joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x14002a9aa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14002a9c3
add rax, 8
jmp 0x14002aa5a
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14002a9a1
je 0x14002a9df
test rsi, rsi
je 0x14002a9e3
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x14002a9e5
mov rdi, qword [rsi + 8]
jmp 0x14002a9e5
xor eax, eax
jmp 0x14002aa5a
xor edi, edi
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14002aa82
mov rbx, rax
mov rsi, rax
lea rax, [0x1401230c8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x14002aa62
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x14002aa72
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14002aa57
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
jmp 0x14002aa21
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
jmp 0x14002aa35
ud2
Function at 0x1400305a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov r12, qword [rsp + 0xb0]
mov rax, qword [rcx]
bswap rax
mov qword [rsp + 0x38], rcx
mov rbx, qword [rcx + 8]
bswap rbx
test r12, r12
je 0x1400306de
mov rdi, r9
shl r12, 4
add r12, r9
mov rcx, qword [rsp + 0x30]
xor rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
nop word cs:[rax + rax]
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
bswap r14
xor r14, rax
bswap r15
xor r15, rbx
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400302f0
mov r13, rax
mov rbx, rdx
mov rcx, r14
mov rdx, qword [rsp + 0x28]
call fcn.1400302f0
mov rbp, rax
mov rsi, rdx
xor r15, r14
mov rcx, r15
mov rdx, qword [rsp + 0x40]
call fcn.1400302f0
mov rcx, r13
shl rcx, 0x3f
mov r8, r13
shl r8, 0x3e
xor r8, rcx
mov r9, r13
shl r9, 0x39
xor r9, rax
xor r9, r8
xor rbx, r13
mov rcx, rbx
xor rcx, rbp
xor rcx, r9
mov r8, r13
shr r8, 1
mov rax, rcx
shr rax, 1
mov r9, rcx
mov r11, rcx
shr r11, 2
xor r11, rax
mov r10, rcx
mov rax, rcx
shr rax, 7
xor rax, rsi
xor rax, r11
xor rax, rcx
shl rcx, 0x3f
mov r11, r13
shr r11, 2
xor r11, r8
shl r9, 0x3e
shr r13, 7
shl r10, 0x39
xor r10, r9
xor r13, rdx
xor r13, r11
xor r13, rcx
xor r13, r10
xor rbx, rsi
xor rbx, rbp
xor rbx, r13
add rdi, 0x10
cmp rdi, r12
jne 0x140030600
bswap rax
bswap rbx
mov ecx, eax
shr ecx, 0x10
mov edx, eax
shr edx, 0x18
mov r8, rax
shr r8, 0x20
mov r9, rax
shr r9, 0x28
mov r10, rax
shr r10, 0x30
mov r11, rax
shr r11, 0x38
mov esi, ebx
shr esi, 0x10
mov edi, ebx
shr edi, 0x18
mov r14, rbx
shr r14, 0x20
mov r15, rbx
shr r15, 0x28
mov r12, rbx
shr r12, 0x30
mov r13, rbx
shr r13, 0x38
mov rbp, qword [rsp + 0x38]
mov byte [rbp], al
mov byte [rbp + 1], ah
mov byte [rbp + 2], cl
mov byte [rbp + 3], dl
mov byte [rbp + 4], r8b
mov byte [rbp + 5], r9b
mov byte [rbp + 6], r10b
mov byte [rbp + 7], r11b
mov byte [rbp + 8], bl
mov byte [rbp + 9], bh
mov byte [rbp + 0xa], sil
mov byte [rbp + 0xb], dil
mov byte [rbp + 0xc], r14b
mov byte [rbp + 0xd], r15b
mov byte [rbp + 0xe], r12b
mov byte [rbp + 0xf], r13b
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140034210
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov al, 1
test rdx, rdx
je 0x14003431e
movzx r9d, byte [rcx]
mov r10, qword [r8]
movzx r10d, byte [r10]
not r10b
test r9b, r10b
jne 0x14003431e
mov r10, qword [r8 + 0x10]
test r10, r10
je 0x140034324
mov r8, qword [r8 + 8]
xor byte [r8], r9b
mov r11d, 1
cmp r10, 1
je 0x140034318
lea rbx, [rdx - 1]
lea rdi, [r10 - 2]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [r8 + 1]
inc rsi
cmp rsi, 0x10
jbe 0x1400342ee
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x14003429e
add rdi, r8
add rdi, 2
lea rbx, [rcx + 1]
cmp rbx, rdi
jb 0x1400342ee
mov r11d, esi
and r11d, 0xf
mov r14d, 0x10
cmovne r14, r11
mov rdi, rsi
sub rdi, r14
lea rbx, [r9 + rdi]
neg r14
lea r11, [rsi + r14]
inc r11
xor esi, esi
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + rsi + 1]
movups xmm1, xmmword [r9 + rsi]
xorps xmm1, xmm0
movups xmmword [r9 + rsi], xmm1
add rsi, 0x10
cmp rdi, rsi
jne 0x1400342d0
mov r9, rbx
add r8, r10
nop word cs:[rax + rax]
cmp rdx, r11
je 0x14003431e
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, r8
jne 0x140034300
cmp r11, rdx
setne al
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x140036dc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x140036ea5
mov rax, rsi
shr rax, 0x3c
jne 0x140036ea5
mov rdi, rcx
mov rbx, qword [rcx]
lea rdx, [rsi*8]
mov ecx, 8
call fcn.140089d40
test rax, rax
je 0x140036ea5
mov r14, rax
xor eax, eax
cmp rsi, 4
jb 0x140036e62
mov rcx, r14
sub rcx, rbx
