joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140194ea0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1404c3ee8]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140194f04
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.140196ce0
test al, al
je 0x140194ef8
mov dword [0x1404c3ee8], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1404c3ee8], 1
jmp 0x140194f09
cmp eax, 2
je 0x140194f5b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140194f3a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140194f5b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x140195b60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rsi, r9
mov rbp, r8
mov rcx, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x140195c01
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140195bc5
mov dword [rsi], 0x51
jmp 0x140195bfa
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140138490
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140153f80
mov rax, qword [rdi + 8]
mov dword [rax + 0xde4], ebx
mov dword [rsi], reloc.WS2_32.dll_getservbyport
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x28], edx
mov rdx, qword [rdi]
mov dword [rsp + 0x20], ebx
call fcn.140154110
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140195c40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x308]
test dword [rcx + 0x84], 0x800
jne 0x140195d81
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140195d11
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140138490
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140153f80
mov eax, 2
jmp 0x140195d83
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.140155330
test al, al
jne 0x140195d81
mov qword [rsp + 0x1e0], rdi
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ebx, dword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140138490
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140153f80
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x140195d83
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14022a640
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14019dc80
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.14016c630
mov r13, rax
test rax, rax
jne 0x14019dcfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401385c0
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140153f80
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [fcn.14022b64e]
jmp 0x14019deb8
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14019dd71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401385c0
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140153f80
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x14019dea2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14019ddba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401385c0
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140153f80
mov ebx, 0x4d
jmp 0x14019de96
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x14019ddef
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.140153f80
mov ebx, 0x4d
jmp 0x14019de8e
lea rcx, [rdi + 1]
call qword [section..data]
mov rbp, rax
test rax, rax
jne 0x14019de09
lea ebx, [rax + 0x1b]
jmp 0x14019de8e
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x14019de68
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14019deda
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14019de5f
mov edi, esi
jmp 0x14019de61
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x14019de20
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.14019da00
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.14022b64e]
mov rcx, r13
call fcn.14022b64e
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401385c0
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140153f80
mov ebx, 0x4d
jmp 0x14019de86
Function at 0x1401a5250
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x1401a5293
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x1401a52e0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x1401a5342
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x1401a5300
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x1401a5381
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1403ce4a1]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403ce4a2]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x1401a5350
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x1401a6380
Capabilities:
Get socket status

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x470
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rdx
xor ebp, ebp
lea rdx, [rsp + 0x30]
mov dword [rcx + 0x270], ebp
mov rbx, rcx
call fcn.1401c1590
test eax, eax
jne 0x1401a6511
mov eax, dword [rsp + 0x30]
mov edx, 0x3e8
mov r8d, dword [rbx + 0xb0]
imul ecx, eax, 0x3e8
mov qword [rsp + 0x4a0], rdi
mov edi, dword [rbx + 0x25c]
test edi, edi
cmove ecx, edx
test r8d, r8d
jle 0x1401a643f
test eax, eax
je 0x1401a63f4
cmp ecx, r8d
jle 0x1401a643f
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rdx, rsi
mov rcx, rax
call sub.api_ms_win_crt_time_l1_1_0.dll__difftime64
mulsd xmm0, qword [0x1403c2288]
