joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048d50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rdi, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
lea rbx, [rdi + 0x150]
test dword [rdi + 0x68], 0x800000
jne 0x140048e50
movsxd rcx, dword [rdi + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140048dce
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x24]
lea r8, [rsp + 0x40]
mov dword [rbx + 4], eax
lea rdx, [rsp + 0x20]
movzx eax, word [rsp + 0x22]
mov dword [rbx + 8], eax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
movsxd rcx, dword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x140048dbb
cmp dword [rdi + 0x54], eax
je 0x140048e0b
movups xmm0, xmmword [rdi + 0x50]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0xc], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x10
movzx ecx, ax
mov dword [rbx + 0x10], ecx
test esi, esi
je 0x140048e33
mov eax, dword [rbx + 8]
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov dword [rbx], 5
call fcn.140046940
test eax, eax
jne 0x140048dbb
or dword [rdi + 0x68], 0x800000
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004be00
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov r14d, edx
mov dword [rsp + 0x38], r8d
xor r15d, r15d
mov dword [r11 - 0x28], edx
mov ebp, r8d
mov edx, dword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
mov dword [r11 - 0x30], r15d
mov ebx, 0x2390
add rbx, qword [rax]
mov edi, 0x2384
add rdi, qword [rax]
lea rax, [r11 + 8]
mov dword [r11 + 8], r15d
mov r8, qword [rbx]
mov qword [r11 - 0x38], rax
mov r9d, dword [rdi]
call fcn.14004e510
mov r9d, dword [rdi]
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jl 0x14004bec2
cmp r9d, eax
jg 0x14004be8a
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.140029730
mov r9d, dword [rdi]
mov r8, qword [rbx]
lea rax, [rsp + 0x60]
mov edx, dword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], r15d
call fcn.14004e510
mov r9d, dword [rdi]
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jg 0x14004bee8
mov rcx, qword [rbx]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movsxd rdx, eax
mov byte [rdx + rcx], r15b
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov r8d, eax
lea rdx, str.set_str_length_mismatch__d__d
mov ecx, 0x45
call fcn.140028d40
int3
Function at 0x1400539a0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov ebx, r9d
mov rdx, rcx
mov edi, r8d
lea rcx, [rsp + 0x48]
sub rcx, 8
call fcn.1400296d0
mov rcx, qword [rsp + 0x88]
mov r9d, ebx
mov qword [rsp + 0x38], rcx
mov r8d, edi
mov ecx, dword [rsp + 0x80]
mov edx, esi
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, rax
call fcn.1401712b0
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
mov rsi, qword [rsp + 0x58]
cmp rax, 0xffffffffffffffff
cmove rax, rcx
add rsp, 0x40
pop rdi
ret

Function at 0x140053ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, r8
xor edx, edx
mov ebx, r9d
mov rsi, rcx
lea r8d, [rdx + 0x78]
call fcn.140174d10
xor r8d, r8d
mov dword [rsi + 0x38], ebx
mov rdx, rdi
mov qword [rsi], rdi
mov rcx, rsi
mov qword [rsi + 8], rbp
call fcn.140054170
mov rcx, rsi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x10], rax
call fcn.140053ef0
test eax, eax
jne 0x140053d8c
mov rbx, qword [rsi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, rbx
lea edx, [rax + 0x32]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140053d8c
mov edi, dword [rsp + 0x58]
test rbx, rbx
je 0x140053d8c
mov r9, qword [rsi + 0x10]
mov rdx, rbx
mov r8d, dword [rsi + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.1400542e0
movsd xmm0, qword [rbx]
mov r8d, edi
mov r9, qword [rsi + 8]
mov edx, 0x32
movsd qword [rsi + 0x3c], xmm0
mov rcx, rbx
mov eax, dword [rbx + 8]
mov dword [rsi + 0x44], eax
movzx eax, word [rbx + 0xc]
mov word [rsi + 0x48], ax
movsd xmm0, qword [r9]
movsd qword [rsi + 0x66], xmm0
mov eax, dword [r9 + 8]
mov dword [rsi + 0x6e], eax
movzx eax, word [r9 + 0xc]
lea r9, [rsp + 0x58]
mov word [rsi + 0x72], ax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
jmp 0x140053dae
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140053dab
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsi + 0x20], 0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140053ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0xcc8
