joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ac40
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x58
call fcn.1402b4ee0
sub rsp, rax
mov dword [rsp + 0x30], 0
mov r8d, 0x5e2
lea rdx, str.enginese_capi.c
mov ecx, 0x20
call fcn.14008ed90
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14011ac94
xor eax, eax
jmp 0x14011ae57
cmp dword [rsp + 0x78], 1
jne 0x14011acce
cmp dword [0x14036ba30], 0
je 0x14011acce
lea rdx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x14011acce
lea rax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], reloc.OLEAUT32.dll_SafeArrayGetElement
cmp qword [rsp + 0x60], 0
je 0x14011ad5f
mov rax, qword [rsp + 0x60]
cmp dword [rax], 2
jl 0x14011ad5f
mov rax, qword [rsp + 0x60]
cmp qword [rax + 8], 0
je 0x14011ad5f
mov rcx, qword [rsp + 0x68]
call fcn.14011cf20
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x70]
call fcn.14011cf20
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
mov rcx, qword [rsp + 0x60]
call fcn.1401194e0
mov r8d, 0x5f6
lea rdx, str.enginese_capi.c
mov rcx, qword [rsp + 0x40]
call fcn.14008ee10
mov r8d, 0x5f7
lea rdx, str.enginese_capi.c
mov rcx, qword [rsp + 0x48]
call fcn.14008ee10
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x20000
test eax, eax
je 0x14011ad78
mov dword [rsp + 0x30], 0x20
mov rax, qword [rsp + 0x38]
add rax, 8
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14011adc5
mov r9d, 0x5fd
lea r8, str.enginese_capi.c
mov edx, 0x68
xor ecx, ecx
call fcn.140119540
call fcn.140119870
jmp 0x14011ae3e
mov rax, qword [rsp + 0x38]
add rax, 0x10
mov r8, rax
mov edx, dword [rsp + 0x80]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x14011ae1c
mov r9d, 0x602
lea r8, str.enginese_capi.c
mov edx, 0x75
xor ecx, ecx
call fcn.140119540
call fcn.140119870
xor edx, edx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14011ae3e
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x80]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x38]
mov qword [rax], 0
mov rax, qword [rsp + 0x38]
jmp 0x14011ae57
mov r8d, 0x60c
lea rdx, str.enginese_capi.c
mov rcx, qword [rsp + 0x38]
call fcn.14008ee10
xor eax, eax
add rsp, 0x58
ret
Function at 0x140133130
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1402b4ee0
sub rsp, rax
cmp dword [0x14036ba40], 0
jne 0x1401331e9
mov dword [0x14036ba40], 1
mov r8d, SafeArrayCopyData
xor edx, edx
lea rcx, [0x14036ba50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x14036ba50]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401331e9
call fcn.1400a1d90
lea r8, str.BIO_sock_init
mov edx, DllRegisterServer
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1400a1de0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov edx, eax
mov ecx, 2
call fcn.1400a1e50
call fcn.1400a1d90
lea r8, str.BIO_sock_init
mov edx, reloc.OLEAUT32.dll_DllRegisterServer
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.1400a1e50
mov eax, 0xffffffff
jmp 0x1401331ee
mov eax, 1
add rsp, 0x28
ret

Function at 0x140133200
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1402b4ee0
sub rsp, rax
movsxd rax, dword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140133272
call fcn.1400a1d90
lea r8, str.BIO_socket_ioctl
mov edx, 0xd1
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1400a1de0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov edx, eax
mov ecx, 2
call fcn.1400a1e50
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1401332f0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, 0x288
call fcn.1402b4ee0
sub rsp, rax
mov rax, qword [0x14036aa00]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [rsp + 0x290], 0
jl 0x140133330
cmp dword [rsp + 0x290], 0x40
jl 0x14013333a
mov eax, 0xffffffff
jmp 0x140133463
cmp qword [rsp + 0x2a0], 0
jne 0x14013334f
mov eax, 1
jmp 0x140133463
xor ecx, ecx
call fcn.1401334b0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x2a0], rax
jge 0x140133371
xor eax, eax
jmp 0x140133463
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
jmp 0x14013338d
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
jae 0x1401333ad
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x290]
cmp qword [rsp + rax*8 + 0x68], rcx
jne 0x1401333ab
jmp 0x1401333ad
jmp 0x140133383
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
jne 0x1401333d8
cmp dword [rsp + 0x60], 0x40
jae 0x1401333d8
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x290]
mov qword [rsp + rax*8 + 0x68], rcx
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
xor eax, eax
test eax, eax
jne 0x140133379
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x2a0]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x298], 0
je 0x140133412
mov qword [rsp + 0x48], 0
jmp 0x14013341c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x298], 0
je 0x140133432
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
jmp 0x14013343b
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x290]
inc eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1402b48e0
add rsp, 0x288
ret
Function at 0x140135570
Capabilities:
Resolve dns

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.1402b4ee0
sub rsp, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140135699
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x140135677
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x140135677
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14013561e
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140135677