mov ecx, dword [rbx + 0xb0]
cvttsd2si eax, xmm0
cmp eax, ecx
jle 0x1401a6435
lea r8, str.API_timeout_expired
mov edx, 0xfffffff7
mov rcx, rbx
call fcn.1401c1b80
jmp 0x1401a6509
sub ecx, eax
mov r8d, 1
jmp 0x1401a6448
test ecx, ecx
mov r8d, ebp
setg r8b
mov eax, 0x10624dd3
mov r10, rbp
imul ecx
mov r11, rbp
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov rcx, qword [rbx + 0x250]
mov dword [rsp + 0x3c], eax
test dil, 1
je 0x1401a6494
mov qword [rsp + 0x48], rcx
lea r11, [rsp + 0x40]
mov dword [rsp + 0x40], 1
test dil, 2
je 0x1401a64b5
mov qword [rsp + 0x258], rcx
lea r10, [rsp + 0x250]
mov dword [rsp + 0x250], 1
test r8d, r8d
lea rax, [rsp + 0x38]
mov r8, r10
mov rdx, r11
cmove rax, rbp
inc ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1401a64ef
lea r8, str.Timed_out_waiting_on_socket
mov rcx, rbx
lea edx, [rax - 9]
call fcn.1401c1b80
jmp 0x1401a6509
jns 0x1401a6507
lea r8, str.Error_waiting_on_socket
mov edx, 0xfffffff7
mov rcx, rbx
call fcn.1401c1b80
jmp 0x1401a6509
xor eax, eax
mov rdi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x470
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401b7cc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r9
xor r15d, r15d
mov r9, qword [r9]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp r9, r8
jae 0x1401b7d5c
mov rax, r9
lea rbp, [rcx + 0x68]
nop word [rax + rax]
mov rcx, qword [rbx + 0x88]
cmp dword [rbx + 0x90], r15d
jne 0x1401b7d2c
mov r8d, esi
mov qword [rsp + 0x20], rbp
sub r8d, r9d
lea rdx, [rax + r14]
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1401b7d3d
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, eax
mov eax, dword [rsp + 0x60]
add qword [rdi], rax
test ecx, ecx
je 0x1401b7d7b
mov dword [rbx + 0x90], r15d
mov rax, qword [rdi]
mov r9d, eax
cmp rax, rsi
jb 0x1401b7d00
mov qword [rdi], r15
mov eax, r9d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbx + 0x90], r15d
jne 0x1401b7d98
cmp eax, 0x3e5
je 0x1401b7d9f
mov eax, 0xffffffff
jmp 0x1401b7d62
cmp eax, 0x3e4
jne 0x1401b7d91
mov dword [rbx + 0x90], 1
mov eax, 0xffffffdb
jmp 0x1401b7d62

Function at 0x1401b7db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r9
xor r15d, r15d
mov r9, qword [r9]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp r9, r8
jae 0x1401b7e4c
mov rax, r9
lea rbp, [rcx + 0x68]
nop word [rax + rax]
mov rcx, qword [rbx + 0x88]
cmp dword [rbx + 0x90], r15d
jne 0x1401b7e1c
mov r8d, esi
mov qword [rsp + 0x20], rbp
sub r8d, r9d
lea rdx, [rax + r14]
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401b7e2d
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, eax
mov eax, dword [rsp + 0x60]
add qword [rdi], rax
test ecx, ecx
je 0x1401b7e6b
mov dword [rbx + 0x90], r15d
mov rax, qword [rdi]
mov r9d, eax
cmp rax, rsi
jb 0x1401b7df0
mov qword [rdi], r15
mov eax, r9d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbx + 0x90], r15d
jne 0x1401b7e88
cmp eax, 0x3e5
je 0x1401b7e8f
mov eax, 0xffffffff
jmp 0x1401b7e52
cmp eax, 0x3e4
jne 0x1401b7e81
mov dword [rbx + 0x90], 1
mov eax, 0xffffffdb
jmp 0x1401b7e52
Function at 0x1401c1860
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov qword [r9], 0
mov r14, r9
mov rdi, rdx
mov r8, rcx
mov rsi, 0xffffffffffffffff
test rbx, rbx
jne 0x1401c189d
mov rbx, rsi
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1401c1894
lea rcx, [rbx*4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rcx, rdx
mov rdx, r8
shr rcx, 1
add rcx, 4
call qword [rreloc.WS2_32.dll_htonl + 8]
mov r9, rax
mov rbp, rax
test rax, rax
je 0x1401c19d1
mov qword [rsp + 0x48], r15
test rbx, rbx
je 0x1401c19b5
lea r15, [0x1403d3240]
xor edx, edx
xor eax, eax
nop dword [rax + rax]
test rbx, rbx
je 0x1401c1902
movzx ecx, byte [rdi]
inc edx
inc rdi
dec rbx
jmp 0x1401c190e
cmp rax, 3
jae 0x1401c19e4
xor cl, cl
mov byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 3
jl 0x1401c18f0
movzx r10d, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x41]
movzx r11d, r10b
movzx r8d, byte [rsp + 0x42]
movzx eax, cl
shr al, 4
and r10b, 3
and cl, 0xf
shl r10b, 4
or r10b, al
shl cl, 2
movzx eax, r8b
shr r11b, 2
shr al, 6
and r8b, 0x3f
or cl, al
sub edx, 1
je 0x1401c1981
cmp edx, 1
je 0x1401c1975
movzx eax, r8b
movzx edx, byte [rax + r15]
movzx eax, cl
movzx r8d, byte [rax + r15]
jmp 0x1401c1987
movzx eax, cl
mov dl, 0x3d
movzx r8d, byte [rax + r15]
jmp 0x1401c1987
mov dl, 0x3d
movzx r8d, dl
movzx eax, r10b
movzx ecx, byte [rax + r15]
movzx eax, r11b
movzx eax, byte [rax + r15]
mov byte [r9], al
mov byte [r9 + 1], cl
mov byte [r9 + 2], r8b
mov byte [r9 + 3], dl
add r9, 4
test rbx, rbx
jne 0x1401c18e7
mov byte [r9], 0
mov qword [r14], rbp
nop dword [rax]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x1401c19c0
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call fcn.14022a768
int3
Function at 0x14021d270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, dword [rsp + 0x88]
xor ebp, ebp
mov rax, qword [rsp + 0x80]
mov r10d, r12d
and r10d, 0x7f
movsxd rdi, r8d
mov r15d, r9d
mov dword [rsp + 0x20], 0xffffffff
mov r14, rdx
mov dword [rsp + 0x24], ebp
mov r13, rcx
mov esi, ebp