mov r9d, dword [rcx + 0x38]
lea rax, [rsp + 0xce0]
mov rdx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], send
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x32]
call fcn.140007ed0
cmp eax, 3
je 0x140054162
lea edx, [rbx + 0x2a]
mov qword [rsp + 0xce8], rbp
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14005414d
mov qword [rsp + 0xcf0], rdi
mov qword [rsp + 0xcf8], r12
mov qword [rsp + 0xcc0], r13
mov qword [rsp + 0xcb8], r14
mov qword [rsp + 0xcb0], r15
cmp qword [rsi + 0x28], rbx
jne 0x140053f9a
mov qword [rsi + 0x28], rax
mov rdx, qword [rsi + 8]
mov r13d, 0x80000000
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, rcx
sub rdi, rdx
mov r14d, 5
cmp rcx, rdx
mov r8d, r14d
mov r12d, send
cmovbe rdi, rax
cmp rdi, r13
mov edi, dword [rsp + 0xce0]
cmovae r8d, r12d
xor edx, edx
test edi, edi
je 0x140053ffb
nop
cmp ebx, r8d
jge 0x140053ffb
mov eax, edx
inc edx
imul rcx, rax, 0xd0
add ebx, dword [rsp + rcx + 0x140]
cmp edx, edi
jb 0x140053fe0
mov rdx, qword [rsi + 0x18]
mov rcx, rbp
movsxd r15, ebx
mov r8, r15
call fcn.140174ed0
mov rdx, qword [rsi + 0x28]
mov rdi, qword [rsi + 0x10]
mov rcx, rdx
sub rcx, rdi
mov rax, rdi
sub rax, rdx
cmp rdx, rdi
lea r9, [r15 + rdx]
lea r8, [r15 + rdi]
mov edx, r14d
cmovbe rcx, rax
mov rax, r8
cmp rcx, r13
mov rcx, r9
cmovae edx, r12d
sub rax, r9
sub rcx, r8
cmp r9, r8
cmovbe rcx, rax
cmp rcx, r13
jae 0x14005406c
sub r8d, r9d
mov eax, r14d
sub r8d, r14d
mov byte [rsp + 0x40], 0xe9
mov dword [rsp + 0x41], r8d
lea rdi, [rsp + 0x45]
jmp 0x140054088
mov eax, r12d
lea rdi, [rsp + 0x4e]
mov word [rsp + 0x40], 0x25ff
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], r8
mov r8d, edx
cmp eax, edx
jae 0x14005409c
mov ecx, r8d
sub rcx, rax
mov eax, 0xcc
rep stosb byte [rdi], al
lea rcx, [r15 + rbp]
lea rdx, [rsp + 0x40]
call fcn.140174ed0
mov r9, qword [rsi + 0x10]
lea rax, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbp
call fcn.140054210
mov r15, qword [rsp + 0xcb0]
test eax, eax
jne 0x140054137
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x28]
mov rcx, r8
sub rcx, rdx
mov qword [rsi + 0x20], rbp
mov rdi, rdx
mov dword [rsi + 0x30], ebx
sub rdi, r8
cmp rdx, r8
cmovbe rdi, rcx
cmp rdi, r13
cmovae r14d, r12d
add r14d, ebx
mov dword [rsi + 0x34], r14d
mov r13, qword [rsp + 0xcc0]
mov r12, qword [rsp + 0xcf8]
mov rdi, qword [rsp + 0xcf0]
mov r14, qword [rsp + 0xcb8]
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
jmp 0x140054105
or eax, 0xffffffff
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0xcc8
pop rsi
pop rbx
ret
Function at 0x140055d40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rdi, r9
mov rsi, r8
mov r15, rdx
test rcx, rcx
je 0x140055d92
cmp qword [rcx], 0
je 0x140055d92
cmp dword [rcx + 8], 0x40
jb 0x140055d92
xor r9d, r9d
test r8, r8
je 0x140055d6d
mov qword [r8], r9
test rdi, rdi
je 0x140055d75
mov qword [rdi], r9
mov r10, qword [rsp + 0x38]
test r10, r10
je 0x140055d82
mov qword [r10], r9
mov rax, qword [rcx]
mov edx, dword [rcx + 8]
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x140055d9e
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
movsxd r8, dword [rax + 0x3c]
lea ecx, [r8 + 0x14]
cmp ecx, edx
ja 0x140055d92
add ecx, 0x18
mov qword [rsp + 0x18], rbx
lea rbx, [rax + r8]
cmp ecx, edx
ja 0x140055eb0
cmp dword [rbx], 0x4550
jne 0x140055eb0
mov qword [rsp + 0x20], rbp
mov r8d, 0xe0
movzx ebp, word [rbx + 0x14]
mov qword [rsp + 0x28], r14
movzx eax, bp
sub ax, r8w
lea r14, [rbx + 4]
mov r8d, 0xffef
test r8w, ax
jne 0x140055eab
movzx eax, bp
add ecx, eax
cmp ecx, edx
ja 0x140055eab
movzx eax, word [rbx + 0x18]
lea r8, [rbx + 0x18]
mov r11d, 0x10b
sub ax, r11w
mov r11d, 0xfeff
test r11w, ax
jne 0x140055eab
movzx r11d, word [r14 + 2]
lea eax, [r11 + r11*4]
lea ecx, [rcx + rax*8]
cmp ecx, edx
ja 0x140055eab
cmp dword [r8 + 0x3c], edx
ja 0x140055eab
movzx ebp, bp
add rbp, r8
test r11d, r11d
je 0x140055e71
lea rcx, [rbp + 0x10]
nop dword [rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, edx
ja 0x140055eab
mov eax, dword [rcx - 8]
add eax, dword [rcx - 4]
cmp eax, dword [r8 + 0x38]
ja 0x140055eab
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140055e50
