joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f690
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0
jmp 0x14000f6ff
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x30], eax
jge 0x14000f8c0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jne 0x14000f7e1
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jle 0x14000f7dc
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x88]
mov rdx, qword [rdx + 0x58]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
mov rax, qword [rsp + 0x88]
call qword [rax + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14000f798
xor eax, eax
jmp 0x14000f8c5
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
movsxd rax, dword [rsp + 0x40]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140056120
jmp 0x14000f6e7
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x50]
add eax, dword [rcx + 0x10]
mov eax, eax
mov edx, eax
mov rcx, qword [rsp + 0x78]
call fcn.14000f650
test eax, eax
jne 0x14000f80a
xor eax, eax
jmp 0x14000f8c5
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x88]
mov rdx, qword [rdx + 0x58]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
mov rax, qword [rsp + 0x88]
call qword [rax + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14000f860
xor eax, eax
jmp 0x14000f8c5
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x70]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x38]
call fcn.140055a90
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
jmp 0x14000f6e7
mov eax, 1
add rsp, 0x68
ret
Function at 0x1400113f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x148]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x60]
add rax, 0x150
xor ecx, ecx
xchg dword [rax], ecx
mov rax, qword [rsp + 0x60]
add rax, 0x138
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x60]
add rax, 0x160
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.14000ab30
mov rax, qword [rsp + 0x60]
add rax, 0x160
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
shl rax, 1
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x360], eax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x360]
mov rcx, qword [rsp + 0x60]
add rcx, 0x160
mov rdx, qword [rsp + 0x60]
add rdx, 0x160
mov qword [rsp + 0x38], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, rax
call fcn.140055a90
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x360]
add eax, 8
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x364], eax
mov rax, qword [rsp + 0x60]
add rax, 0x370
mov rcx, rax
call fcn.140006ef0
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov word [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 1
movzx r8d, word [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x34], eax
mov edx, 0xfa0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x380]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14001157a
cmp dword [rsp + 0x48], 0x102
je 0x140011605
cmp dword [rsp + 0x48], 0xffffffff
je 0x14001161d
jmp 0x140011633
mov rax, qword [rsp + 0x60]
add rax, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x138]
mov rax, qword [rax + 0x140]
sub rax, rcx
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mov rax, qword [rsp + 0x60]
pxor xmm1, xmm1
cvtsi2sd xmm1, qword [rax + 0x130]
divsd xmm1, qword [0x14008b9f8]
divsd xmm0, xmm1
mov rax, qword [rsp + 0x60]
movsd qword [rax + 0x128], xmm0
mov rax, qword [rsp + 0x60]
add rax, 0x150
mov ecx, 1
xchg dword [rax], ecx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, 1
jmp 0x140011635
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x140011635
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x140011635
xor al, al
add rsp, 0x58
ret
Function at 0x1400137a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x1538
call fcn.140058f10
sub rsp, rax
mov qword [rsp + 0x1510], 0xfffffffffffffffe
mov dword [rsp + 0x1508], 0
lea rdx, [0x14008c22a]
lea rcx, [rsp + 0x14e0]
call fcn.140014cf0
nop
lea rdx, [rsp + 0x14e0]
lea rcx, [rsp + 0x13c0]
call fcn.1400139d0
nop
lea rcx, [rsp + 0x14e0]
call fcn.140004070
lea rcx, [rsp + 0x13c0]
call fcn.140013a00
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140015510
mov r8d, reloc.WS2_32.dll_ntohs
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140015560
mov r8d, 1
mov edx, 3
lea rcx, [rsp + 0x13d0]
call fcn.140015590
nop
mov dword [rsp + 0x14d0], 0
jmp 0x14001386e
mov eax, dword [rsp + 0x14d0]
inc eax
mov dword [rsp + 0x14d0], eax
cmp dword [rsp + 0x14d0], 0x20
jge 0x14001397e
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140019ef0
mov dword [rsp + 0x14d4], eax
cmp dword [rsp + 0x14d4], 0xa
jge 0x1400138af
mov eax, dword [rsp + 0x14d4]
add eax, 0x30
mov dword [rsp + 0x1518], eax
jmp 0x1400138c0
mov eax, dword [rsp + 0x14d4]
add eax, 0x57
mov dword [rsp + 0x1518], eax
movzx eax, byte [rsp + 0x1518]
mov byte [rsp + 0x14d8], al
lea rax, [rsp + 0x13d0]
test rax, rax
je 0x1400138f2
lea rax, [rsp + 0x13d0]
add rax, 0x10
mov qword [rsp + 0x1520], rax
jmp 0x1400138fe
mov qword [rsp + 0x1520], 0
movzx edx, byte [rsp + 0x14d8]
mov rcx, qword [rsp + 0x1520]
call fcn.140019f30
cmp dword [rsp + 0x14d0], 7
je 0x14001393b