mov rbx, qword [rax + r10*8]
test rbx, rbx
je 0x14021d32b
cmp edi, dword [rbx + 0x10]
jne 0x14021d322
cmp edi, 0xffffffff
jne 0x14021d2f5
cmp r12d, dword [rbx + 0x4c]
jne 0x14021d322
mov rcx, qword [rbx]
mov r8, qword [r14 + 0x10]
cmp qword [rcx + 0x18], r8
jne 0x14021d322
mov rdx, qword [r14]
mov rcx, qword [rcx + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14021d322
test rsi, rsi
jne 0x14021d303
mov rsi, rbx
cmp r15d, 2
je 0x14021d32b
mov rcx, qword [rbx + 8]
mov r8, qword [r14 + 0x18]
cmp qword [rcx + 0x18], r8
jne 0x14021d322
mov rdx, qword [r14 + 8]
mov rcx, qword [rcx + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14021d34b
mov rbx, qword [rbx + 0x40]
test rbx, rbx
jne 0x14021d2c8
cmp edi, 0x3c
ja 0x14021d353
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x84], ebp
cmp r15d, 2
jne 0x14021d35f
mov eax, edi
jmp 0x14021d3d3
mov rsi, rbx
mov ebp, 1
test rsi, rsi
jne 0x14021d3c0
mov rax, qword [rsp + 0x20]
jmp 0x14021d3d3
mov rbx, rdi
lea r15, [0x1403e6f98]
shl rbx, 7
lea rbp, [0x1403e6f20]
mov esi, edi
cmp dword [rbx + r15], edi
jne 0x14021d3a8
mov r8, qword [r14 + 0x18]
cmp qword [rbx + rbp + 0x40], r8
jne 0x14021d399
mov rdx, qword [r14 + 8]
mov rcx, qword [rbx + rbp + 0x38]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14021d3b2
inc esi
sub rbx, 0xffffffffffffff80
cmp rbx, 0x1e00
jle 0x14021d376
mov rax, qword [rsp + 0x80]
jmp 0x14021d3d3
mov eax, esi
movabs rcx, 0x100000000
jmp 0x14021d3d0
mov eax, dword [r13 + 0x38]
sub eax, dword [rsi + 0x48]
add eax, 0x3c
mov ecx, ebp
shl rcx, 0x20
or rax, rcx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14022b39c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14022b3e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14022b3e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14022b3e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14022b3e6
cmp dword [rcx + 0x84], 0xe
jbe 0x14022b3e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14022b3e8
xor al, al
add rsp, 0x28
ret

Function at 0x140231370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
mov r11, rdx
and rsi, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rsi
xor ecx, dword [r8 + 8]
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
movq xmm4, rsi
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, edx
mov eax, dword [r8 + 0x14]
xor rcx, rax
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x140231489
cmp edi, 2
jb 0x140231489
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14023141a
cmp rbx, r8
jae 0x140231489
cmp r9, r10
ja 0x140231424
cmp rbx, r10
jae 0x140231489
cmp r9, r11
ja 0x14023142e
cmp rbx, r11
jae 0x140231489
cmp r8, r10
ja 0x140231438
cmp rax, r10
jae 0x140231489
cmp r8, r11
ja 0x140231442
cmp rax, r11
jae 0x140231489
mov eax, edi
and eax, 0xfffffffe
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x140231450
movsxd rax, edx
cmp rax, rdi
jge 0x1402314be
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x140231491
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x14026d840
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14022aff0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1402722e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14027234c
movzx ecx, byte [rcx]
test cl, cl
je 0x14027234c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140272300
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140272350
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1402723c0
movzx ecx, byte [rcx]
test cl, cl
je 0x1402723c0
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140272370
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140276e50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14022aff0
sub rsp, rax
lea rcx, [0x1404c4950]
add rsp, 0x28
jmp fcn.14026d6c0
Function at 0x140296020
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1404c4ba0], 0
lea rax, [0x1402959a0]
mov qword [rsp + 0x28], rax
lea rbx, [0x14041db10]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140295de0]
mov qword [rsp + 0x38], rax
lea rax, [0x14041db30]
mov qword [rsp + 0x40], rax
lea rax, [0x140295940]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1402961f9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1402961ef
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14029611a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14029617a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1402961e7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14029617a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1402961e7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1402961d6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140296190
mov rax, qword [rsp + 0x28]
mov qword [0x1404c02a8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1404c02b8], rax
mov rax, qword [rsp + 0x48]
mov qword [str._Y__], rax
jmp 0x1402961df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1404c4ba0], 1
mov rax, rbp
lea rcx, [0x1404c02a0]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14022a640
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret