joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100054cac
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x20], 0
xor eax, eax
mov rsi, rcx
and dword [rcx + 8], eax
and qword [r11 + 8], rax
lea ebp, [rax + 1]
lea r8, [r11 + 8]
lea rcx, [0x1000374c8]
mov edx, ebp
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
xor ebx, ebx
xor edi, edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x100054d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100054d0d
mov edi, 0x80004005
jmp 0x100054dc4
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x100054dc0
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x30], ebx
lea r8, [0x100038580]
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
jne 0x100054d76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100054d0d
lea r8, [0x100038580]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
test rax, rax
je 0x100054cf9
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100054da4
cmp eax, 0x80
je 0x100054d9d
cmp eax, 0x102
jne 0x100054da7
mov edi, 0x800705b4
jmp 0x100054dc4
mov edi, 0x8000ffff
jmp 0x100054dc4
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
mov rbp, rbx
xor ebx, ebx
test rcx, rcx
je 0x100054dbd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi], rbx
mov qword [rsi], rbp
test edi, edi
jns 0x100054e03
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x100054df5
test byte [rcx + 0x3c], 2
je 0x100054df5
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021358]
mov edx, 0xb
mov r9d, edi
call fcn.100050618
test rbx, rbx
je 0x100054e03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100054e13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x10005dcec
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r13, r8
mov r14, rdx
mov r12, rcx
xor edi, edi
mov qword [rax + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.10006fffc
nop
and al, 0x5d
xor ah, byte [rax + 0x28]
pop rbp
xor al, byte [rax + 9]
add byte [rax], al
shr byte [rax + 0x47], 0x26
movabs al, byte [0xa75f6854df88b44]
mov esi, 0x80070057
jmp 0x10005e04b
call fcn.100248ac0
nop
push 0xffffffff90f03270
and ah, byte [0x10006f4ec]
push rax
insb byte [rdi], dx
jo 0x10005e092
call fcn.10006fffc
nop
xor dl, ah
xor eax, eax
xor al, 0xe2
xor dword [rax - 0x6fffffe1], esp
clc
or byte cs:[rax - 0x75], 5
retf 0x2d38
call qword [rax - 0x5fcd6480]
push rsp
xchg edi, eax
and dword [rax], esi
cld
add dword [rax], eax
add byte [rbx + rbx*4 + 0x32], bh
sub al, 0x8f
cmp dh, bh
call qword [rax + 0x20326bb0]
fsub qword [rbx + 0x25]
and dh, 0
add byte [rax + 0x326bac], dh
call fcn.1000f8a58
nop
and eax, dword [rax]
add al, dl
sbb dl, 0x31
movabs al, byte [0xf031da84702fdb6c]
test byte [rax + 0x3c], 2
je 0x10005e167
call fcn.1003048e8
nop
add al, byte [rax]
add al, byte [rax]
movabs al, byte [0x500a2888b032f37c]
js 0x10005e0e1
xor ah, byte [rax - 0x18]
cmp r14b, dil
call qword [rax + 0x40323ec8]
mov esp, 0x2f902836
add byte [rax], al
adc ah, al
xor ah, byte ds:[rax]
call fcn.100248ac0
nop
pop rsp
and dh, byte [rdx]
xor byte [rdx + rax + 0x17902a], ch
add byte [rax - 0x5fcddda0], dh
mov rcx, qword [rax + 0x30]
lea r8, [0x1000213a8]
mov edx, 0x26
mov r9d, esi
call fcn.100050618
call fcn.100296c1c
nop
add edx, esi
mov dword [rax + 0x2cbdf8], 0x4031f584
invalid
cmp rax, rbp
je 0x10005e1c0
mov eax, dword [rax + 0x3c]
mov ecx, 0x2000008
and eax, ecx
cmp eax, ecx
jne 0x10005e1c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.10022d6f0
nop
jle 0x10005e188
add byte [rax], ah
movsb byte [rdi], byte [rsi]
xor ah, byte cs:[rax - 0x58]
xor dl, byte cs:[rax]
xor byte [rdi], ah
sub dword [rax + 0x48], edx
mov ecx, dword [0x100331948]
lea r9, [0x100037ed8]
mov rcx, qword [rcx + 0x30]
sub eax, r15d
lea r8, [0x1000214f0]
mov edx, 0xa
mov dword [rsp + 0x20], eax
call fcn.100076e34
call fcn.100041938
nop
jl 0x10005e1f2
xor al, byte [rax + 0x70296dbc]
xor dword [rcx], eax
add byte [rax - 0x5fcdd588], dh
test rdi, rdi
je 0x10005e1ef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.1000f8a58
or dword [rax], eax
nop
pop rax
add dword [rax], eax
insb byte [rdi], dx
push rcx
xor dh, byte [rax]
jae 0x10005e211
invalid
or dword [rbx], esi
shr byte [rax - 0x4cfccf7], 1
add byte [rax - 0x38], dl
adc eax, dword [rdi]
xor byte [rax - 0x75], cl
add ecx, dword [rax - 0x75]
retf
Function at 0x100065328
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x100347ae0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor esi, esi
mov rdi, rdx
mov byte [rsp + 0x75], 5
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x71], sil
mov byte [rsp + 0x72], sil
mov byte [rsp + 0x73], sil
mov byte [rsp + 0x74], sil
mov qword [rsp + 0x68], rsi
mov ebx, esi
cmp rdx, rsi
jne 0x100065382
mov ebx, 0x80070057
jmp 0x100065406
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, esi
jne 0x1000653e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x1000653d6
mov ebx, 0x80004005
jmp 0x100065406
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
jmp 0x100065402
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, esi
je 0x1000653c5
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
cmp ebx, esi
jge 0x100065437
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x100065437
test byte [rcx + 0x3c], 2
je 0x100065437
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021490]
mov edx, 0x2a
mov r9d, ebx
call fcn.100050618
mov rcx, qword [rsp + 0x68]
cmp rcx, rsi
je 0x100065447
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1002edf64
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100071b18
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x100347ae0]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
mov r8d, 0x2000000
mov rbp, rdx
mov rsi, rcx
call fcn.1000768f4
mov rbx, qword [rsp + 0x68]
mov edi, eax
test eax, eax
js 0x100071c18
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100071bc3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100071c9e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x100071c7c
dec eax
lea r8, [rsp + 0x70]
mov r9d, 0x105
mov edx, eax
mov rcx, rbx
mov dword [rsp + 0x60], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100071c05
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100071c9e
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.100071b18
mov edi, eax
test eax, eax
jns 0x100071bc3
lea rsi, [0x100331948]
mov rcx, qword [0x100331948]
cmp rcx, rsi
je 0x100071c49
test byte [rcx + 0x3c], 2
je 0x100071c49
mov rcx, qword [rcx + 0x30]
lea r8, [0x1000214d0]
mov edx, 0x2e
mov r9d, edi
call fcn.100050618
test rbx, rbx
je 0x100071c57
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1002edf64
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x100071c8c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x100071cae
xor edi, edi
lea rsi, [0x100331948]
test edi, edi
jns 0x100071c49
jmp 0x100071c1f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x100071c9e
mov rcx, qword [0x100331948]
lea rsi, [0x100331948]
cmp rcx, rsi
je 0x100071ca5
test byte [rcx + 0x3c], 2
je 0x100071ca5
mov rcx, qword [rcx + 0x30]
lea r8, [0x1000214d0]
mov edx, 0x2c
mov r9d, edi
call fcn.100050618
jmp 0x100071ca5
Function at 0x100073f1c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r9
lea rax, [r11 + 8]
and qword [r11 + 8], rbx
lea r9d, [rbx + 2]
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100073f61
xor edi, edi
jmp 0x100073f73
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100073f81
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
jmp 0x100073f86
mov rcx, qword [rsp + 0x40]
lea rbp, [0x100331948]
test edi, edi
jns 0x100073fc0
mov rax, qword [0x100331948]
cmp rax, rbp
je 0x100073fc7
test byte [rax + 0x3c], 2
je 0x100073fc7
mov rcx, qword [rax + 0x30]
lea r8, [0x1000214d0]
mov edx, 0x29
mov r9d, edi
call fcn.100050618
mov rcx, qword [rsp + 0x40]
mov rax, qword [0x100331948]
test rcx, rcx
je 0x100073fdf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
mov rax, qword [0x100331948]
test edi, edi
js 0x10007402a
mov eax, dword [rsp + 0x60]
lea rdx, [0x1000385d8]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100074011
xor edi, edi
jmp 0x10007404d
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x10007404d
mov rax, qword [0x100331948]
cmp rax, rbp
je 0x10007404d
test byte [rax + 0x3c], 2
je 0x10007404d
mov rcx, qword [rax + 0x30]
lea r8, [0x1000214d0]
mov edx, 0x24
mov r9d, edi
call fcn.100050618
test rbx, rbx
je 0x10007405b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1000c5784
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
cmp rcx, rbx
jne 0x1000c57f4
call fcn.10022d6f0
nop
cld
add eax, dword [rax]
and byte [rcx + rdx*8], dh
xor ah, byte [rax - 0x2fcd2ec8]
pop rsp
wait
movups xmm5, xmm0
test dword [rsi + 0x18], edx
add byte [rax + 0x40659d90], dl
invalid
xor dword [rax], eax
mov ebx, 0x80070057
jmp 0x1000c593c
cmp rdx, rbx
je 0x1000c57a8
call fcn.100248ac0
nop
fdiv dword [rcx + 0x34dc6032]
adc ah, byte [rax]
pushfq
add byte [rax], al
loopne 0x1000c57e8
mov cl, 0x32
add al, ch
call 0x910c52bc
mov word [rbx - 0x746f4fce], cs
xor ah, byte [rax - 0x1fffff06]
xchg byte [rax + 0x23], al
loopne 0x1000c580e
invalid
sbb al, 1
add byte [rax], al
call fcn.10024ae48
nop
add ah, dl
movabs al, byte fs:[0xc03269fc90000009]
and byte [rsi + 0x25], bh
mov ebx, 0x8007000e
call fcn.1003048e8
nop
xlatb
add dword [rax], eax
movabs al, byte [0x200527903034a500]
cld
movsb byte [rdi], byte [rsi]
xor al, 0xc0
call fcn.10024ae48
nop
jns 0x1000c591d
invalid

Function at 0x1000c6f9c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
xor esi, esi
xor edi, edi
and qword [r11 - 0x78], rbx
mov rax, r9
mov r13, rdx
mov rbp, rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rsi
test r8, r8
jne 0x1000c6ffc
call fcn.1000f8a58
nop
push rax
add byte [rax], al
sar byte [rax - 0x5b8fcd41], 1
add eax, 0xbfbc1011
xor dh, byte [rax - 0x43]
push rdi
add byte [rdi], al
sub cl, 0xf0
add eax, dword [rax]
add al, ch
push rdi
sbb al, byte [rbx]
add byte [rax - 0x4fffff64], dl
or al, 0xfc
call fcn.1000f8a58
nop
pushfq
add byte [rax], al
mov al, 0xc
cld
xor dh, byte [rax - 0x80]
insd dword [rdi], dx
or dword [rax - 0x1fcd03f0], edx
test rax, rax
je 0x1000c6fdc
call fcn.1000f8a58
nop
retf
Function at 0x1000e1600
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x88
mov eax, dword [r11 + 0x28]
xor ebx, ebx
movzx r13d, cx
lea ecx, [rbx + 5]
mov r12d, edx
mov rsi, r9
cmp eax, ecx
mov ebp, r8d
lea rdx, [r11 + 0x30]
cmova eax, ecx
mov dword [r11 + 0x28], eax
test eax, eax
je 0x1000e1658
lea rcx, [rdx - 8]
mov r8d, eax
lea rdx, [r11 - 0x68]
add rcx, 8
mov rax, qword [rcx]
mov qword [rdx], rax
add rdx, 8
sub r8, 1
jne 0x1000e1644
lea rdx, [0x100020800]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
jne 0x1000e1685
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000e16de
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
movzx eax, word [rsp + 0xe0]
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x28], ax
and qword [rsp + 0x20], rbx
mov r9d, r12d
movzx edx, r13w
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x1000e16d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jns 0x1000e1713
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1000e1713
test byte [rcx + 0x3c], 2
je 0x1000e1713
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020850]
mov edx, 0xa
mov r9d, ebx
call fcn.100050618
mov eax, ebx
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1002edf64
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1003470e0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1003471d8]
mov qword [rsp + 0x58], r11
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1001044c1
mov qword [rsp + 0x38], 0
xor ecx, ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1003470e0]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1001044e3
mov rax, qword [rsp + 0x88]
mov qword [0x1003471d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100347178], rax
xor ecx, ecx
mov rax, qword [0x1003471d8]
mov qword [0x1003481b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100347160], rax
mov dword [0x1003481a0], 0xc0000409
mov dword [0x1003481a4], 1
mov rax, qword [0x100347ae0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1003470c0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1002bbda8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x100347ae0]
jne 0x1002edf7f
rol rcx, 0x10
test cx, 0xffff
jne 0x1002edf7b
ret 0
ror rcx, 0x10
jmp 0x10010443c
Function at 0x14063c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14063c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14063c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063c06f
add dl, dl
jne 0x14063c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063c0f6
xor eax, eax
add dl, dl
jne 0x14063c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063c1ad
add dl, dl
jne 0x14063c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14063c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14063c07e
mov eax, 1
add dl, dl
jne 0x14063c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063c0fb
sub eax, ebx
mov ebx, 1
jne 0x14063c14c
mov ecx, 1
add dl, dl
jne 0x14063c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14063c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14063c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14063c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063c15d
cmp eax, 0x7d00
jae 0x14063c19b
cmp eax, 0x500
jb 0x14063c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063c07e
cmp eax, 0x7f
ja 0x14063c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14063c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14063c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400120d0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1401313b8], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14001212d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14000f7d0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x1400123d0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov rdi, rcx
test rbx, rbx
je 0x140012494
nop dword [rax]
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1401313b8], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140012440
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140012462
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14000f7d0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rdi]
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
test rbx, rbx
je 0x140012488
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
mov rcx, rbx
call fcn.14001bb60
mov rbx, qword [rdi]
test rbx, rbx
jne 0x1400123f0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140014040
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1401313c0], eax
inc eax
cmp eax, 1
jne 0x14001408d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401313c4], eax
test bl, bl
je 0x140014131
xor ebx, ebx
lock xadd dword [0x1401313c4], ebx
test ebx, ebx
je 0x140014131
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x14012c300]
lea rsi, [0x14012c2f8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400140e6
mov rax, qword [0x14012c2f8]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400140e8
mov al, 1
lea rcx, str.E:_boost_1_83_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140014155
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400c86b0
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140011b80
int3