test r15, r15
je 0x140055e79
mov qword [r15], rbx
test rsi, rsi
je 0x140055e81
mov qword [rsi], r14
test rdi, rdi
je 0x140055e89
mov qword [rdi], r8
test r10, r10
je 0x140055e91
mov qword [r10], rbp
xor eax, eax
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
or eax, 0xffffffff
jmp 0x140055e93
mov rbx, qword [rsp + 0x18]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x140055ed0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov ebp, ecx
mov ebx, 0x1000
mov edx, 1
mov ecx, ebx
mov r14, r8
call fcn.1401762f4
mov rcx, qword [rsi]
mov rdi, rax
test rcx, rcx
je 0x140055f12
call fcn.1401762fc
mov qword [rsi], 0
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov ecx, ebp
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rsp + 0x48]
cmp eax, 0xc0000004
je 0x140055f33
cmp ecx, ebx
jbe 0x140055f47
lea eax, [rcx + rbx*2]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14017d614
mov rdi, rax
jmp 0x140055f12
xor eax, eax
test r14, r14
je 0x140055f51
mov dword [r14], ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov qword [rsi], rdi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a780
Capabilities:
List tcp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14027a2e4]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.14017d614
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
cmp eax, 0x7a
jne 0x14005a83b
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.14017d614
mov edx, dword [0x14027a2e4]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14027a2e4], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 5
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov edi, eax
test eax, eax
je 0x14005a834
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005a834
call fcn.1401762fc
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14005a850
Capabilities:
List udp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14027a2e8]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.14017d614
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
cmp eax, 0x7a
jne 0x14005a90b
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.14017d614
mov edx, dword [0x14027a2e8]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14027a2e8], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
mov edi, eax
test eax, eax
je 0x14005a904
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005a904
call fcn.1401762fc
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14005f220
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
call fcn.140174d10
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret

Function at 0x14005f3c0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140174d10
mov eax, 1
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
add rsp, 0x20
pop rbx
ret
Function at 0x14005f750
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140174d10
mov eax, 1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
add rsp, 0x20
pop rbx
ret

Function at 0x140060710
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.140174d10
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x14006c8e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006c920
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov dword [rbx], eax
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14006ca70
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14006e450
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor esi, esi
mov rdi, rcx
mov ebx, esi
lea edx, [rsi + 1]
call fcn.140060390
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.140060220
mov r14, rax
test rax, rax
je 0x14006e4f1
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14006e4ca
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400602a0
mov rcx, rdi
call fcn.140060440
mov rbx, rax
test rax, rax
jne 0x14006e58d
mov edx, 1
mov rcx, rdi
call fcn.140060390
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.140060220
mov r14, rax
test rax, rax
je 0x14006e57b
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14006e55d
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.1400602a0
mov rcx, rdi
call fcn.140060440
mov rbx, rax
test rbx, rbx
je 0x14006e585
mov rax, rbx
jmp 0x14006e58d
mov rcx, rdi
call fcn.140060440
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14006ea50
