [0x14014b8d0], 0
call fcn.140094fd0
mov rax, qword [0x14014b8c8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140095a49
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.14009ab24
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x140095a01
mov qword [0x14014b8c8], 0
mov dword [0x14014b8b8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x14009e72c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14009e73f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400a85f0
lea rdx, [0x14013c200]
lea rcx, [rsp + 0x20]
call fcn.1400b8e6c
int3

Function at 0x1400a8f88
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14014cac0]
xor edx, edx
jmp fcn.14009e72c

Function at 0x1400a9920
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14014cac0]
jmp fcn.14009e72c

Function at 0x1400b5080
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b513c]
mov r9, qword [r9 + 8]
jmp fcn.1400a674c

Function at 0x1400b5114
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b514c]
mov r9, qword [r9 + 8]
jmp fcn.1400a674c

Function at 0x1400c7dac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c7bd8
Function at 0x1400cc600
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400cc326
call fcn.1400c2460
mov dword [rax], socket
call fcn.1400bcee0
jmp 0x1400cc471
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400cc471
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400cc471
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400cc355
lock or dword [rcx + 0x14], 0x10
jmp 0x1400cc471
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400cc369
call fcn.1400cde54
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400cc379
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400cc37c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400cab70
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400ce428
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400cc45f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400cc40d
mov rcx, rbx
call fcn.1400cab70
cmp eax, 0xffffffff
je 0x1400cc3f8
mov rcx, rbx
call fcn.1400cab70
cmp eax, 0xfffffffe
je 0x1400cc3f8
mov rcx, rbx
call fcn.1400cab70
movsxd rdi, eax
lea r14, [0x14014d260]
mov rcx, rbx
sar rdi, 6
call fcn.1400cab70
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400cc3ff
lea rdx, [0x14013f480]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400cc40d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400cc431
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400cc431
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400cc431
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400cc44f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400cc45a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400cc476
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400cc2f0

Function at 0x1400d0e88
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d0ea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c23f0
or eax, 0xffffffff
jmp 0x1400d0eaa
xor eax, eax
add rsp, 0x28
ret