joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093bb0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x140093c31
sub r8d, 1
je 0x140093c08
cmp r8d, 1
jne 0x140093c45
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140093c29
cmp ecx, r8d
jne 0x140093c45
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.140093dd0
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140093c29
cmp ecx, 1
jne 0x140093c45
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.140093dd0
ret

Function at 0x140093c50
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x140093cf4
sub r8d, 2
je 0x140093cad
cmp r8d, 1
jne 0x140093ce6
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140093ca0
cmp ecx, r8d
jne 0x140093ce6
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140093ce7
cmp ecx, 1
jne 0x140093ce6
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.140093dd0
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x140093cd9
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.140093dd0

Function at 0x140093d20
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x140093dad
sub r8d, 1
je 0x140093d7e
cmp r8d, 1
jne 0x140093dc4
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140093da2
cmp ecx, r8d
jne 0x140093dc4
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.140093dd0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140093da2
cmp ecx, 1
jne 0x140093dc4
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.140093dd0
ret
Function at 0x140093dd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x38], 0xff
mov rcx, qword [rcx + 0x18]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
xor r9d, r9d
mov byte [rsp + 0x39], sil
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 0x1f0]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140093e2f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140072470
mov r9d, edi
lea rdx, str.SENT
mov r8d, esi
mov rcx, rbx
call fcn.1400935b0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140094180
Capabilities:
Send data
Send data on socket

Disassembly:
mov r10, qword [rcx + 0x1b8]
movsxd r11, edx
mov r9d, dword [r10 + r11*4 + 8]
cmp r8d, 1
jne 0x1400941d3
test r9d, r9d
je 0x1400941bd
sub r9d, 2
je 0x1400941e5
cmp r9d, r8d
jne 0x140094213
cmp dword [r10 + r11*4 + 0x408], 0
jne 0x140094213
mov dword [r10 + r11*4 + 0x408], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 2
mov edx, 0xfb
jmp fcn.140093dd0
sub r9d, 1
je 0x1400941fd
sub r9d, 1
je 0x1400941a5
cmp r9d, 1
jne 0x140094213
cmp dword [r10 + r11*4 + 0x408], 1
jne 0x140094213
mov dword [r10 + r11*4 + 0x408], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 3
mov edx, 0xfc
jmp fcn.140093dd0
ret

Function at 0x140094220
Capabilities:
Send data
Send data on socket

Disassembly:
mov r10, qword [rcx + 0x1b8]
movsxd r11, edx
mov r9d, dword [r10 + r11*4 + 0xc08]
cmp r8d, 1
jne 0x140094279
test r9d, r9d
je 0x140094260
sub r9d, 2
je 0x14009428b
cmp r9d, r8d
jne 0x1400942bc
cmp dword [r10 + r11*4 + 0x1008], 0
jne 0x1400942bc
mov dword [r10 + r11*4 + 0x1008], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 2
mov edx, 0xfd
jmp fcn.140093dd0
sub r9d, 1
je 0x1400942a3
sub r9d, 1
je 0x140094248
cmp r9d, 1
jne 0x1400942bc
cmp dword [r10 + r11*4 + 0x1008], 1
jne 0x1400942bc
mov dword [r10 + r11*4 + 0x1008], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 3
mov edx, 0xfe
jmp fcn.140093dd0
ret
Function at 0x140095430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140112070]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x18]
mov rsi, rcx
xor r9d, r9d
mov rdi, qword [rax + 0x470]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdi + 0x154]
lea r14, [rdi + 0x160]
mov rdx, qword [r14]
add r8d, 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x148], 0
mov dword [rdi + 0x14c], eax
jne 0x1400954c9
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xc8]
lea rdx, [rsp + 0x40]
call fcn.1400a58c0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x148], eax
mov r9d, dword [rdi + 0x14c]
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rbp
cmp r9d, 4
jge 0x14009552a
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.140072470
mov dword [rdi + 0xc], 7
xor eax, eax
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140060520
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
mov rcx, r14
call fcn.140094f50
movzx r8d, ax
mov dword [rdi + 0xc], r8d
sub r8d, 3
je 0x1400955d9
sub r8d, 1
je 0x14009564b
sub r8d, 1
je 0x140095595
cmp r8d, 1
je 0x140095575
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x1400f9f24]
call fcn.140072470
jmp 0x14009564b
mov rdx, qword [r14]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rdi
call fcn.140095170
test eax, eax
je 0x14009564b
jmp 0x1400954fe
mov rbp, qword [r14]
lea eax, [r9 - 4]
mov rcx, r14
movsxd rbx, eax
call fcn.140094f30
movzx r9d, ax
lea rcx, [rbp + 4]
mov rdx, rbx
mov dword [rdi + 8], r9d
call fcn.140096070
cmp rax, rbx
jae 0x14009564b
lea r8, [rbp + 4]
mov rcx, rsi
lea rdx, str.TFTP_error:__s_n
call fcn.140072560
jmp 0x14009564b
cmp r9d, 4
jle 0x14009564b
mov rcx, r14
call fcn.140094f30
movzx ecx, word [rdi + 0x15c]
inc ecx
cmp cx, ax
jne 0x14009564b
mov r8, qword [r14]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, rsi
call fcn.140072390
mov ebx, eax
test eax, eax
je 0x14009562a
mov edx, 5
mov rcx, rdi
call fcn.140095f60
mov eax, ebx
jmp 0x1400954fe
mov eax, dword [rdi + 0x14c]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0x100], rax
mov rdx, qword [rsi + 0x100]
call fcn.14007edc0
mov rcx, rsi
call fcn.14007f050
test eax, eax
je 0x1400954fc
mov edx, 5
mov rcx, rdi
call fcn.140095f60
mov eax, Ordinal_46
jmp 0x1400954fe
Function at 0x1400975c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [str._l_v_]
mov rdi, rax
test rax, rax
je 0x14009763d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140097668
cmp ebx, esi
je 0x140097668
cmp ebx, 0x8000
ja 0x140097668
cmp ebx, esi
jb 0x140097663
mov edx, ebx
mov rcx, rdi
call qword [str._l_v_]
mov rdi, rax
test rax, rax
jne 0x140097600
mov rcx, rbp
call qword [fcn.1400afdbc]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140097648
mov rcx, rdi
jmp 0x140097640
jmp 0x1400975c0

Function at 0x140097670
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [str._l_v_]
mov rdi, rax
test rax, rax
je 0x14009763d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140097668
cmp ebx, esi
je 0x140097668
cmp ebx, 0x8000
ja 0x140097668
cmp ebx, esi
jb 0x140097663
mov edx, ebx
mov rcx, rdi
call qword [str._l_v_]
mov rdi, rax
test rax, rax
jne 0x140097600
mov rcx, rbp
call qword [fcn.1400afdbc]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140097648
mov rcx, rdi
jmp 0x140097640
jmp 0x1400975c0
Function at 0x1400a2eb0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140112070]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400a2f7c
mov qword [rsp + 0xa0], rbp
lea rdx, [rsp + 0x64]
xor ebp, ebp
mov dword [rsp + 0x58], 0x208
mov rcx, rsi
mov qword [rsp + 0x64], rbp
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
call fcn.1400a2ff0
lea rcx, [rsp + 0x64]
lea edx, [rbp + 8]
call fcn.1400a45d0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [rbp + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1400a2f80
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1400a2fca
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140060520
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a35a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400b5dec]
mov rdi, rax
test rax, rax
jne 0x1400a35e2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a3629
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a3682
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a3640
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a36c3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400e5b78]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400e5b79]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a3690
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400bdbb4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400bd9e0

Function at 0x1400c8e74
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400c8e94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b8e60
or eax, 0xffffffff
jmp 0x1400c8e96
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002250
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140041150]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400022aa
mov r8, qword [0x14003e0a3]
mov rcx, qword [0x140041120]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140041150]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140001928
lea rcx, [0x140002228]
mov rdx, rbx
call fcn.1400023cc
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400022b4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140041150], eax
add rsp, 0x28
jmp fcn.140002250

Function at 0x1400023cc
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140041158], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x140041168]
jne 0x140002419
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140041190], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140041158], 1
mov ecx, dword [0x140041190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400024ee
mov rcx, qword [0x140041120]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140002519
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140041160]
test rax, rax
je 0x140002469
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140041160], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x140002534]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140041190]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140041120]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140002519
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140002c48
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov ebx, reloc.WS2_32.dll_recv
lea r8, [0x140002b5c]
lea ecx, [rbx + 0x28]
mov edx, ebx
call fcn.140003cd0
xor r8d, r8d
xor edx, edx
mov ecx, ebx
mov qword [0x1400411a0], rax
call fcn.140003b50
xor ebx, ebx
cmp word [0x140041198], bx
mov qword [0x140045ea0], rax
jne 0x140002d6b
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
mov word [0x140041198], di
test eax, eax
je 0x140002cb9
mov word [0x140041198], bx
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400411c8], rax
test rax, rax
je 0x140002d6b
lea rdx, str.getaddrinfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400411c8]
lea rdx, str.freeaddrinfo
mov qword [0x1400411a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400411c8]
lea rdx, str.getnameinfo
mov qword [0x1400411b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400411c8]
lea rdx, str.WSAStringToAddressA
mov qword [0x1400411b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400411a8], rbx
mov qword [0x1400411c0], rax
je 0x140002d6b
cmp qword [0x1400411b0], rbx
je 0x140002d6b
cmp qword [0x1400411b8], rbx
je 0x140002d6b
mov ecx, dword [0x14004119c]
test rax, rax
cmovne ecx, edi
mov dword [0x14004119c], ecx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret

Function at 0x1400075b0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
mov rcx, qword [0x140045f40]
call fcn.140003b4c
cmp dword [0x14003e018], 0
mov rdi, qword [rax]
je 0x140007627
cmp qword [0x140045f60], rdi
jne 0x140007627
cmp dword [0x14004191c], 0
je 0x140007627
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140041920]
mov qword [rsp + 0x38], rsi
xor esi, esi
test rbx, rbx
je 0x140007617
cmp rbx, rdi
je 0x14000760c
cmp dword [rbx + 0x38], esi
jne 0x14000760c
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rbx + 0x38], esi
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400075f8
mov rbx, qword [rsp + 0x30]
mov dword [0x14004191c], esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140007630
Capabilities:
Check for time delay via gettickcount
Suspend thread

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x140045f40]
call fcn.140003b4c
cmp dword [0x14003e018], 0
mov rsi, qword [rax]
je 0x140007770
cmp dword [0x14004191c], 0
jne 0x140007770
lea rcx, [0x140041928]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1400412dc], 0
je 0x1400076a6
lea rcx, [0x140046820]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140045fa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x140056c60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x140045f60], rsi
mov dword [0x14004191c], 1
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [0x140041920]
lea edi, [rax + 0xc8]
test rbx, rbx
je 0x140007723
cmp rbx, rsi
je 0x14000771b
cmp dword [rbx + 0x38], 0
jne 0x14000771b
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x14000770b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx + 0x38], 0
je 0x1400076f0
cmp dword [rbx + 0x38], 0
jne 0x14000771b
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400076e3
cmp dword [0x1400412dc], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14000775d
lea rcx, [0x140045fa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140046820]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140041928]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x20
pop rsi
ret
Function at 0x14000c2f0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
call fcn.14000c100
call fcn.140007630
xor ecx, ecx
call fcn.14000c5b0
test eax, eax
jne 0x14000c300
mov rbx, qword [0x1400412f8]
test rbx, rbx
je 0x14000c3e0
cmp dword [0x140041300], eax
je 0x14000c3e0
cmp dword [0x140041950], 0
mov eax, dword [0x1400412ec]
mov dword [rsp + 0x20], 0x23
lea eax, [rax*4]
mov dword [rsp + 0x24], eax
je 0x14000c3ab
mov rcx, qword [0x1400467c0]
movsxd r8, eax
mov rdx, rbx
call sub.msvcrt.dll_memcpy
xor r9d, r9d
cmp dword [0x1400412ec], r9d
jle 0x14000c3a4
xor r8d, r8d
nop word [rax + rax]
mov rdx, qword [0x1400467c0]
inc r9d
add rdx, r8
add r8, 4
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 3]
mov byte [rdx], al
movzx eax, byte [rdx + 2]
mov byte [rdx + 3], cl
movzx ecx, byte [rdx + 1]
mov byte [rdx + 1], al
mov byte [rdx + 2], cl
cmp r9d, dword [0x1400412ec]
jl 0x14000c370
mov rbx, qword [0x1400467c0]
call fcn.14001fc00
lea rcx, [0x140056c80]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140041978]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [rax + 0x18]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x20], 1
call fcn.14001fc00
lea rcx, [0x140056c80]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140041978]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [rax + 0x18]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x140041978]
call qword [rax + 0x28]
lea rcx, [0x140045fa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140046820]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x140041968]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140041968]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140041970]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140041970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140045fa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140046820]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140045fa0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x140056c80]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x140046820]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add rsp, 0x40
pop rbx
ret