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.1401353e0
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x140135664
mov eax, 8
jmp 0x1401356ee
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x140135610
mov r9d, 0x400
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xor eax, eax
jmp 0x1401356ee
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2af9
je 0x1401356cd
cmp dword [rsp + 0x20], 0x2afa
je 0x1401356d4
cmp dword [rsp + 0x20], 0x2afb
je 0x1401356db
cmp dword [rsp + 0x20], 0x2afc
je 0x1401356e2
jmp 0x1401356e9
mov eax, 0x2af9
jmp 0x1401356ee
mov eax, 0x2afa
jmp 0x1401356ee
mov eax, 0x2afb
jmp 0x1401356ee
mov eax, 0x2af9
jmp 0x1401356ee
mov eax, 0x2af9
add rsp, 0x48
ret
Function at 0x14015d0c0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.1402b4ee0
sub rsp, rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x70], eax
jne 0x14015d116
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
cmp eax, 0x6a
je 0x14015d14f
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
cmp eax, 0x6b
je 0x14015d14f
call fcn.1400a1d90
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.1400a1e50
mov eax, 0xffffffff
jmp 0x14015d2cc
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x2c], 0x6b
jne 0x14015d25c
mov eax, dword [rsp + 0x68]
sub eax, 3
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
jmp 0x14015d192
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jge 0x14015d20d
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x20]
cmp eax, 0xba
jne 0x14015d1c3
jmp 0x14015d20d
movzx eax, byte [rsp + 0x20]
cmp eax, 0xbb
je 0x14015d208
call fcn.1400a1d90
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.1400a1e50
mov eax, 0xffffffff
jmp 0x14015d2cc
jmp 0x14015d188
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x28], 0
jne 0x14015d25a
call fcn.1400a1d90
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.1400a1e50
mov eax, 0xffffffff
jmp 0x14015d2cc
jmp 0x14015d267
mov eax, dword [rsp + 0x68]
sub eax, 2
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x14015d2b2
call fcn.1400a1d90
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x8b
mov ecx, 4
call fcn.1400a1e50
mov eax, 0xffffffff
jmp 0x14015d2cc
mov eax, dword [rsp + 0x24]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret
Function at 0x1401a1830
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1402b4ee0
sub rsp, rax
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.1400c47b0
cmp dword [rsp + 0x20], 0
jg 0x1401a18b1
mov ecx, dword [rsp + 0x20]
call fcn.1401a1c70
test eax, eax
je 0x1401a18b1
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.1400c5630
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1401a1cf0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov eax, 0x48
call fcn.1402b4ee0
sub rsp, rax
mov dword [rsp + 0x34], 1
cmp dword [rsp + 0x50], 0xffffffff
jne 0x1401a1d50
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, 0x54
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x87
mov ecx, 0x20
call fcn.1400a1e50
xor eax, eax
jmp 0x1401a1f7d
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401a1d65
mov dword [rsp + 0x30], 1
jmp 0x1401a1d6d
mov dword [rsp + 0x30], 0
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x50]
call fcn.140133280
test eax, eax
jne 0x1401a1d85
xor eax, eax
jmp 0x1401a1f7d
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x1401a1e2a
movsxd rax, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 8
mov edx, 0xffff
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401a1e2a
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, 0x5e
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.1400a1e50
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.1400a1e50
xor eax, eax
jmp 0x1401a1f7d
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x1401a1ecf
movsxd rax, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401a1ecf
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, 0x68
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.1400a1e50
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 0x20
call fcn.1400a1e50
xor eax, eax
jmp 0x1401a1f7d
mov rcx, qword [rsp + 0x58]
call fcn.1401338a0
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x58]
call fcn.1400929e0
movsxd rcx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x38]
mov r8d, edx
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401a1f78
mov ecx, 0xffffffff
call fcn.1401a1c70
test eax, eax
jne 0x1401a1f74
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, WSACleanup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov edx, eax
mov ecx, 2
call fcn.1400a1e50
call fcn.1400a1d90
lea r8, str.BIO_connect
mov edx, reloc.WS2_32.dll_WSACleanup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400a1de0
xor r8d, r8d
mov edx, 0x67
mov ecx, 0x20
call fcn.1400a1e50
xor eax, eax
jmp 0x1401a1f7d
mov eax, 1
add rsp, 0x48
ret
Function at 0x14024eb80
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1402b4ee0
sub rsp, rax
mov r8d, 0xf0
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x14024ebb8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x14024ebdf
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1403533c0]
movsxd rdx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8]
mov qword [r8 + rdx*8], rax
jmp 0x14024ebae
add rsp, 0x38
ret

Function at 0x1402589a0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1402b4ee0
sub rsp, rax
mov r8d, 0x80
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x1402589d8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x1402589fe