cmp rcx, 0x20
jb 0x140036e62
mov rax, rsi
and rax, 0xfffffffffffffffc
xor ecx, ecx
pcmpeqd xmm0, xmm0
nop word [rax + rax]
movdqu xmm1, xmmword [rbx + rcx*8]
movdqu xmm2, xmmword [rbx + rcx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r14 + rcx*8], xmm1
movdqu xmmword [r14 + rcx*8 + 0x10], xmm2
add rcx, 4
cmp rax, rcx
jne 0x140036e30
cmp rsi, rax
je 0x140036eee
mov rdx, rsi
mov rcx, rax
and rdx, 3
je 0x140036e97
mov r8, rax
nop word cs:[rax + rax]
lea rcx, [r8 + 1]
mov r9, qword [rbx + r8*8]
not r9
mov qword [r14 + r8*8], r9
mov r8, rcx
dec rdx
jne 0x140036e80
sub rax, rsi
cmp rax, 0xfffffffffffffffc
jbe 0x140036eb0
test rsi, rsi
jne 0x140036eee
ud2
mov rax, qword [rbx + rcx*8]
not rax
mov qword [r14 + rcx*8], rax
mov rax, qword [rbx + rcx*8 + 8]
not rax
mov qword [r14 + rcx*8 + 8], rax
mov rax, qword [rbx + rcx*8 + 0x10]
not rax
mov qword [r14 + rcx*8 + 0x10], rax
mov rax, qword [rbx + rcx*8 + 0x18]
not rax
mov qword [r14 + rcx*8 + 0x18], rax
lea rax, [rcx + 4]
mov rcx, rax
cmp rsi, rax
jne 0x140036eb0
or byte [r14], 1
mov r15, rsi
shl r15, 6
sub r15, qword [rdi + 0x20]
je 0x140036f36
mov rax, qword [r14 + rsi*8 - 8]
mov ecx, r15d
shl rax, cl
shr rax, cl
mov qword [r14 + rsi*8 - 8], rax
cmp r15, 1
adc r15, 0
nop word [rax + rax]
mov rcx, r14
mov rdx, r14
mov r8, rbx
mov r9, rsi
call fcn.14010ce90
dec r15
jne 0x140036f20
mov r15d, 1
nop dword [rax]
mov rcx, r14
mov rdx, r14
mov r8, rbx
mov r9, rsi
call fcn.14010ce90
cmp rsi, r15
je 0x140036f5b
inc r15
jmp 0x140036f40
add rdi, 0x10
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r14
mov r8, r14
mov r9, rbx
call fcn.1400dc180
mov rax, r14
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003e1e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 8], r8
jne 0x14003e295
mov rsi, r8
test r8, r8
je 0x14003e295
mov rdi, rdx
mov rbx, qword [rcx]
xor eax, eax
cmp rsi, 4
jb 0x14003e260
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x20
jb 0x14003e260
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x14003e230
cmp rax, rsi
je 0x14003e2de
mov r8, rsi
mov rdx, rax
and r8, 3
je 0x14003e287
mov r9, rax
nop
lea rdx, [r9 + 1]
mov r10, qword [rbx + r9*8]
not r10
mov qword [rdi + r9*8], r10
mov r9, rdx
dec r8
jne 0x14003e270
sub rax, rsi
cmp rax, 0xfffffffffffffffc
jbe 0x14003e2a0
test rsi, rsi
jne 0x14003e2de
ud2
mov rax, qword [rbx + rdx*8]
not rax
mov qword [rdi + rdx*8], rax
mov rax, qword [rbx + rdx*8 + 8]
not rax
mov qword [rdi + rdx*8 + 8], rax
mov rax, qword [rbx + rdx*8 + 0x10]
not rax
mov qword [rdi + rdx*8 + 0x10], rax
mov rax, qword [rbx + rdx*8 + 0x18]
not rax
mov qword [rdi + rdx*8 + 0x18], rax
lea rax, [rdx + 4]
mov rdx, rax
cmp rsi, rax
jne 0x14003e2a0
or byte [rdi], 1
mov r14, rsi
shl r14, 6
sub r14, qword [rcx + 0x20]
je 0x14003e326
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.14010ce90
dec r14
jne 0x14003e310
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14004c5c0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x14004c629
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x14004c5e8
add rdi, rbx
sub rsi, rbx
je 0x14004c629
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x14004c5e0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14004c5e0
test ebp, 0x7fffffff
setne al
jmp 0x14004c62b
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140070120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x14007014f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140070168
add rax, 8
jmp 0x140070219
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140070146
je 0x140070217
test rsi, rsi
je 0x140070184
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x1400701a0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x1401bb111]
mov edx, 0x18
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140070246
mov rbx, rax
mov rsi, rax
lea rax, [0x140123108]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x140070226
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x140070236
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140070212
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x140070219
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x1400701dc
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x1400701f0
ud2
Function at 0x14007f5d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r9
mov rdx, rax
call fcn.140083e90
cmp byte [rbx], 0
jne 0x14007f612
lea rdx, [0x140146d58]
mov r8d, 3
mov rcx, rsi
call fcn.140084f70
movabs rbx, 0x8000000000000000
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140088800
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
cmp r15, rbx
jne 0x14007f64d
mov rcx, rbx
mov rdx, r14
call fcn.14007f6c0
mov qword [rdi], rbx
jmp 0x14007f685
mov r12, qword [rsp + 0x30]
mov rcx, r14
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14007f66c
mov qword [rdi], r15
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r12
jmp 0x14007f685
mov qword [rdi], rbx
test r15, r15
je 0x14007f685
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, r14
call fcn.1400fda74
cmp qword [rsi], 0
je 0x14007f6aa
mov r8, qword [rsi + 8]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400fda74
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140081230
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov eax, 1
test rcx, rcx
jne 0x1400812dd
mov rax, qword [0x1401bb0d0]
cmp rax, 3
jne 0x140081303
mov rsi, rdx
movzx ecx, word [rdx]
call fcn.14008a350
test rax, rax
je 0x14008126c
mov eax, 1
jmp 0x1400812dd
cmp word [rsi], 0
je 0x14008128e
movups xmm0, xmmword [rsi + 4]
mov eax, dword [rsi + 0x14]
mov r9d, dword [rsi + 0x18]
movzx ecx, word [rsi + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x1400812a3
mov eax, dword [rsi + 2]
movzx ecx, word [rsi + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r10w, 2
rol cx, 8
mov word [rsp + 0x2c], r10w
mov word [rsp + 0x2e], cx
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x44], r9d
lea rax, [rsp + 0x2c]
mov rsi, rdx
mov rcx, rdx
mov rdx, rax
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
je 0x1400812e4
xor eax, eax
mov rdx, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov rdx, rdi
jmp 0x140081265
mov rsi, rdx
call fcn.140085350
mov rdx, rsi
jmp 0x140081255

Function at 0x140081320
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rcx, rax
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x1400813c6
mov eax, dword [rsp + 0x28]
movzx ecx, word [rsp + 0x40]
cmp ecx, 0x17
je 0x1400813d5
cmp ecx, 2
jne 0x140081421
cmp eax, 0xf
jbe 0x14008143a
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xc0
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x140081428
cmp eax, 0x1b
jbe 0x14008143a
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x30], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rsp + 0x2e]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rsp + 0x3e]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xc0
pop rsi
ret
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xc0
pop rsi
ret
ud2
Function at 0x1400819b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x140123018]
test ecx, ecx
je 0x1400819d7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400819f0
add rax, 8
jmp 0x140081a8b
lea rcx, section..data
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400819ce
je 0x140081a89
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140081ab3
mov rbx, rax
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140123018]
test ecx, ecx
je 0x140081a93
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123018]
test ecx, ecx
je 0x140081aa3
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140081a84
mov rax, qword [rdi + 8]
test rax, rax
je 0x140081a73
lock dec qword [rax]
jne 0x140081a73
mov rcx, qword [rdi + 8]
call fcn.1400b6910
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x140081a8b
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, section..data
call fcn.140082430
mov ecx, eax
jmp 0x140081a36
lea rcx, section..data
call fcn.140082430
mov ecx, eax
jmp 0x140081a4a
ud2

Function at 0x140081d60
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140081dbe
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140081dbe
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140081dbe
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140081dbe
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140081dfe
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140081dec
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x140146df0]
add rsp, 0x38
ret

Function at 0x140081e10
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140081e6e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140081e6e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140081e6e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140081e6e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140081eae
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140081e9c
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x140146df0]
add rsp, 0x38
ret
Function at 0x140082430
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400824b5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x1400824ec
cmp dword [rsp + 0x2c], 0
je 0x1400824dd
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400824ee
mov edi, eax
mov rax, qword [0x1401be038]
mov rax, qword [0x1401bb0c0]
nop dword [rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401bb0c0], rsi
jne 0x140082490
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400824e2
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400824ec
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x1400824e2
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x1400824e2
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2

Function at 0x1400838e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
movzx r8d, byte [rdx + 0x3a]
test r8b, r8b
setne al
cmp r9b, 1
ja 0x140083962
test r8b, r8b
jne 0x14008393a
movzx esi, byte [rdx + 0x10]
lea r8d, [rsi - 5]
cmp r8b, 1
ja 0x14008393a
mov r10, qword [rdx]
mov r8, qword [rdx + 8]
mov eax, dword [rdx + 8]
xor eax, eax
xor r8d, r8d

Function at 0x140087890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140123038]
test ecx, ecx
je 0x1400878ba
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400878d3
add rax, 8
jmp 0x140087968
lea rcx, [0x140123020]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400878b1
je 0x140087966
xor edi, edi
test rsi, rsi
je 0x1400878ef
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, edi
mov edi, eax
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140087990
mov rbx, rax
mov rsi, rax
lea rax, [0x140123020]
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov ecx, dword [0x140123038]
test ecx, ecx
je 0x140087970
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123038]
test ecx, ecx
je 0x140087980
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140087961
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x140087968
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123020]
call fcn.140082430
mov ecx, eax
jmp 0x14008792b
lea rcx, [0x140123020]
call fcn.140082430
mov ecx, eax
jmp 0x14008793f
ud2
Function at 0x140088c70
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov ebx, 2
xor r14d, r14d
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x140088d00
jmp 0x140088cdf
jae 0x140088da3
cmp r8, 0x201
jae 0x140088d00
mov edi, 0x200
lea r12, [rsp + 0x88]
mov r13, r8
jmp 0x140088d29
sub r8, r15
mov rax, r14
sub rax, r15
cmp r8, rax
ja 0x140088d87
cmp r14, rsi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x38], r15
mov rdi, r15
mov r12, rbx
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x140088d4e
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140088e33
mov r8d, ebp
cmp r13, r8
jne 0x140088cd0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140088ef1
add r13, r13
cmp r13, rsi
cmovae r13, rsi
mov r8, r13
cmp r8, 0x201
jb 0x140088cdf
jmp 0x140088d00
lea rcx, [rsp + 0x28]
mov rdx, r15
call fcn.1400d4920
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
jmp 0x140088d0e
cmp rdi, r8
jb 0x140088ef1
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, r12
call fcn.1400874d0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.140083e90
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x140088df1
lea rdx, [0x140146d58]
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.140084f70
movabs rdi, 0x8000000000000000
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.140088800
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
cmp rsi, rdi
jne 0x140088e61
mov rcx, rdi
mov rdx, rbx
call fcn.14007f6c0
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
jmp 0x140088ea6
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rcx], rax
test r14, r14
jne 0x140088ec9
jmp 0x140088edc
mov r14, qword [rsp + 0x80]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x140088e88
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x140088ea6
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
test rsi, rsi
je 0x140088ea6
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rbx
call fcn.1400fda74
cmp qword [rsp + 0x50], 0
je 0x140088ec1
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
call fcn.1400fda74
cmp qword [rsp + 0x28], 0
je 0x140088edc
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
call fcn.1400fda74
nop
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2