joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ddaa
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x14011ddbc
add rcx, 8
jmp fcn.1401892c1

Function at 0x14011eef9
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x70]
lea r9, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.14011ecb9
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14011f048
test eax, eax
je 0x14011efd5
cmp eax, 0x90317
je 0x14011f042
cmp eax, 0x90321
jne 0x14011f066
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14011eea3
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x14011f074
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x40]
and qword [rdi + 0x50], 0
call fcn.14011f088
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.140072855
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14011eea3
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x14011f074
mov byte [rsi + 1], 1
jmp 0x14011f062
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14011f074
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14011f33a
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x178]
mov rcx, qword [rdx + 0x168]
mov rdx, qword [rdx + 0x170]
lea r9, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.14011ecb9
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14011f4aa
test eax, eax
je 0x14011f422
cmp eax, 0x90317
je 0x14011f4a4
cmp eax, 0x90321
jne 0x14011f4c8
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14011f2db
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x14011f4d6
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x168]
mov rdx, qword [rdi + 0x170]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x140]
and qword [rdi + 0x150], 0
push rax
add dword [rax], eax
add byte [rax], al
call fcn.14011f088
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.140072855
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14011f2db
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x14011f4d6
mov byte [rsi + 1], 1
jmp 0x14011f4c4
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14011f4d6
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x14011f4e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne fcn.14011f4f2
add rcx, 8
jmp fcn.14018905d

Function at 0x140122849
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
mov rbx, rdx
ror dword [rax - 0x77], cl
and al, 0x50
Function at 0x1401353e8
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1f28
call fcn.140196080
sub rsp, rax
movaps xmmword [rsp + 0x1f10], xmm9
movaps xmmword [rsp + 0x1f00], xmm8
movaps xmmword [rsp + 0x1ef0], xmm7
movaps xmmword [rsp + 0x1ee0], xmm6
mov r13, rdx
mov rbx, rcx
lea rbp, [rcx + 0x1b0]
lea r12, [rcx + 0x1d1]
lea r15, [rsp + 0x121]
lea rax, [rcx + 0x180]
mov qword [rsp + 0x208], rax
lea rax, [rcx + 0xd8]
mov qword [rsp + 0x2d8], rax
lea rax, [rcx + 0x158]
mov qword [rsp + 0x158], rax
xorps xmm6, xmm6
movss xmm7, dword [0x14019f7c8]
lea rax, [rcx + 0x18]
mov qword [rsp + 0x2d0], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x2c8], rax
lea r14, [rsp + 0x4c0]
lea rdi, [rsp + 0x1260]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0xfc], eax
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x68], rcx

Function at 0x140149be0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
sub esp, 0x68
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea rdi, [rsp + 0x50]
push rax
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call case.0x140173769.1034
lea r13, [rsp + 0x30]
insb byte [rdi], dx
and al, 0x30
mov dword [r13], 0x800
lea r15, [rsp + 0x34]
and dword [r15], 0
lea r12, [rsp + 0x38]
mov edx, 0x800
mov rcx, r12
call fcn.14013ca62
mov rdi, qword [rdi + 8]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r13
and al, 0x28
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x140149c74
mov edx, dword [rsp + 0x30]
mov rcx, r12
call fcn.140072587
jmp 0x140149c42
test eax, eax
jne 0x140149c96
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x140149cbe
movabs rax, 0xde00000002
jmp 0x140149c9e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
mov rdx, r14
call fcn.1400a4b5e
jmp 0x140149cd2
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call fcn.14011c039
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401517c8
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
add byte [rax], al
add byte [rdi], cl
adc dword [rsp + 0x80], eax
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x18], rax
je 0x140151834
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x90], rdx
cmp qword [rcx + 0x30], rax
je 0x14015186f
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140151866
invalid
mov r8, qword [rcx + 0x38]
xor edx, edx
lea r9, [0x1402e6e68]
xor r10d, r10d
movzx r11d, byte [r8 + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp rax, r10
jne 0x140151853
jmp 0x140151868
xor edx, edx
mov dword [rsp + 0x98], edx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1401518c6
lea rbx, [rsi*8]
mov rax, rsi
shr rax, 0x3c
jne 0x14015198c
mov r15, qword [rcx + 8]
mov r14d, 8
mov ecx, 8
add byte [rax - 0x77], cl
invalid
call fcn.1400b2871
test rax, rax
je 0x14015198f
mov rdi, rax
xor eax, eax
mov rcx, qword [r15 + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp rsi, rax
jne 0x1401518b2
mov eax, esi
jmp 0x1401518cf
xor esi, esi
mov edi, 8
xor eax, eax
lea rcx, [rsp + 0x60]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
mov dword [rcx + 8], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
add byte [rax - 0x73], cl
adc eax, 0x1645dc
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x140151926
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
mov esi, 1
jmp 0x14015195e
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov ecx, 8
mov edx, 0x20
call fcn.1400b2871
test rax, rax
je 0x14015199a
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r15
jnp 0x140151973
xor r14d, r14d
test rsi, rsi
je 0x140151977
shl rsi, 3
mov edx, 8
or byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
stc
mov r8, rsi
call fcn.14000631d
mov rax, r14
mov rdx, rbx
add rsp, 0xb0
mov al, 0
add byte [rax], al
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor r14d, r14d
mov rcx, r14
mov rdx, rbx
call fcn.140197440
mov ecx, 8
mov edx, 0x20
add byte [rax], al
call fcn.140197460
int3

Function at 0x140152010
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
and dword [rax], 0
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
xchg ebp, eax
invalid
jne 0x14015203a
mov rdx, qword [rsp + 0x20]
jmp 0x140152042
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x1401708aa
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
add byte [rax - 0x75], cl
mov rax, qword [rcx]
cmp byte [rax], 0
cmp byte [rax], al
mov byte [rax], 0
add byte [rdi], cl
test byte [rcx], al
invalid
add byte [rax], al
lea r14, str.127.0.0.1:34254
lea rcx, [rsp + 0x30]
and al, 0x30
mov qword [rcx], r14
mov dword [rcx], esi
mov qword [rcx + 8], 0xf
or byte [r15], cl
add byte [rax], al
add byte [rax], al
call fcn.140078c60
xor eax, 0xffffffff
mov rsi, rax
mov esi, eax
test sil, 1
mov byte [rcx], 0xf
invalid
xchg dword [rax], eax
add byte [rax], al
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
and al, 0x38
test r9, r9
leave
je 0x14017096b
xor edi, edi
cmp byte [r8], 0x3a
jne 0x14017096b
lea r10, [r8 + 1]
lea r11, [r9 - 1]
lea ebx, [rcx - 1]
mov bp, 0xa
mov ebp, 0x894c000a
mov ebx, ebx
mov r15, r10
xlatb
xor ecx, ecx
test rbx, rbx
je 0x140170943
lea rdx, [r15 + 1]
movzx r12d, byte [r15]
add r12d, 0xffffffd0
xor eax, eax
cmp r12d, 0xa
cld
or cl, byte [rdi]
xchg edx, eax
ror byte [rdi + rcx + 0x42], 0xfa
cli
sub rbx, rax
jmp case.0x140072379.2916
xor eax, eax
cmp eax, 1
jne 0x140170990
invalid
mov eax, ecx
mul bp
mul ebp
jo 0x140170982
add ax, r12w
setb dl
cmp r12d, 0xffff
ja 0x140170982
test dl, dl
jne 0x140170982
inc edi
mov ecx, eax
jmp 0x140170920
xor eax, eax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
test ax, ax
jne 0x1401709a9
xor esi, esi
xor eax, eax
jmp 0x1401709cd
xor eax, eax
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r11
pop rsp
and al, 0x38
jmp case.0x140071f60.2984
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
xor eax, eax
test edi, edi
setne al
je 0x140170984
cmp ax, 1
jne 0x14017096d
movabs rax, 0xffffffff00
and rsi, rax
shr rsi, 8
movzx eax, cx
shl rax, 0x30
shl rsi, 0x10
or rsi, rax
mov eax, 1
add dword [rax], eax
add byte [rax], al
movzx ecx, si
or rcx, rax
cmp rcx, 1
jne 0x140170a72
cmp qword [rsp + 0x38], 0
jne 0x140170a89
invalid
add byte [rax], al
invalid
mov ebp, esi
shr ebp, 0x10
adc byte [rax - 0x3f], cl
out dx, al
sbb byte [rbp + 0x31], al
invalid
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
test rcx, rcx
je 0x140170d43
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140170a89
mov rcx, qword [rsp + 0x30]
dec rax
mov dl, byte [rcx]
inc rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
cmp dl, 0x5b
jne 0x140170a89
lea rsi, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, str._rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_std_src_synconce.rs
call fcn.140197da0