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1403534c0]
movsxd rdx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov dword [r8 + rdx*4], eax
jmp 0x1402589ce
add rsp, 0x38
ret
Function at 0x140270700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1402b4ee0
sub rsp, rax
mov dword [rsp + 8], 0
jmp 0x140270730
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 8], eax
jge 0x14027075c
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 8]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
jne 0x14027075c
jmp 0x140270726
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 4], eax
jmp 0x140270772
mov eax, dword [rsp + 4]
dec eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0
jl 0x1402707a2
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x1402707a2
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0xff
jne 0x1402707a2
jmp 0x140270768
mov eax, dword [rsp + 4]
cmp dword [rsp + 8], eax
jge 0x1402707b6
mov eax, 0xffffffff
jmp 0x1402708bb
mov eax, dword [rsp + 4]
cmp dword [rsp + 8], eax
jle 0x1402707cc
mov eax, dword [rsp + 8]
shl eax, 3
jmp 0x1402708bb
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 8]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
mov byte [rsp], al
movzx eax, byte [rsp]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
dec eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0x7e
ja case.0x140270824.2
movsxd rax, dword [rsp + 0xc]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x2708e0]
mov eax, dword [rcx + rax*4 + 0x2708c0]
add rax, rcx
jmp rax
mov dword [rsp + 4], 7
jmp 0x140270873
mov dword [rsp + 4], 6
jmp 0x140270873
mov dword [rsp + 4], 5
jmp 0x140270873
mov dword [rsp + 4], 4
jmp 0x140270873
mov dword [rsp + 4], 3
jmp 0x140270873
mov dword [rsp + 4], 2
jmp 0x140270873
mov dword [rsp + 4], 1
jmp 0x140270873
mov eax, 0xffffffff
jmp 0x1402708bb
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp]
and eax, ecx
test eax, eax
jne 0x1402708a7
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp]
and eax, ecx
movzx ecx, byte [rsp]
cmp eax, ecx
je 0x1402708b0
mov eax, 0xffffffff
jmp 0x1402708bb
mov eax, dword [rsp + 4]
mov ecx, dword [rsp + 8]
lea eax, [rax + rcx*8]
add rsp, 0x18
ret
Function at 0x1402a98a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1402b4ee0
sub rsp, rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 5
je 0x1402a98f4
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.1402aa4c0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jg 0x1402a98f4
mov eax, dword [rsp + 0x20]
jmp 0x1402a9955
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.1400c47b0
cmp dword [rsp + 0x20], 0
jg 0x1402a9951
mov ecx, dword [rsp + 0x20]
call fcn.1401a1c70
test eax, eax
je 0x1402a9951
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.1400c5630
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1402b0294
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x60
xor r9d, r9d
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 8], eax
cmp eax, 0xffffffff
je 0x1402b02d2
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
add rsp, 0x60
pop rbx
ret
lea rdx, str.unable_to_create_tls_index
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1402b0344
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b037e
add dword [rax], 0xffffffff
jne 0x1402b0378
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1402b03a1
add rsp, 0x60
pop rbx
ret
lea rdx, str.likely_unbalanced_enter_exit_monitor_pair__extra_exit_
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.unable_to_set_tls_value
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1402b03c4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b03e1
cmp dword [rax], 0
jne 0x1402b03eb
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.1402b04b4
inc dword [rax]
add rsp, 0x20
pop rbx
ret
Function at 0x1402b03fc
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1402b0408
push rbx
sub rsp, 0x60
mov rbx, rcx
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b0421
mov eax, dword [rax]
test eax, eax
je 0x1402b0450
mov rcx, rbx
call fcn.1402b0344
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b0440
cmp dword [rax], 0
jne 0x1402b044a
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x60
pop rbx
ret
lea rdx, str.must_own_monitor_prior_to_calling_exit__
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1402b0408
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1402b0408
push rbx
sub rsp, 0x60
mov rbx, rcx
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b0421
mov eax, dword [rax]
test eax, eax
je 0x1402b0450
mov rcx, rbx
call fcn.1402b0344
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402b0440
cmp dword [rax], 0
jne 0x1402b044a
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x60
pop rbx
ret
lea rdx, str.must_own_monitor_prior_to_calling_exit__
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1402b04b4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1402b04f9
lea edx, [rax + 4]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1402b0507
and dword [rax], 0
mov rdx, rax
mov ecx, dword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1402b052a
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rdx, str.unable_to_create_tls_data
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.unable_to_set_tls_value
lea rcx, [rsp + 0x20]
call fcn.1402ac760
lea rdx, [0x140365390]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3