joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400301b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400301e0
test ecx, ecx
jne 0x140030230
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1400301ec
test ecx, ecx
jne 0x140030230
mov rcx, rdi
call fcn.140030090
movzx eax, al
test bpl, bpl
jne 0x140030237
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140030223.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1400303a8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140030223.2
xor eax, eax
test bpl, bpl
je 0x1400301fc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140030389
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14003026a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400302e9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400302b0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1400302cb
inc rax
dec rdi
cmp rax, 1
jne 0x140030290
jmp 0x1400302e9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400302cb
cmp ebx, 0x5c
je 0x1400302cb
inc rax
dec rdi
cmp rax, 1
jne 0x1400302b0
jmp 0x1400302e9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140030397
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140030313
mov al, 9
cmp rdx, 2
je 0x140030317
cmp rdx, 1
jne 0x140030327
cmp byte [r8], 0x2e
jne 0x140030327
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140030327
mov al, 0xa
jmp 0x140030327
cmp byte [r8], 0x2e
jne 0x140030327
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140030223.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140030223.2
mov ecx, 2
jmp case.0x140030223.2
lea r8, str.library_std_srcpath.rs
call fcn.14005c100
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14005c100
ud2
Function at 0x1400308a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14002d220
mov r14, qword [rbp - 0x60]
test r14, r14
je 0x140030a43
mov qword [rbp + 0x3d8], rsi
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x3c8], xmm0
mov qword [rbp + 0x3c0], r14
mov qword [rbp + 0x408], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x428], rax
xor eax, eax
mov qword [rbp + 0x420], rax
xor ebx, ebx
xor edi, edi
cmp r8, 0x201
jae 0x140030970
jmp 0x140030952
mov r14, rsi
jae 0x140030a55
cmp r8, 0x201
jae 0x140030970
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x1400309d2
sub r8, rdi
sub rbx, rdi
cmp rbx, r8
jae 0x1400309a6
lea rcx, [rbp + 0x408]
mov rdx, rdi
call fcn.14005d0a0
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x420], rax
mov rbx, qword [rbp + 0x420]
mov eax, 0xffffffff
cmp rbx, rax
mov edi, 0xffffffff
cmovb rdi, rbx
mov qword [rbp + 0x418], rdi
mov r13, qword [rbp + 0x428]
mov r15, rdi
mov r12, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, r14
mov rcx, r14
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140030a01
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140030a8b
mov r8d, r14d
cmp r12, r8
jne 0x140030940
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140030b32
mov r14, rsi
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140030952
jmp 0x140030970
lea rcx, [rbp - 0x58]
call fcn.14002a940
mov byte [rsi + 0x18], 2
jmp 0x140030afc
cmp r15, r8
jb 0x140030b4c
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.14002ed70
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmmword [rbp + 0x3e0], xmm0
jmp 0x140030aaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3e0], rax
mov byte [rbp + 0x3f8], 2
mov r14, rsi
cmp qword [rbp + 0x420], 0
mov rsi, qword [rbp + 0x3d8]
je 0x140030acc
mov edx, 2
mov rcx, qword [rbp + 0x428]
call fcn.140005400
cmp byte [rbp + 0x3f8], 2
jne 0x140030b11
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3e0]
call fcn.14002a940
cmp qword [rbp + 0x3c8], 0
je 0x140030afc
mov edx, 2
mov rcx, r14
call fcn.140005400
nop
add rsp, 0x4b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3e0]
movaps xmm1, xmmword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x3c8], 0
jne 0x140030aef
jmp 0x140030afc
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005c200
jmp 0x140030b61
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14005c180
ud2
Function at 0x1400343f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], 0x103
mov qword [rsp + 0x58], 0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140034462
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x50]
cmp eax, 0xc0000011
jne 0x140034471
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400344a9
cmp eax, 0x103
je 0x1400344b3
test eax, eax
js 0x14003448e
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400344a9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x98
pop rdi
pop rsi
ret
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, [0x14006a2e0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
lea rax, [0x14006bc78]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x68]
call fcn.14002b3e0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.14002b480
mov ecx, 7
int 0x29
ud2
Function at 0x140034fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x14003502c
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x140035120
test r15w, r15w
je 0x14003502c
cmp r15w, 0x2e
jne 0x140035120
test r12w, r12w
jne 0x140035120
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call fcn.14004ee60
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140035105
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140035081
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x140035105
cmp word [rsp + 0xac], 0x2e
jne 0x1400350aa
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x140035070
cmp ax, 0x2e
jne 0x1400350aa
cmp word [rsp + 0xb0], 0
je 0x140035070
lock inc qword [r14]
jle 0x140035209
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x14003514b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x140035197
mov qword [rsi], 0
jmp 0x1400351f7
lock inc qword [r14]
jle 0x140035209
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.14004f020
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.14004f020
jmp 0x1400351aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call fcn.14004f020
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x140040f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14002d220
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x140041006
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.140040e80
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x140041014
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140041034
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x140041025
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
call fcn.14002a940
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x140041025
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140005400
Function at 0x140042c50
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov ecx, 0x10
mov edx, 8
call fcn.140005370
test rax, rax
je 0x140042d22
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140043110]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140042d14
mov rcx, qword [r14]
mov qword [rbp - 0x10], r14
mov rax, qword [r14 + 8]
call qword [rax]
mov rsi, qword [rbp - 0x10]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x140042cf2
mov rcx, qword [rsi]
mov rdx, qword [rax + 0x10]
call fcn.140005400
mov edx, 8
mov rcx, rsi
call fcn.140005400
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 8
mov edx, 0x10
call fcn.14005bef0
ud2
Function at 0x140043bc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x140043bff
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x1400314c0]
mov qword [rbp - 0x28], rax
lea rax, [0x14006a748]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14005c040
ud2

Function at 0x1400462e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14004642f
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140046318
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140046418
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400463fa
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004637b
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1400463a4
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
xor eax, eax
jmp 0x1400463e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x6d
je 0x1400463ac
cmp eax, 0x3e5
jne 0x1400463e0
lea rax, [rsp + 0x30]
jmp 0x1400463ba
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400463e6
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.14002a940
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400463f0
cmp rax, 1
je 0x140046362
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x14004636c
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14005d160
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140046325
mov r8d, 0x10
mov rcx, rbx
call fcn.14005d160
mov rax, qword [rbx + 8]
jmp 0x140046318
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14005d450
ud2

Function at 0x140052b7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400529a8
Function at 0x180004b60
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x88
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x38], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x180004be9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
call fcn.1800049a0
mov r8, rax
mov edx, dword [rsp + 0x34]
lea rcx, [rsp + 0x58]
call fcn.180003b00
mov dword [rsp + 0x20], 0x1a
lea r9, str.win_tss_ptr_create
mov r8d, 0x2e
lea rdx, str.C:_boostPidor_boost_asiodetailimplwin_tss_ptr.ipp
lea rcx, [rsp + 0x40]
call fcn.180001fb0
mov r8, rax
lea rdx, [0x180027bc0]
lea rcx, [rsp + 0x58]
call fcn.180004660
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180024410
add rsp, 0x88
ret

Function at 0x180005d70
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800107f0
movzx eax, al
test eax, eax
je 0x180005deb
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x180005e18
xor r8d, r8d
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 8]
lea rcx, [fcn.180001e80]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov edx, 0xffffffff
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180024410
add rsp, 0x48
ret
Function at 0x1800062f0
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x18000637d
movzx eax, byte [rsp + 0x1f8]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180024410
add rsp, 0x1e8
ret

Function at 0x180007df0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x44], 0
cmp qword [rsp + 0xb0], 0xffffffffffffffff
je 0x180007fb5
movzx eax, byte [rsp + 0xc0]
test eax, eax
je 0x180007eae
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 8
test eax, eax
je 0x180007eae
xor eax, eax
mov word [rsp + 0x78], ax
xor eax, eax
mov word [rsp + 0x7a], ax
lea rcx, [rsp + 0x80]
call fcn.180003ad0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, pe_nt_image_headers64
mov r8d, 0xffff
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.180008800
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x180007ece
mov byte [rsp + 0x40], 1
jmp 0x180007ed3
mov byte [rsp + 0x40], 0
movzx edx, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
call fcn.180007d90
cmp dword [rsp + 0x44], 0
je 0x180007fb5
xor r8d, r8d
mov edx, 0x2733
lea rcx, [rsp + 0x48]
call fcn.180016060
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.180004000
movzx eax, al
test eax, eax
jne 0x180007f46
xor r8d, r8d
mov edx, 0x4d5
lea rcx, [rsp + 0x60]
call fcn.180016060
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call fcn.180004000
movzx eax, al
test eax, eax
je 0x180007fb5
mov dword [rsp + 0x7c], 0
lea r8, [rsp + 0x7c]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0xb8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x180007f9e
mov byte [rsp + 0x41], 1
jmp 0x180007fa3
mov byte [rsp + 0x41], 0
movzx edx, byte [rsp + 0x41]
mov rcx, qword [rsp + 0xc8]
call fcn.180007d90
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180024410
add rsp, 0xa8
ret
Function at 0x180008210
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x40], eax
mov dl, 1
mov rcx, qword [rsp + 0x90]
call fcn.180007d90
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0x40
jne 0x1800082c4
mov edx, 0x2746
mov rcx, qword [rsp + 0x90]
call fcn.180016020
jmp 0x18000831c
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0x4d2
jne 0x1800082ec
mov edx, 0x274d
mov rcx, qword [rsp + 0x90]
call fcn.180016020
jmp 0x18000831c
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0x2738
je 0x180008314
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0xea
jne 0x18000831c
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 0
je 0x18000832a
mov eax, 0xffffffff
jmp 0x18000833b
mov rcx, qword [rsp + 0x90]
call fcn.180004970
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180024410
add rsp, 0x68
ret

Function at 0x1800084d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSASend]
mov dword [rsp + 0x48], eax
mov dl, 1
mov rcx, qword [rsp + 0x90]
call fcn.180007d90
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0x40
jne 0x180008582
mov edx, 0x2746
mov rcx, qword [rsp + 0x90]
call fcn.180016020
jmp 0x1800085a8
mov rcx, qword [rsp + 0x90]
call fcn.180003c60
cmp eax, 0x4d2
jne 0x1800085a8
mov edx, 0x274d
mov rcx, qword [rsp + 0x90]
call fcn.180016020
cmp dword [rsp + 0x48], 0
je 0x1800085b6
mov eax, 0xffffffff
jmp 0x1800085c7
mov rcx, qword [rsp + 0x90]
call fcn.180004970
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180024410
add rsp, 0x68
ret
Function at 0x180008730
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x18000878f
mov byte [rsp + 0x30], 1
jmp 0x180008794
mov byte [rsp + 0x30], 0
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.180007d90
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x1800087b2
mov rax, qword [rsp + 0x38]
jmp 0x1800087e9
cmp dword [rsp + 0x60], 0x17
jne 0x1800087e4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov r8d, 0x1b
mov edx, 0x29
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180024410
add rsp, 0x58
ret