Function at 0x14017100e
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14017103b
xor eax, eax
jmp 0x140171040
call fcn.14011f130
nop
add rsp, 0x38
ret
Function at 0x140171d40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
add byte [rax], 0
add byte [rax], al
mov rsi, rcx
movups xmm0, xmmword [0x1402bc6d0]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
invalid
dec dword [rcx + 0x39]
ror byte [rcx + 0xf], 0x42
ror byte [rdi], 0x57
ror byte [rdi], 0x11
and al, 0x38
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
call 0x1645ba6cb
and al, 0x20
xor edx, edx
rol byte [rbp + 0x31], cl
rol byte [rbp + 0x31], 0xc9
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
adc eax, 0x2d6b6
add byte [0x140171e9a], bh
add byte [rax], al
add byte [rbp + 0x18], dh
mov rcx, rsi
mov edx, 0xffffffff
invalid
invalid
invalid
invalid
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add al, byte [rax]
mov eax, dword [rbp]
add byte [0x140171eb2], bh
add byte [rax], al
je 0x140171dde
test eax, eax
js 0x140171dbd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140171dd4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
imul edx, esi, 2
add byte [rcx - 0x1d3eb73e], cl
mov edx, eax
shl rdx, 0x20
shl edx, 0x20
loop 0x140171deb
or rdx, 2
retf 0xb802
add dword [rax], eax
add byte [rax], al
invalid
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1402bc738]
test eax, 0x89480014
mov dword [rbp - 0x38], eax
enter 0xffffffffffffc748, 0x45
mov dword [rbp - 0x30], 1
add byte [rax], al
add byte [rax - 0x73], cl
lea eax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x28], eax
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x11
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
push rbp
enter 0xffffffffffff88e8, 0xfffffffffffffff7
invalid
dec dword [rax - 0x77]
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
clc
call fcn.140171660
invalid
invalid
mov ecx, 7
int 0x29
ud2

Function at 0x140174130
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
test eax, ebp
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x48], al
add byte [rdx], al
add byte [rax], al
Function at 0x140177b70
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
in al, dx
test al, 4
add byte [rax], al
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov dword [rbp + 0x420], 0xfffffffe
add byte [rax], al
invalid
invalid
invalid
invalid
mov rsi, rcx
lea rcx, [rbp - 0x60]
lea ecx, [rbp - 0x60]
call fcn.140177ff0

Function at 0x1401799f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
sub esp, 0xa8

Function at 0x14017cbe0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
in al, dx
call 0x18817cbed
lea ebp, [rsp + 0x80]

Function at 0x1401821fa
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
cmp rdx, 0x20
jb fcn.14007baf0
jmp fcn.140072ea0

Function at 0x14018795d
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsp

Function at 0x140188141
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140188148
test al, 1
je 0x140188167
test al, 2
jne 0x14018817f
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402c05b8]
mov edx, 0x23
call fcn.1401979c0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402c05f8]
mov edx, 0x25
call fcn.1401979c0
int3

Function at 0x14018900d
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.14018783c
mov rcx, qword [rax]
movzx eax, bl

Function at 0x14018905d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
add byte [rax], al
mov r12, rdx
mov r14, rcx
lea r15, [rsp + 0x72]
lea rsi, [rsp + 0x3a]
mov rbp, qword [rcx + 0x10]
mov r13, qword [r8 + 8]
mov rdi, qword [r8 + 0x10]
mov qword [rsp + 0x40], r8
mov rax, qword [r8]
add rax, rdi
mov qword [rsp + 0x58], rax
mov rcx, r13
sub rcx, rdi
mov eax, 0x7fffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
mov rax, qword [r14 + 0x18]
mov qword [rsp + 0x60], rax
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x68]
mov qword [rsp + 0x28], rbp
Function at 0x140190b29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
clc
add byte [rax], al
add byte [rbp - 0x77], cl
int3
mov r15, r8
mov rbp, rdx
mov r13, rcx
mov r14, qword [rsp + 0x168]
mov dil, byte [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax - 0x73], cl
mov ah, 0x24
mov byte [rax], al
add byte [rax], al
mov rcx, rsi
mov rdx, r8
mov r8, r9
call fcn.14019170f
mov eax, dword [rsi]
cmp eax, 0x23
je 0x140190e7f
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
cmp eax, 0x2f
je 0x140190bd2
cmp eax, 0x3f
je 0x140190e55
cmp eax, 0x5c
je 0x140190bd2
cmp eax, 0x110000
jne 0x140190e69
cmp dword [r14 + 0x20], 0
je 0x140190fe4
mov r8d, dword [r14 + 0x24]
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
lea r9, [0x1402e4ef0]
call fcn.140190b18
mov r8, rdx
jmp 0x140190fec
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x70], r13
jo 0x140190c16
in eax, dx
cmp dword [r14 + 0x18], 0
je 0x140190ee4
lea rax, [r14 + 0x1c]
jmp 0x140190ef3
cmp dword [r14 + 0x20], 0
je 0x1401911a4
lea rax, [r14 + 0x24]
mov ebx, edi
mov r8d, dword [rax]
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
call fcn.1401913f9
mov r8, rdx
add r8, rax
mov rcx, rbp
mov rdx, rax
call fcn.1400ade68
mov edi, dword [r14 + 0x2c]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
lea rsi, [rsp + 0x88]
mov rcx, rsi
mov rdx, rbp
mov r8d, ebx
mov r9d, edi
call fcn.14019173c
mov eax, dword [rsi]
cmp eax, 2
jne 0x140190f7d
mov al, byte [rsp + 0x8c]
mov byte [r13 + 8], al
movabs rax, 0x8000000000000000
mov qword [r13], rax
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400a4b5e
mov ecx, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x90]
mov r8, qword [rbp + 0x10]
mov qword [r13 + 0x10], r8
movups xmm0, xmmword [rbp]
movups xmmword [r13], xmm0
mov r8, qword [r14 + 0x30]
mov r9d, dword [r14 + 0x38]
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [r13 + 0x40], xmm0
mov r10b, byte [r14 + 0x50]
mov byte [r13 + 0x50], r10b
mov r10d, dword [r14 + 0x28]
mov r11d, dword [r14 + 0x3c]
mov dword [r13 + 0x18], eax
mov dword [r13 + 0x1c], ecx
mov qword [r13 + 0x20], rdx
mov dword [r13 + 0x28], r10d
mov dword [r13 + 0x2c], edi
mov qword [r13 + 0x30], r8
mov dword [r13 + 0x38], r9d
mov dword [r13 + 0x3c], r11d
jmp 0x14019118f
mov rax, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
add r8, rax
mov rcx, rbp
mov rdx, rax
call fcn.1400ade68
mov rax, qword [rbp + 0x10]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rbp]
movups xmmword [r13], xmm0
movups xmm0, xmmword [r14 + 0x2c]
movups xmm1, xmmword [r14 + 0x40]
movups xmmword [r13 + 0x40], xmm1
mov al, byte [r14 + 0x50]
mov byte [r13 + 0x50], al
mov eax, dword [r14 + 0x28]
mov rcx, qword [r14 + 0x18]
mov qword [r13 + 0x18], rcx
and dword [r13 + 0x20], 0
mov ecx, dword [r14 + 0x3c]
mov dword [r13 + 0x28], eax
movups xmmword [r13 + 0x2c], xmm0
mov dword [r13 + 0x3c], ecx
jmp 0x14019118f
mov ebx, edi
mov rax, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
jmp 0x140190f08
Function at 0x140196830
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14019687a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14019687a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14019687a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14019687a
cmp dword [rcx + 0x84], 0xe
jbe 0x14019687a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14019687c
xor al, al
add rsp, 0x28
ret

Function at 0x14019d040
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x14019d1b1
js 0x14019d1bd
mov rdi, r9
mov rbx, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x1402f3328]
xor ecx, ecx
mov rdx, r14
call fcn.14017ed20
test rax, rax
je 0x14019d1c2
mov r15, rax
mov rcx, rax
mov rdx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0xf
ja 0x14019d0c1
test rbx, rbx
je 0x14019d10b
xor eax, eax
nop
cmp byte [r12 + rax], 0
je 0x14019d0d3
inc rax
cmp rbx, rax
jne 0x14019d0b0
jmp 0x14019d10b
xor ecx, ecx
mov rdx, r12
mov r8, rbx
call fcn.14007b8b0
test rax, rax
je 0x14019d10b
lea rax, [0x1402bbcf0]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x14019d19f
mov edx, 1
mov rcx, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140027cc0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.140047d50
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14019d16f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14019d183
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x14019d19f
mov edx, 1
mov rcx, rbx
call fcn.140027cc0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.140197da0
call fcn.140047c20
mov ecx, 1
mov rdx, r14
call fcn.140197440
int3