joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060700
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006074a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006074a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006074a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006074a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006074a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006074c
xor al, al
add rsp, 0x28
ret

Function at 0x140064020
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140064048
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140064048
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140066e30
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002270
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400022c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001853
mov dword [rax + 0x60], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14009c4a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002270
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400022c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001853
mov dword [rax + 0x60], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14013654f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140159580
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14053f2dc]
call fcn.14013ceb8
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1401595bc
mov rcx, qword [rbp + 0x100]
call fcn.14013693c
jmp 0x1401595d7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1401595d7
mov rcx, qword [rbp + 0x100]
call fcn.140138dfe
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1401365c2
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14015ac30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14053f20c]
call fcn.14013ceb8
mov qword [rbp + 8], 0
jmp 0x14015ac6e
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x14015acc4
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x14015ac63
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140136edc
Capabilities:
Get common file path

Disassembly:
jmp 0x14035f550
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rsp, 0x28
ret
Function at 0x1401388ef
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1402b3950
mov rax, rcx
neg rcx
test rax, 7
je 0x1402b396d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1402b39c8
test al, 7
jne 0x1402b3960
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1402b3981
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402b39f2
test dh, dh
je 0x1402b39ec
shr rdx, 0x10
test dl, dl
je 0x1402b39e6
test dh, dh
je 0x1402b39e0
shr rdx, 0x10
test dl, dl
je 0x1402b39da
test dh, dh
je 0x1402b39d4
shr edx, 0x10
test dl, dl
je 0x1402b39ce
test dh, dh
jne 0x1402b3981
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14013892b
Capabilities:
Query environment variable

Disassembly:
jmp 0x14038d560
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14038d0e0
lea rcx, [rsp + 0x20]
call fcn.14038d130
movzx eax, al
test eax, eax
jne 0x14038d5a5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14038d110
mov rax, qword [rsp + 0x40]
jmp 0x14038d69f
lea rcx, [rsp + 0x20]
call fcn.14038d230
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14038d1d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140138ea8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140137f0d
lea rcx, [rsp + 0x28]
call fcn.1401395dd
movzx eax, al
test eax, eax
jne 0x14038d63f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14013b522
lea rcx, [rsp + 0x20]
call fcn.14038d110
mov rax, qword [rsp + 0x50]
jmp 0x14038d69f
lea rcx, [rsp + 0x20]
call fcn.14038d230
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14013cd19
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140138d77
lea rcx, [rsp + 0x28]
call fcn.14013dbc9
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14013b522
lea rcx, [rsp + 0x20]
call fcn.14038d110
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140138c7d
Capabilities:
Reference sql statements

Disassembly:
jmp 0x140151940
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x70]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
lea rax, [rbp + 0x150]
mov qword [rbp + 8], rax
mov qword [rbp + 0x28], 0
movzx eax, byte [0x1404511e4]
test eax, eax
jne 0x14015199d
xor al, al
jmp 0x140151b33
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 8]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rbp + 8]
movzx ecx, byte [rdx + rcx]
mov edx, 1
imul rdx, rdx, 2
mov r8, qword [rbp + 8]
movzx edx, byte [r8 + rdx]
mov r8d, 1
imul r8, r8, 3
mov r9, qword [rbp + 8]
movzx r8d, byte [r9 + r8]
mov r9d, 1
imul r9, r9, 1
mov r10, qword [rbp + 8]
movzx r9d, byte [r10 + r9]
mov r10d, 1
imul r10, r10, 2
mov r11, qword [rbp + 8]
movzx r10d, byte [r11 + r10]
mov r11d, 1
imul r11, r11, 3
mov rbx, qword [rbp + 8]
movzx ebx, byte [rbx + r11]
mov r11d, 1
imul r11, r11, 2
mov rdi, qword [rbp + 8]
movzx edi, byte [rdi + r11]
mov r11d, 1
imul r11, r11, 3
mov rsi, qword [rbp + 8]
movzx esi, byte [rsi + r11]
mov dword [rbp + 0x114], esi
mov r11d, 1
imul r11, r11, 3
mov rsi, qword [rbp + 8]
movzx esi, byte [rsi + r11]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov eax, dword [rbp + 0x114]
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, str.ipbanlist
lea rdx, str.SELECT_count___FROM___s__WHERE__rtime____NOW___AND___list____u..._OR__list____u._u.._OR__list____u._u._u._OR__list____u._u._u._u_
mov rcx, qword [0x1404510c8]
call fcn.140138935
cmp eax, 0xffffffff
jne 0x140151ace
mov eax, dword [str._Gc]
add eax, 0xb
mov r8d, eax
lea rdx, str.C:UsersuserDesktop_raTest_srcloginipban.cpp
mov rcx, qword [0x1404510c8]
call fcn.140138584
mov al, 1
jmp 0x140151b33
mov rcx, qword [0x1404510c8]
call fcn.1401360db
cmp eax, 0xffffffff
jne 0x140151ae3
mov al, 1
jmp 0x140151b33
xor r9d, r9d
lea r8, [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x1404510c8]
call fcn.140136c66
mov rcx, qword [rbp + 0x28]
call fcn.140136446
mov dword [rbp + 0x44], eax
mov rcx, qword [0x1404510c8]
call fcn.140135b45
cmp dword [rbp + 0x44], 0
jle 0x140151b22
mov dword [rbp + 0x114], 1
jmp 0x140151b2c
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
mov rdi, rax
lea rcx, [rbp - 0x70]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b8a6
mov rax, rdi
lea rsp, [rbp + 0x128]
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140138dfe
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14015c6f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14053f2dc]
call fcn.14013ceb8
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x14015c734
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x14015c7c5
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14015c78a
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14015c794
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14015c729
mov qword [rbp + 0x88], 0xe3
jmp 0x14015c7e3
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14015c88c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x14015c848
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14015c852
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14015c7d2
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x14015c8ec
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14015c8f6
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1401390d3
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1402aef20
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402ae8a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402aef5f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140541020]
jmp 0x1402aef69
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14013949d
Capabilities:
Query environment variable

Disassembly:
jmp 0x14038d2b0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14038d0e0
lea rcx, [rsp + 0x40]
call fcn.14038d260
movzx eax, al
test eax, eax
jne 0x14038d2f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14038d110
mov rax, qword [rsp + 0x70]
jmp 0x14038d4c9
lea rcx, [rsp + 0x40]
call fcn.14038d230
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14038d1d0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14038d230
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14013af7d
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14038d39e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14038d110
mov rax, qword [rsp + 0x80]
jmp 0x14038d4c9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140138ea8
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140138b42
lea rcx, [rsp + 0x48]
call fcn.140138250
movzx eax, al
test eax, eax
jne 0x14038d405
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1401363ab
lea rcx, [rsp + 0x40]
call fcn.14038d110
mov rax, qword [rsp + 0x88]
jmp 0x14038d4c9
lea rcx, [rsp + 0x48]
call fcn.140139c63
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14038d230
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14013af7d
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14038d49b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1401363ab
lea rcx, [rsp + 0x40]
call fcn.14038d110
mov rax, qword [rsp + 0xa0]
jmp 0x14038d4c9
lea rcx, [rsp + 0x48]
call fcn.140138ae3
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1401363ab
lea rcx, [rsp + 0x40]
call fcn.14038d110
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1401394bb
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402aee50
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1402ae820
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402aee91
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140541020]
jmp 0x1402aee97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1401395e7
Capabilities:
Get geographical location

Disassembly:
jmp 0x14036ffa0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14036eed0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140370007
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140541030]
jmp 0x140370029
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1401381ab
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x14013960a
Capabilities:
Terminate process

Disassembly:
jmp 0x14028a020
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140139b9b
Capabilities:
Print debug messages

Disassembly:
jmp 0x140397f90
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14044e640]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140397fb6
jmp 0x140398033
mov rcx, qword [rbp + 0x30]
call fcn.1401388ef
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140397fcf
jmp 0x140398033
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140397fec
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401366d5
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14013707b
test eax, eax
jne 0x140398033
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140138d40
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14013a21c
Capabilities:
Set environment variable

Disassembly:
jmp 0x14038f410
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x14013a712
Capabilities:
Parse pe header

Disassembly:
jmp 0x14028c3a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14028c3c0
xor al, al
jmp 0x14028c441
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14028c3d3
xor al, al
jmp 0x14028c441
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14028c3fd
xor al, al
jmp 0x14028c441
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14028c411
xor al, al
jmp 0x14028c441
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14028c423
xor al, al
jmp 0x14028c441
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14028c43f
xor al, al
jmp 0x14028c441
mov al, 1
add rsp, 0x38
ret

Function at 0x14013ab68
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140179780
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14044e640]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14013ceb8
lea rax, str.conf_packet_athena.conf
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0x1000
mov eax, 2
mov word [rbp + 0x204], ax
lea rdx, [rbp + 0x50]
movzx ecx, word [rbp + 0x204]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140179801
lea rcx, str.socket_init:_WinSock_not_available__n
call fcn.1401388b3
jmp 0x14017990b
movzx eax, word [rbp + 0x50]
and rax, 0xff
movzx eax, al
cmp eax, 2
jne 0x140179828
movzx eax, word [rbp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
test eax, eax
je 0x140179839
lea rcx, str.socket_init:_WinSock_version_mismatch__2.0_or_compatible_required___n
call fcn.1401388b3
jmp 0x14017990b
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x1404693b0]
call fcn.14013cea9
mov dword [0x1404693a4], eax
mov dword [0x1404693f0], 0
lea rcx, str.Server_uses_e_1_37mselecte_0m_as_event_dispatcher_n
call fcn.14013b946
mov r8d, 0x200
xor edx, edx
lea rcx, [0x140475400]
call fcn.14013ae88
mov rcx, qword [rbp + 8]
call fcn.1401391c8
xor ecx, ecx
call fcn.140179b30
mov qword [0x1404693a8], rax
lea r9, [0x14013bee6]
lea r8, [0x140135fbe]
lea rdx, [0x14013a433]
xor ecx, ecx
call fcn.140176430
mov r8d, 0x80000
xor edx, edx
lea rcx, [0x14047da30]
call fcn.14013ae88
lea rdx, str.connect_check_clear
lea rcx, [0x140175ef0]
call fcn.14013781e
call fcn.14013bc2f
add rax, 0x3e8
mov dword [rsp + 0x20], 0x493e0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140175ef0]
mov rcx, rax
call fcn.14013d084
mov edx, dword [rbp + 0x24]
lea rcx, str.Server_supports_up_to_e_1_37m_ue_0m_concurrent_connections._n
call fcn.14013b946
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14013b8a6
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140138d40
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x14013b379
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b4de0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402b4e0e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14013c576
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14013bf81
Capabilities:
Set current directory

Disassembly:
jmp 0x140397ea0
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rcx, [rsp + 0x30]
call fcn.140137e90
call fcn.1401393bc
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.1401379b3
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140397eed
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1401386f6
mov eax, dword [rsp + 0x24]
jmp 0x140397f12
lea rcx, [rsp + 0x30]
call fcn.140137d2d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.1401386f6
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x14013c61b
Capabilities:
Print debug messages

Disassembly:
jmp 0x140364060
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret