joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005500
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000552e
xor eax, eax
jmp 0x14000561a
cmp qword [rcx + 0x68], 0
je 0x14000553f
call fcn.140005de0
jmp 0x14000561a
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005556
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005558
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000558a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1401c75d0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140005614
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400055c5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400055f0
mov r9, qword ds:[rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1401cce6c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140005614
cmp rsi, rbx
ja 0x1400055cc
test rsi, rsi
je 0x140005614
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1401cce6c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000b4e0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000b573
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x14029a8e8]
lea rsi, [0x14029a8e0]
and dword [rsp + 0x24], 0
mov edi, eax
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x14000b545
mov rcx, qword [0x14029a8e0]
mov edx, edi
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x14000b54a
test edi, edi
setne al
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
test al, 1
je 0x14000b573
cmp rax, 1
jne 0x14000b585
test edi, edi
setne al
test al, al
jne 0x14000b585
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rdx, [0x1402620f0]
lea rcx, [rsp + 0x20]
call fcn.14000b340
int3
Function at 0x14000bae0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1402a8d60], eax
test eax, eax
je 0x14000bb37
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14000bb58
mov rdx, qword [rbx + 8]
lea rcx, [fcn.140005cec]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x14000c640
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rax, [rcx + 0x28]
neg rcx
mov ecx, dword [0x1402a8d9c]
sbb rbx, rbx
and rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x14000c671
cmp qword [rax], rbx
je 0x14000c67b
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000c668
jmp 0x14000c726
mov rbx, qword ds:[rax + 8]
test rbx, rbx
je 0x14000c726
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x14000c6f7
cmp ecx, 1
jne 0x14000c726
lea rdx, [rbx + 0x58]
mov dword [rbx + 0x50], 2
lea rcx, [rbp - 0x50]
call fcn.1401c4770
xorps xmm0, xmm0
lea rax, vtable.boost::asio::multiple_exceptions.0
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x18]
movups xmmword [rbp - 0x28], xmm0
call fcn.1401c4770
lea rcx, [rbp - 0x50]
call fcn.1401c4850
lea rdx, ds:[rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.14002cde0
mov rdx, rax
lea rcx, [rbx + 0x58]
call fcn.1401c4768
lea rcx, [rbp - 0x40]
jmp 0x14000c721
lea rcx, [rbp - 0x50]
mov dword [rbx + 0x50], 1
call fcn.1401c47c4
lea rcx, [rbp - 0x50]
call fcn.1401c47d0
lea rcx, [rbx + 0x58]
lea rdx, [rbp - 0x50]
call fcn.1401c4768
lea rcx, [rbp - 0x50]
call fcn.1401c4850
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14000ce80
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov rsi, r9
mov r14, rdx
mov rdi, rcx
mov ebx, r15d
cmp rcx, 0xffffffffffffffff
je 0x14000cf87
test r8b, r8b
je 0x14000cefd
mov al, byte [rdx]
test al, 8
je 0x14000cefd
or al, 8
mov dword [rbp + 0x20], r15d
mov byte [rdx], al
lea r9, [rbp + 0x20]
xorps xmm0, xmm0
mov qword [rbp - 0x10], r15
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x20]
setne dl
call fcn.14000cda0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.14000cda0
test ebx, ebx
je 0x14000cf87
mov edx, 0x2733
lea rcx, [rbp - 0x20]
call fcn.14002cf20
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.14000aa20
test al, al
jne 0x14000cf55
mov edx, 0x4d5
lea rcx, [rbp - 0x20]
call fcn.14002cf20
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.14000aa20
test al, al
je 0x14000cf87
lea r8, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.14000cda0
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000cfc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea r9, [rsp + 0x68]
and qword [rax - 0x20], 0
and dword [rax + 0x20], 0
and dword [rax + 0x18], 0
lea rax, [rax + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rbx, qword [rsp + 0x70]
mov dl, 1
mov rcx, rbx
mov esi, eax
call fcn.14000cda0
mov r9, qword ds:[rbx + 0x10]
lea rdi, [rbx + 8]
movabs r10, 0x4800144005b3
cmp r9, 1
je 0x14000d02d
mov ecx, dword [rbx]
mov r8d, ecx
jmp 0x14000d05c
mov rcx, qword [rdi]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
nop dword [rax]
cmp ecx, 0x40
jne 0x14000d06c
mov edx, 0x2746
jmp 0x14000d0af
cmp r9, 1
je 0x14000d077
mov eax, r8d
jmp 0x14000d0a3
mov rcx, qword [rdi]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x4d2
jne 0x14000d0b9
mov edx, 0x274d
mov rcx, rbx
call fcn.14002cfb8
jmp 0x14000d132
cmp r9, 1
je 0x14000d0c4
mov eax, r8d
jmp 0x14000d0f0
mov rcx, qword [rdi]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x2738
je 0x14000d13b
cmp r9, 1
jne 0x14000d129
mov rcx, qword [rdi]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0xea
je 0x14000d13b
test esi, esi
je 0x14000d13b
or eax, 0xffffffff
jmp 0x14000d169
cmp qword [rbx + 0x10], 0
jne 0x14000d14b
lea r8, [0x14029a8e0]
jmp 0x14000d15c
cmp qword [rbx + 0x10], 1
lea r8, [0x14029a8c8]
je 0x14000d15c
mov r8, qword [rdi]
mov rcx, rbx
call fcn.14000a9a0
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000d180
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1402998f8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, qword [rbp + 0x200]
mov rax, r9
mov qword [rsp + 0x48], rax
mov r13, r8
mov r12b, dl
mov r15, rcx
cmp rcx, 0xffffffffffffffff
jne 0x14000d1e5
mov edx, 0x2719
mov rcx, rdi
call fcn.14002cfb8
xor eax, eax
jmp 0x14000d367
mov r14b, r12b
and r14b, 0x10
cmp byte [rbp + 0x1f8], 0
je 0x14000d22b
test r14b, r14b
je 0x14000d22b
cmp qword ds:[rdi + 0x10], 0
jne 0x14000d20b
lea r8, [0x14029a8e0]
jmp 0x14000d221
mov esi, 1
lea r8, [0x14029a8c8]
cmp qword [rdi + 0x10], rsi
je 0x14000d221
mov r8, qword [rdi + 8]
mov rcx, rdi
call fcn.14000a9a0
jmp 0x14000d1db
mov esi, 1
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, r13
mov rcx, r15
call fcn.14000cfc0
test r14b, r14b
je 0x14000d252
test eax, eax
je 0x14000d2f7
test eax, eax
jns 0x14000d365
nop word [rax + rax]
test sil, r12b
jne 0x14000d1db
mov edx, 0x2733
lea rcx, [rsp + 0x30]
call fcn.14002cf20
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000aa20
test al, al
jne 0x14000d2ad
mov edx, 0x4d5
lea rcx, [rsp + 0x50]
call fcn.14002cf20
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000aa20
test al, al
je 0x14000d1db
and qword [rsp + 0x20], 0
lea ecx, [r15 + 1]
xor r9d, r9d
mov qword [rsp + 0x78], r15
xor r8d, r8d
mov dword [rsp + 0x70], esi
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
mov rcx, rdi
mov ebx, eax
sets dl
call fcn.14000cda0
test ebx, ebx
js 0x14000d1db
mov rax, qword [rsp + 0x48]
jmp 0x14000d230
and dword [rsp + 0x34], 0
lea rbx, [0x14029a710]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x14029a718]
cmp rcx, rsi
jbe 0x14000d32e
mov rax, qword [0x14029a710]
mov edx, 2
mov rcx, rbx
call qword [rax + 0x30]
mov sil, al
movzx eax, sil
mov dword [rsp + 0x30], 2
add rax, 2
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x14000d1db
cdqe
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1401c17d0
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d3a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea r9, [rax + 0x20]
and qword [rax - 0x20], 0
and dword [rax - 0x28], 0
mov rbx, qword [rsp + 0x70]
and dword [rax + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov dl, 1
mov rcx, rbx
mov edi, eax
call fcn.14000cda0
cmp qword [rbx + 0x10], 1
movabs r9, 0x4800144005b3
je 0x14000d3f5
mov ecx, dword [rbx]
mov r8d, ecx
jmp 0x14000d425
mov rcx, qword [rbx + 8]
mov rax, r9
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x14000d431
mov edx, 0x2746
jmp 0x14000d473
cmp qword [rbx + 0x10], 1
jne 0x14000d465
mov rcx, qword [rbx + 8]
mov rax, r9
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14000d47b
mov edx, 0x274d
mov rcx, rbx
call fcn.14002cfb8
test edi, edi
je 0x14000d484
or eax, 0xffffffff
jmp 0x14000d4b2
cmp qword [rbx + 0x10], 0
jne 0x14000d494
lea r8, [0x14029a8e0]
jmp 0x14000d4a6
cmp qword [rbx + 0x10], 1
lea r8, [0x14029a8c8]
je 0x14000d4a6
mov r8, qword [rbx + 8]
mov rcx, rbx
call fcn.14000a9a0
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140023280
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1402998f8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
mov ecx, 1
call fcn.140037d34
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400232dc
mov rcx, rax
call fcn.140005cf4
mov rdi, rax
jmp 0x1400232de
xor edi, edi
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1401c7c80
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14002340c
and qword [rbp + 0x170], 0
and qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0xf
mov byte [rbp + 0x170], 0
lea r8, [rsp + 0x5c]
lea rdx, [rbp + 0x170]
call fcn.140007534
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14002335f
mov rdx, qword [rbx]
lea rcx, ds:[rbp + 0x170]
cmp qword [rbp + 0x188], 0x10
cmovae rcx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
cmp r8, qword [rbx + 0x10]
jne 0x1400233b1
call fcn.1401c7e20
test eax, eax
jne 0x1400233b1
mov r8d, dword ds:[rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov esi, eax
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x140023405
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400233fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002344e
nop
call fcn.1400378bc
test esi, esi
jmp 0x140023319
test rdi, rdi
je 0x14002341f
mov edx, 1
mov rcx, rdi
call fcn.1400378bc
nop
mov rcx, rbx
call fcn.140006640
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1401c17d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1401cd660
nop
int3
Function at 0x1400281e0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1f0
mov rax, qword [0x1402998f8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov bl, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1402a8d90], eax
inc eax
cmp eax, 1
jne 0x140028231
lea ecx, [rax + 1]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1402a8d94], eax
test bl, bl
je 0x140028293
xor ebx, ebx
lock xadd dword [0x1402a8d94], ebx
test ebx, ebx
je 0x140028293
and dword [rsp + 0x24], 0
lea rsi, [0x14029a8e0]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x14029a8e8]
cmp rcx, 1
jbe 0x140028278
mov rax, qword [0x14029a8e0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14002827a
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
test al, 1
jne 0x1400282bb
mov rax, rdi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1401c17d0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.14000b340
int3
Function at 0x14002ff60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rbx, qword [rcx + 0x18]
xor eax, eax
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x14002ff93
mov rcx, rbx
call fcn.14000c560
jmp 0x140030045
and dword ds:[rbp + 0x37], 0
lea rcx, [rbp + 0x3f]
call fcn.1401c47c4
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rbp - 0x19]
call fcn.1401c7c80
nop
mov rax, rbx
lea rdx, [rbx + 0x28]
neg rax
sbb rcx, rcx
and rcx, rdx
mov qword [rbp - 0x49], rcx
lea rax, [rbp - 0x19]
mov qword [rbp - 0x41], rax
mov ecx, dword [0x1402a8d9c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x49]
mov ecx, dword [0x1402a8d9c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r9, ds:[rbp - 0x31]
lea r8, [rbp - 0x19]
mov rcx, rbx
call fcn.14000c740
test rax, rax
jne 0x14002fff2
mov rdx, qword [rbp - 0x39]
mov ecx, dword [0x1402a8d9c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp - 0x19]
mov edi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x140030031
call fcn.140037d7c
add rbx, 8
sub rdi, 1
jne 0x140030024
lea rcx, ds:[rbp + 0x3f]
call fcn.1401c4850
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140036580
Capabilities:
Connect socket
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1402998f8]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rsi, qword [r8]
mov r14, rdx
mov rdi, qword [rbp + 0x3d0]
mov ebx, 0x2719
mov r12d, 2
cmp rsi, 0xffffffffffffffff
jne 0x1400365d6
mov edx, ebx
mov rcx, rdi
call fcn.14002cfb8
jmp 0x140036605
cmp word [r9], r12w
mov eax, 0x1c
mov rdx, r9
mov rcx, rsi
lea r8d, [rax - 0xc]
cmovne r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
setne dl
call fcn.14000cda0
mov edx, 0x2734
lea rcx, [rsp + 0x38]
call fcn.14002cf20
lea rdx, ds:[rsp + 0x38]
mov rcx, rdi
call fcn.14000aa20
test al, al
jne 0x14003664d
mov edx, 0x2733
lea rcx, [rsp + 0x38]
call fcn.14002cf20
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14000aa20
test al, al
je 0x140036769
cmp rsi, 0xffffffffffffffff
jne 0x140036665
mov edx, ebx
mov rcx, rdi
call fcn.14002cfb8
nop dword [rax]
jmp 0x140036769
and qword ss:[rsp + 0x20], 0
lea ecx, [rsi + 1]
lea r9, [rsp + 0x50]
mov qword [rbp + 0x168], rsi
lea r8, [rbp + 0x160]
mov dword [rbp + 0x160], 1
xor edx, edx
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
mov rcx, rdi
mov ebx, eax
sets dl
call fcn.14000cda0
test ebx, ebx
js 0x140036769
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x34], 4
mov r8d, 0x1007
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14000cda0
nop dword [rax]
cmp ebx, 0xffffffff
je 0x140036769
and dword [rsp + 0x3c], 0
lea rsi, [0x14029a8e0]
mov ebx, dword [rsp + 0x30]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x14029a8e8]
cmp rcx, 1
jbe 0x14003673d
mov rax, qword [0x14029a8e0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140036742
test ebx, ebx
setne al
movzx eax, al
mov dword [rsp + 0x38], ebx
add rax, r12
mov qword [rsp + 0x40], rsi
movups xmm0, xmmword [rsp + 0x38]
mov qword [rsp + 0x48], rax
movsd xmm1, qword [rsp + 0x48]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
movups xmm0, xmmword [rdi]
mov rax, r14
movups xmmword [r14], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [r14 + 0x10], xmm1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1401c17d0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037340
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003736c
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140037367
mov rax, qword [rcx]
xor edx, edx
call rax
nop
and qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400373b7
mov ecx, dword [0x1402a8d9c]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400373aa
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400373aa
xor edx, edx
xor eax, eax
cmp qword [rcx + rax*8], 0
je 0x1400373c2
inc edx
inc rax
cmp rax, 2
jl 0x140037398
mov rcx, rbx
call fcn.140037d7c
and qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x1400373b2

Function at 0x140037c34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x14003b57b
cmp dword [rcx + 0xe8], 0
jne 0x14003b57b
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.1400413a0
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14003b8e8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x14003b93d
call fcn.14003f6dc
mov rdx, rax
test rax, rax
je 0x14003b93b
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x14005c10a.0]
mov rbx, rax
jmp 0x14003b93d
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14003b650
Function at 0x140039f6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140039fe3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140039fe3
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140039fd0
cmp rbx, rcx
jae 0x140039fe3
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140039fbb
cmp rbx, rcx
jae 0x140039fe3
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x140039fe5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003a874
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14003a8ef
xor r8d, r8d
call fcn.14003ab44
mov rsi, rax
test rax, rax
je 0x14003a8eb
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14003a8eb
mov eax, dword [rsp + 0x30]
jmp 0x14003a905
mov eax, edi
jmp 0x14003a905
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret