joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053320
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, qword [rcx + 0x30]
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
mov dword [rsp + 0x20], 0
cmp rbx, qword [rcx + 0x38]
je 0x14005337b
nop word [rax + rax]
mov rsi, qword [rbx]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + reloc.WS2_32.dll_recv]
cmp eax, r14d
je 0x1400533ac
add rbx, 8
cmp rbx, qword [rbp + 0x38]
jne 0x140053360
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], 0
mov byte [rdi], 0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r8, rax
test rax, rax
je 0x14005337b
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x20]
jmp 0x14005338e

Function at 0x140056ca0
Capabilities:
Open clipboard

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
cmp qword [rcx + 0x340], 0
je 0x140056dd9
mov rax, qword [rcx + 0x338]
mov rbp, qword [rax + 8]
mov rcx, rbp
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140056d56
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], eax
lea rax, str._clipboard__OpenClipboard_failed_with__d__current:_0x_x__open:0x_x
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x77
lea r9, str.CAutoClipboard::CAutoClipboard
lea r8, str...includes_sunloginincludeSynergyClipplatformclipClipboardViewWnd.cpp
lea edx, [rbx + 1]
lea rcx, [0x1401399a0]
call fcn.14007a380
nop
test ebx, ebx
je 0x140056dd3
mov rcx, qword [rsi + 0x340]
mov rax, qword [rcx]
mov r8d, r14d
lea rdx, [rsp + 0x60]
call qword [rax + 0x18]
mov rdx, rax
mov rcx, r15
call fcn.140011de0
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140056dd3
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140056dcd
test cl, 0x1f
je 0x140056da0
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140056daf
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140056dbe
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140056dca
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140056e00
Capabilities:
Open clipboard

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
cmp qword [rcx + 0x340], 0
je 0x140056f39
mov rax, qword [rcx + 0x338]
mov rbp, qword [rax + 8]
mov rcx, rbp
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140056eb6
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], eax
lea rax, str._clipboard__OpenClipboard_failed_with__d__current:_0x_x__open:0x_x
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x77
lea r9, str.CAutoClipboard::CAutoClipboard
lea r8, str...includes_sunloginincludeSynergyClipplatformclipClipboardViewWnd.cpp
lea edx, [rbx + 1]
lea rcx, [0x1401399a0]
call fcn.14007a380
nop
test ebx, ebx
je 0x140056f33
mov rcx, qword [rsi + 0x340]
mov rax, qword [rcx]
mov r8d, r14d
lea rdx, [rsp + 0x60]
call qword [rax + 0x20]
mov rdx, rax
mov rcx, r15
call fcn.140011de0
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140056f33
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140056f2d
test cl, 0x1f
je 0x140056f00
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140056f0f
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140056f1e
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140056f2a
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140059940
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ebx, edx
call fcn.14005a070
mov rdi, rax
mov ecx, ebx
test rax, rax
je 0x1400599bf
call fcn.140053fc0
mov dword [rsp + 0x38], eax
lea r9, str.CClipboardRaw::SetClipboardDataUI
lea rax, str._clipboard__setClipboardData__format__u__oray_format__u
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r8, str...includes_sunloginincludeSynergyClipplatformclipClipboardRaw.cpp
mov edx, 1
mov dword [rsp + 0x20], 0x9c0
lea rcx, [0x1401399a0]
call fcn.14007a380
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x1400599ff
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.140053fc0
mov dword [rsp + 0x38], eax
lea r9, str.CClipboardRaw::SetClipboardDataUI
lea rax, str._clipboard__data_is_empty_so_empty_it__format__u__oray_format__u
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r8, str...includes_sunloginincludeSynergyClipplatformclipClipboardRaw.cpp
mov edx, 1
mov dword [rsp + 0x20], 0x9c6
lea rcx, [0x1401399a0]
call fcn.14007a380
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14005ed90
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
mov rax, qword [rcx + 0x80]
sub rcx, 0xffffffffffffff80
call qword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x60], rax
lea rax, [rdi + 0x70]
mov qword [rsp + 0x28], rax
xor esi, esi
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14005f090]
xor edx, edx
xor ecx, ecx
call fcn.1400b41dc
mov qword [rdi + 0x68], rax
or edx, 0xffffffff
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14005ee0d
cmp qword [rdi + 8], rsi
lea eax, [rsi + 1]
jne 0x14005ee0f
mov eax, esi
mov dword [rdi + 0x74], eax
test eax, eax
jne 0x14005ee29
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x60], rsi
mov dword [rdi + 0x74], esi
jmp 0x14005ee35
mov dword [rdi + 0x74], 1
mov esi, 1
mov rdx, qword [rdi + 0x80]
lea rcx, [rdi + 0x80]
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140060370
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, qword [rcx + 8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400603e7
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rbx
lea r9, str.CAutoClipboard::CAutoClipboard
mov qword [rsp + 0x38], rdi
lea r8, str...includes_sunloginincludeSynergyClipplatformclipClipboardViewWnd.cpp
mov dword [rsp + 0x30], eax
lea rcx, [0x1401399a0]
lea rax, str._clipboard__OpenClipboard_failed_with__d__current:_0x_x__open:0x_x
mov ebx, 1
mov qword [rsp + 0x28], rax
mov edx, ebx
mov dword [rsp + 0x20], 0x77
call fcn.14007a380
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400603e9
xor ebx, ebx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140076890
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14002ad80
nop
mov r8d, 4
lea rdx, str.log
lea rcx, [rsp + 0x28]
call fcn.14002dd30
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14007695e
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov qword [rsp + 0x60], 7
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov word [rsp + 0x48], r8w
cmp word [rdx], r8w
je 0x14007692b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140076920
lea rcx, [rsp + 0x48]
call fcn.140008a20
nop
lea rcx, [rsp + 0x48]
call fcn.14002a430
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14007695e
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140008b70
lea rcx, [rsp + 0x28]
call fcn.140076580
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x140076986
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140008b70
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14009d860
add rsp, 0x78
ret

Function at 0x1400769c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x140076a4d
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call fcn.1400a1560
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140076a4d
cmp dword [rsp + 0x38], edi
je 0x140076a49
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140076a2f
mov esi, dword [rsp + 0x50]
cmp rbx, 0xffffffffffffffff
je 0x140076a5c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140079010
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rsp + 0x30]
mov rdx, rax
call fcn.1400786d0
add rsp, 0x28
ret
Function at 0x14007c1c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rcx, rdx
je 0x14007c360
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, r8
mov r15, rdx
mov r14, rcx
lea rsi, [rcx + 0x28]
cmp rsi, rdx
je 0x14007c33b
xor r12d, r12d
mov rdi, rsi
movzx eax, word [rsi]
mov word [rsp + 0x28], ax
movzx eax, word [rsi + 2]
mov word [rsp + 0x2a], ax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x30]
call fcn.140009120
nop
mov rdx, r14
lea rcx, [rsp + 0x28]
call qword [rbp]
test al, al
je 0x14007c2a1
cmp r14, rsi
je 0x14007c288
lea rbx, [rsi + 0x30]
nop
sub rbx, 0x28
lea rdi, [rbx - 0x30]
movzx eax, word [rdi]
mov word [rbx - 8], ax
movzx eax, word [rbx - 0x2e]
mov word [rbx - 6], ax
lea rdx, [rbx - 0x28]
mov rcx, rbx
call fcn.14002dea0
cmp rdi, r14
jne 0x14007c260
movzx eax, word [rsp + 0x28]
mov word [r14], ax
movzx eax, word [rsp + 0x2a]
mov word [r14 + 2], ax
lea rcx, [r14 + 8]
jmp 0x14007c306
lea rbx, [rsi - 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [rbp]
test al, al
je 0x14007c2f1
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rdi], ax
movzx eax, word [rbx + 2]
mov word [rdi + 2], ax
lea rdx, [rbx + 8]
lea rcx, [rdi + 8]
call fcn.14002dea0
mov rdi, rbx
sub rbx, 0x28
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [rbp]
test al, al
jne 0x14007c2c0
movzx eax, word [rsp + 0x28]
mov word [rdi], ax
movzx eax, word [rsp + 0x2a]
mov word [rdi + 2], ax
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x30]
call fcn.14002dea0
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x14007c32e
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140008b70
add rsi, 0x28
cmp rsi, r15
jne 0x14007c210
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007e7b0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
movzx ebp, r9w
mov r12, qword [rsp + 0x60]
mov r14d, r8d
mov r15d, edx
mov qword [rdi], 0
mov byte [r12], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x14007e888
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x14007e84b
cmp word [rax + 0x12], 4
jne 0x14007e84b
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007e84b
nop word [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov ecx, r15d
mov edx, r14d
call fcn.14007e710
mov qword [rdi], rax
test rax, rax
je 0x14007e881
mov rcx, qword [rbx + 8]
lea rdi, [rax + 0x28]
add rbx, 8
test rcx, rcx
jne 0x14007e820
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r12
lea edx, [r9 + 1]
call fcn.1400b4478
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, 8
jmp 0x14007e862
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x14007e8a2
sub eax, 1
je 0x14007e8b0
sub eax, 1
je 0x14007e8a9
cmp eax, 1
mov eax, 0x2af9
jmp 0x14007e867
mov eax, 0x2afb
jmp 0x14007e867
mov eax, 0x2afa
jmp 0x14007e867
Function at 0x14007f130
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x140139f60], 0
lea rax, [0x14007ebc0]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
movzx ebp, cx
lea rax, [0x14007eed0]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.14007eb70]
mov qword [rsp + 0x48], rax
jne 0x14007f2fc
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14007f2f2
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1400b454c
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1400b45ac
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14007f224
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14007f284
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1400b454c
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1400b45ac
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14007f2ea
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14007f284
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14007f2ea
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x14007f2d9
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x14007f293
mov rax, qword [rsp + 0x28]
mov qword [0x140133b18], rax
mov rax, qword [rsp + 0x38]
mov qword [0x140133b28], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.14007eb70], rax
jmp 0x14007f2e2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x140139f60], 1
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x14007f330
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
lea rdi, [0x14013a1f0]
mov qword [rax + 8], rdi
mov qword [0x14013a208], 0xf
xor ebx, ebx
mov qword [0x14013a200], rbx
mov byte [0x14013a1f0], bl
mov qword [0x14013a218], rbx
mov qword [0x14013a220], rbx
call fcn.140083190
mov qword [0x14013a218], rax
mov qword [0x14013a228], rbx
mov qword [0x14013a230], rbx
call fcn.14003e510
mov qword [0x14013a228], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14013a238], eax
lea rax, vtable.CCrtSection.0
mov qword [0x14013a240], rax
lea rcx, [0x14013a248]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov byte [0x14013a270], bl
mov qword [0x14013a210], rbx
mov qword [0x14013a274], rbx
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x38], bl
lea r8d, [rbx + 0xf]
lea rdx, str.._dnscache.json
lea rcx, [rsp + 0x38]
call fcn.140009260
nop
lea rbx, [0x14013a240]
mov qword [rsp + 0x28], rbx
mov rcx, rbx
mov rax, qword [0x14013a240]
call qword [rax]
mov byte [rsp + 0x30], 1
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140009390
cmp qword [0x14013a200], 0
jne 0x14007f450
mov rcx, rbx
mov rax, qword [0x14013a240]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14007f479
mov dword [0x14013a274], 0x93a80
mov dword [0x14013a278], 0xe10
mov byte [0x14013a270], 1
mov rcx, rbx
mov rax, qword [0x14013a240]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x14007f4d2
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x14007f4cc
test cl, 0x1f
je 0x14007f49f
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14007f4ae
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x14007f4bd
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x14007f4c9
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
nop
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14007f730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rbp, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x50]