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14006ea77
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14006ea60
movzx eax, r9b
ret
Function at 0x14006ec20
Capabilities:
Access the windows event log
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x168
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
test rax, rax
je 0x14006ecdd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x14006ecdd
mov qword [rsp + 0x160], rsi
lea rbx, [rsp + 0x188]
call fcn.14001fb00
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov esi, 0x100
xor ebx, ebx
mov r8d, esi
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017bc38
or ecx, 0xffffffff
mov qword [rsp + 0x20], rbx
test eax, eax
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x60]
cmovs eax, ecx
mov rcx, rdi
test eax, eax
cmovs eax, esi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x160]
add rsp, 0x168
pop rdi
pop rbx
ret
lea rbx, [rsp + 0x188]
call fcn.14001fb00
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov r8d, 0xff
xor ebx, ebx
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017bc38
mov byte [rsp + 0x15f], bl
call fcn.14006eac0
xor ecx, ecx
test eax, eax
jle 0x14006ed9b
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
test rax, rax
je 0x14006edb3
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x60]
mov ecx, 1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x14006ed88
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x168
pop rdi
pop rbx
ret
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_MessageBoxA]
add rsp, 0x168
pop rdi
pop rbx
ret

Function at 0x1400714f0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x14027c0b8]
jmp fcn.14006c8e0

Function at 0x140079300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140079368
movzx eax, byte [rcx]
test al, al
je 0x140079368
mov qword [rsp + 0x30], rsi
mov esi, 0x100
movsx ecx, al
call fcn.1400c34e0
or eax, esi
lea rdi, [rdi + 1]
mov ecx, eax
add esi, 0x100
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
xor ebx, eax
movzx eax, byte [rdi]
test al, al
jne 0x140079325
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400aab90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov r8, rsi
mov rbp, rcx
call fcn.140175530
test eax, eax
jle case.0x1400aac69.2
xor r8d, r8d
test esi, esi
jle 0x1400aabe9
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x1400aabe9
inc rcx
inc r8d
mov rax, rcx
sub rax, rbx
cmp rax, rsi
jl 0x1400aabd0
lea edx, [rsi - 1]
movsxd rax, edx
test edx, edx
js 0x1400aac16
mov r9, rbp
lea rcx, [rax + rbx]
sub r9, rbx
nop dword [rax]
cmp byte [rcx + r9], 0
jne 0x1400aac16
cmp byte [rcx], 0xff
jne 0x1400aac16
dec edx
dec rcx
cmp rcx, rbx
jns 0x1400aac00
cmp r8d, edx
jl case.0x1400aac69.2
jle 0x1400aac2e
lea eax, [r8*8]
jmp 0x1400aacb0
movsxd rax, r8d
movzx r9d, byte [rax + rbx]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1400aac69.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0xaace8]
mov ecx, dword [r11 + rax*4 + 0xaacc8]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1400aac9a
mov eax, 6
jmp 0x1400aac9a
mov eax, 5
jmp 0x1400aac9a
mov eax, 4
jmp 0x1400aac9a
mov eax, 3
jmp 0x1400aac9a
mov eax, 2
jmp 0x1400aac9a
mov eax, 1
test dl, r10b
jne case.0x1400aac69.2
and r9b, dl
cmp r9b, dl
jne case.0x1400aac69.2
lea eax, [rax + r8*8]
jmp 0x1400aacb0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bc260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1400bc287
xor r9d, r9d
cmp rdx, r8
jae 0x1400bc2a0
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1400bc2d1
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400bc2c0
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.140062200
test eax, eax
je 0x1400bc302
cmp dword [rsp + 0x40], 0x10
jne 0x1400bc302
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400bc4a0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400bc528
test r8, r8
je 0x1400bc528
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1400bc4e6
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400bc4d0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1400bc528
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1400bc528
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1400bc510
ret