cmp dword [rsp + 0x14d0], 0xb
je 0x14001393b
cmp dword [rsp + 0x14d0], 0xf
je 0x14001393b
cmp dword [rsp + 0x14d0], 0x13
jne 0x140013979
lea rax, [rsp + 0x13d0]
test rax, rax
je 0x14001395e
lea rax, [rsp + 0x13d0]
add rax, 0x10
mov qword [rsp + 0x1528], rax
jmp 0x14001396a
mov qword [rsp + 0x1528], 0
mov dl, 0x2d
mov rcx, qword [rsp + 0x1528]
call fcn.140019f30
jmp 0x14001385e
mov rdx, qword [rsp + 0x1540]
lea rcx, [rsp + 0x13d0]
call fcn.1400156c0
mov eax, dword [rsp + 0x1508]
or eax, 1
mov dword [rsp + 0x1508], eax
lea rcx, [rsp + 0x13d0]
call fcn.140013a20
mov rax, qword [rsp + 0x1540]
add rsp, 0x1538
ret
Function at 0x140013a60
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x268
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
je 0x140013adb
lea rdx, str.Error_opening_registry_key.
lea rcx, [0x1400b2e80]
call fcn.14001a320
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
xor al, al
jmp 0x140013b87
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.MyProgram
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
je 0x140013b58
lea rdx, str.Error_setting_registry_value.
lea rcx, [0x1400b2e80]
call fcn.14001a320
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x140013b87
lea rdx, str.Added_to_startup_registry_successfully.
lea rcx, [0x1400b2e10]
call fcn.14001a320
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x268
ret

Function at 0x140013c20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0xffffffffffffffff
jne 0x140013c74
lea rdx, str.Failed_to_create_process_snapshot.
lea rcx, [0x1400b2e80]
call fcn.14001a320
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
xor al, al
jmp 0x140013d22
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x260]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140013cc6
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_get_first_process.
lea rcx, [0x1400b2e80]
call fcn.14001a320
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
xor al, al
jmp 0x140013d22
mov byte [rsp + 0x268], 0
mov rcx, qword [rsp + 0x280]
call fcn.1400041b0
mov rdx, rax
lea rcx, [rsp + 0x4c]
call fcn.140058da0
test eax, eax
jne 0x140013cf6
mov byte [rsp + 0x268], 1
jmp 0x140013d0c
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x260]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013cce
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x268]
add rsp, 0x278
ret
Function at 0x140013e50
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x54]
sub eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movzx eax, word [rsp + 0x46]
movzx ecx, word [rsp + 0x56]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm1, qword [0x14008b9f8]
addsd xmm0, xmm1
movsd qword [rsp + 0x30], xmm0
movsd xmm0, qword [0x14008cc08]
comisd xmm0, xmmword [rsp + 0x30]
jbe 0x140013ec9
jmp 0x140013f63
call fcn.140014440
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140013f70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rax
lea rax, str.15:57:05
mov ecx, eax
call fcn.140058eb0
call fcn.140058ec8
cdq
mov ecx, reloc.WS2_32.dll_sendto
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
imul eax, eax, 0xc
cdqe
mov rcx, rax
call fcn.140013750
call fcn.140013bc0
call fcn.140014b60
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x68
ret
Function at 0x140014b60
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x148
mov qword [rsp + 0x130], 0xfffffffffffffffe
lea rdx, str.vmcompute.exe
lea rcx, [rsp + 0x50]
call fcn.140015470
nop
lea rcx, [rsp + 0x50]
call fcn.140013c20
movzx eax, al
test eax, eax
jne 0x140014cd1
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140056120
mov dword [rsp + 0xc0], WSAGetLastError
mov dword [rsp + 0xfc], 1
xor eax, eax
mov word [rsp + 0x100], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140056120
lea rdx, str.powershell.exe_Enable_WindowsOptionalFeature__FeatureName__Containers_DisposableClientVM___All__Online
lea rcx, [rsp + 0x78]
call fcn.140015470
nop
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400154e0
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140014c84
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140014cc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x138], eax
lea rdx, str.Failed_to_create_process._Error_code:
lea rcx, [0x1400b2e80]
call fcn.14001a320
mov ecx, dword [rsp + 0x138]
mov edx, ecx
mov rcx, rax
call fcn.140014de0
lea rdx, [0x140013b90]
mov rcx, rax
call fcn.140014dc0
nop
lea rcx, [rsp + 0x78]
call fcn.140004120
jmp 0x140014cd7
call fcn.140012c60
nop
lea rcx, [rsp + 0x50]
call fcn.140004120
add rsp, 0x148
ret
Function at 0x14001f060
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14001f082
mov rcx, qword [rsp + 0x40]
call fcn.14001f300
jmp 0x14001f099
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14001f099
mov rcx, qword [rsp + 0x40]
call fcn.14001f130
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14001f130
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp], 0
jmp 0x14001f14a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0xe3
jge 0x14001f1dc
mov eax, dword [rsp]
add eax, 0x270
cdqe
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4 + 4]