add rcx, 0x50
call qword [rax]
test rbp, rbp
je 0x14007f796
mov ecx, dword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14007f796
cmp rax, rbp
jne 0x14007f796
xor edx, edx
mov ecx, dword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14007f796
mov edx, 0x590
mov rcx, rdi
call fcn.14009de9c
nop
mov rax, qword [rsi + 0x50]
lea rcx, [rsi + 0x50]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400812c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140081325
mov ecx, 0x590
call fcn.14009dbb8
xor edx, edx
mov r8d, 0x590
mov rcx, rax
mov rbx, rax
call fcn.1400a1560
mov ecx, dword [rdi + 0x48]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140081325
mov edx, 0x590
mov rcx, rbx
call fcn.14009de9c
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140085c80
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
movzx eax, byte [rcx + 0x48]
test al, al
je 0x140085ca3
mov al, 1
jmp 0x140085d21
mov byte [rcx + 0x4b], dl
mov byte [rcx + 0x48], 1
mov byte [rcx + 0x49], 0
mov byte [rcx + 0x4a], 0
lea rdi, [rcx + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
cmp qword [rbx + 0x10], 0
je 0x140085ccb
movzx ebx, byte [rbx + 0x48]
jmp 0x140085d04
lea rdx, [rbx + 8]
movzx eax, byte [rbx + 0x4b]
neg al
sbb ecx, ecx
and ecx, 8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
mov r9, rbx
lea r8, [0x140085e40]
xor edx, edx
xor ecx, ecx
call fcn.1400b41dc
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140085d13
mov byte [rbx + 0x48], al
xor bl, bl
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
movzx eax, bl
jmp 0x140085d21
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
movzx eax, byte [rbx + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400878b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
test rdx, rdx
je 0x1400879ae
lea rbx, [0x1400e9810]
nop dword [rax + rax]
test r9, r9
je 0x1400879b7
movzx eax, byte [r10]
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [r8], al
sub r9, 1
je 0x1400879b7
sub rdx, 1
je 0x140087903
movzx r11d, byte [r10 + 1]
shr r11d, 4
jmp 0x140087906
xor r11d, r11d
movzx eax, byte [r10]
shl eax, 4
lea ecx, [r11 + rax]
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r8 + 1], al
sub r9, 1
je 0x1400879b7
test rdx, rdx
je 0x14008795d
sub rdx, 1
je 0x14008794a
movzx ecx, byte [r10 + 2]
movzx eax, byte [r10 + 1]
shr ecx, 6
lea ecx, [rcx + rax*4]
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
jmp 0x14008795f
movzx eax, byte [r10 + 1]
xor ecx, ecx
lea ecx, [rcx + rax*4]
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
jmp 0x14008795f
mov al, 0x3d
mov byte [r8 + 2], al
sub r9, 1
je 0x1400879b7
test rdx, rdx
je 0x14008797c
movzx eax, byte [r10 + 2]
and eax, 0x3f
movzx ecx, byte [rax + rbx]
jmp 0x14008797e
mov cl, 0x3d
mov byte [r8 + 3], cl
add r8, 4
sub r9, 1
je 0x1400879b7
test rdx, rdx
lea rax, [rdx - 1]
cmove rax, rdx
mov rdx, rax
lea rax, [r10 + 3]
test rdx, rdx
cmove rax, r10
mov r10, rax
jne 0x1400878d0
test r9, r9
je 0x1400879b7
mov byte [r8], 0
mov rbx, qword [rsp + 8]
ret
Function at 0x1400879c0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov rbx, qword [r9]
mov rdi, r9
mov r11, rbx
cmp rdx, 2
jb 0x140087ad9
mov qword [rsp + 0x10], rsi
lea r10, [rcx + 2]
lea rsi, [0x1400e9710]
nop dword [rax]
movzx eax, byte [r10 - 2]
movzx r9d, byte [rax + rsi]
test r9b, r9b
js 0x140087ad4
movzx eax, byte [r10 - 1]
movzx ecx, byte [rax + rsi]
test cl, cl
js 0x140087ad4
test r11, r11
je 0x140087a2c
sar cl, 4
shl r9b, 2
or cl, r9b
mov byte [r8], cl
inc r8
dec r11
cmp rdx, 2
je 0x140087ad4
movzx eax, byte [r10]
cmp al, 0x3d
jne 0x140087a54
cmp rdx, 4
jne 0x140087ad4
cmp byte [r10 + 1], al
jne 0x140087ad4
jmp 0x140087ac2
movzx eax, al
movzx r9d, byte [rax + rsi]
test r9b, r9b
js 0x140087ad4
test r11, r11
je 0x140087a82
movzx eax, byte [r10 - 1]
sar r9b, 2
movzx ecx, byte [rax + rsi]
shl cl, 4
or cl, r9b
mov byte [r8], cl
inc r8
dec r11
cmp rdx, 3
je 0x140087ad4
movzx eax, byte [r10 + 1]
cmp al, 0x3d
jne 0x140087a99
cmp rdx, 4
jne 0x140087ad4
jmp 0x140087ac2
movzx eax, al
movzx r9d, byte [rax + rsi]
test r9b, r9b
js 0x140087ad4
test r11, r11
je 0x140087ac2
movzx eax, byte [r10]
movzx ecx, byte [rax + rsi]
shl cl, 6
or cl, r9b
mov byte [r8], cl
inc r8
dec r11
add r10, 4
sub rdx, 4
cmp rdx, 2
jae 0x1400879f0
mov rsi, qword [rsp + 0x10]
sub rbx, r11
test rdx, rdx
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x18]
sete al
pop rdi
ret