and eax, 0x80000000
mov ecx, dword [rsp]
add ecx, 0x271
movsxd rcx, ecx
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx*4 + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x14001f1a3
mov dword [rsp + 0x10], 0x9908b0df
jmp 0x14001f1ab
mov dword [rsp + 0x10], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0x10]
mov ecx, dword [rsp]
add ecx, 0x3fd
movsxd rcx, ecx
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx*4 + 4]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x30]
mov dword [rdx + rcx*4 + 4], eax
jmp 0x14001f142
jmp 0x14001f1e6
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x26f
jge 0x14001f278
mov eax, dword [rsp]
add eax, 0x270
cdqe
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4 + 4]
and eax, 0x80000000
mov ecx, dword [rsp]
add ecx, 0x271
movsxd rcx, ecx
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx*4 + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
and eax, 1
test eax, eax
je 0x14001f23f
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14001f247
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0xc]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, dword [rsp]
sub ecx, 0xe3
movsxd rcx, ecx
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx*4 + 4]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x30]
mov dword [rdx + rcx*4 + 4], eax
jmp 0x14001f1de
mov eax, dword [rsp]
add eax, 0x270
cdqe
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4 + 4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x14001f2b7
mov dword [rsp + 0x18], 0x9908b0df
jmp 0x14001f2bf
mov dword [rsp + 0x18], 0
mov eax, dword [rsp + 4]
shr eax, 1
xor eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
xor eax, dword [rcx + 0x634]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x30]
mov dword [rdx + rcx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x14001f300
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x270
jmp 0x14001f31a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x4e0
jge 0x14001f3ac
mov eax, dword [rsp]
sub eax, 0x270
cdqe
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 4]
and eax, 0x80000000
mov ecx, dword [rsp]
sub ecx, 0x26f
movsxd rcx, ecx
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rdx + rcx*4 + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x14001f373
mov dword [rsp + 8], 0x9908b0df
jmp 0x14001f37b
mov dword [rsp + 8], 0
mov eax, dword [rsp + 4]
shr eax, 1
xor eax, dword [rsp + 8]
mov ecx, dword [rsp]
sub ecx, 0xe3
movsxd rcx, ecx
mov rdx, qword [rsp + 0x20]
xor eax, dword [rdx + rcx*4 + 4]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x20]
mov dword [rdx + rcx*4 + 4], eax
jmp 0x14001f312
add rsp, 0x18
ret
Function at 0x140028660
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140033730
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140028670
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140033760
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x14002c900
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x14002c918
lea ebx, [rdx - 2]
jmp 0x14002c91a
jns 0x14002c92c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
imul ebx, dword [rsp + 0x40]
neg ebx
mov r8d, dword [rdi + 0x54]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.14002a8c0

Function at 0x14002d3f0
Capabilities:
Terminate thread

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp qword [rcx + 0x70], 0
mov edi, edx
mov rbx, rcx
je 0x14002d4cc
add rcx, 0x28
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
jne 0x14002d422
mov edi, dword [rbx + 0x54]
mov r8d, edi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x48], rbp
call fcn.14002a8c0
mov esi, dword [rbx + 0x18]
dec esi
movsxd rdi, esi
js 0x14002d48d
nop
test rdi, rdi
js 0x14002d4d3
cmp esi, dword [rbx + 0x18]
jge 0x14002d4d3
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
jne 0x14002d47d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec esi
dec rdi
jns 0x14002d440
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x70], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc000008c
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]

Function at 0x140033550
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x700b
mov dword [rsp + 0x20], 8
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140033580
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x7010
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x1400335b0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1400335d0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 6
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140033730
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140033730
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140033760
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140033760
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400337f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 0
test edx, edx
jne 0x140033818
lea r9, [rsp + 0x50]
jmp 0x140033822
cmp edx, 1
jne 0x14003386b
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
jne 0x1400338be
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret