joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400394ec
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x14004a780]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rdx, [0x14004af00]
mov ecx, 0x20
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
jge 0x140039525
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov r8d, 0x40
xor edx, edx
lea rcx, [0x14004aea0]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x14004aef4]
mov dword [0x14004aea0], eax
mov eax, dword [0x14004aef8]
mov dword [0x14004aea4], eax
mov dword [0x14004aea8], 0x15
mov dword [0x14004aeb4], 0
mov dword [0x14004aed0], 0x50
mov dword [0x14004aeb8], 1
mov dword [0x14004aecc], 1
mov rax, qword [0x14004b830]
mov qword [0x14004aec0], rax
mov dword [0x14004aec8], 1
mov rax, qword [0x14004af00]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [0x14004b838]
mov qword [rsp + 0x30], rax
lea rax, [0x14004aea0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x20
mov r9, qword [0x14004b830]
mov r8d, 1
xor edx, edx
mov rcx, qword [0x14004af00]
call qword [rsp + 0x50]
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x10
mov r9d, 8
mov r8d, 0x3a0
mov edx, 0x1548
lea rcx, str.1.67_WIP
call fcn.140006e44
xor ecx, ecx
call fcn.140006aa8
call fcn.1400089d0
mov qword [rsp + 0x48], rax
mov rcx, qword [0x14004b830]
call fcn.14001e5f8
mov rcx, qword [0x14004b838]
call fcn.14001dcc4
xor ecx, ecx
call fcn.140016708
call fcn.140008e64
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x140043880]
movss xmm1, dword [0x140043880]
lea rcx, [rsp + 0x70]
call fcn.14002d5a8
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x14], rax
mov rax, qword [rsp + 0x40]
xorps xmm0, xmm0
movss dword [rax + 0x10], xmm0
lea rdx, str.C:WindowsFontsBahnschrift.ttf
lea rcx, [rsp + 0x78]
call fcn.14002c364
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x98]
call fcn.140014260
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x78]
call fcn.140036974
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
movss xmm2, dword [0x140043878]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140011bec
mov qword [0x14004ae48], rax
mov rax, qword [0x14004af00]
mov rax, qword [rax]
mov rcx, qword [0x14004af00]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14003a520
add rsp, 0xb8
ret
Function at 0x14003ac20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003ac6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ac6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ac6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ac6a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ac6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003ac6c
xor al, al
add rsp, 0x28
ret
Function at 0x35e041420
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, rdx
mov rax, qword [rax + 0x20]
mov rsi, qword [rax]
mov r11, qword [rsi - 0x10]
lea r10, [rsi - 0x10]
cmp r11, rsi
je 0x35e04149c
nop dword [rax]
mov rax, qword [r10 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x35e041491
mov edx, 0xe0e
nop dword [rax]
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x35e041470
cmp edx, 0x18cf5f14
je 0x35e0414ae
mov r10, r11
mov r11, qword [r10]
cmp r11, rsi
jne 0x35e041458
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, dword [r10 + 0x40]
mov r12, qword [r10 + 0x30]
mov r13d, eax
sub r13d, r8d
cmp eax, r8d
je 0x35e04149c
mov ebp, r8d
xor esi, esi
nop word cs:[rax + rax]
lea rdi, [r12 + rsi]
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x35e04149e
add rsi, 1
cmp esi, r13d
jb 0x35e0414d0
jmp 0x35e04149c
Function at 0x35e041990
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
mov rax, rcx
lea rcx, [rcx + 0xf]
sub rcx, rdx
cmp rcx, 0x1e
jbe 0x35e041a74
movdqu xmm1, xmmword [rdx]
movups xmmword [rax], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm0
movzx edi, byte [rax + 0x1f]
mov r10d, 8
movzx r9d, byte [rax + 0x1e]
lea r11, [0x35e103120]
movzx r8d, byte [rax + 0x1d]
lea rbx, section..rdata
movzx edx, byte [rax + 0x1c]
jmp 0x35e041a39
movzx r8d, r8b
movzx edx, dl
movzx ecx, byte [r11 + r8]
movzx r8d, r9b
movzx r9d, dil
movzx edi, byte [r11 + rdx]
mov edx, r10d
shr edx, 3
movzx r8d, byte [r11 + r8]
xor cl, byte [rbx + rdx]
movzx r9d, byte [r11 + r9]
mov edx, ecx
xor dl, byte [rax]
add r10d, 1
add rax, 4
xor r8b, byte [rax - 3]
xor r9b, byte [rax - 2]
xor dil, byte [rax - 1]
mov byte [rax + 0x1c], dl
mov byte [rax + 0x1d], r8b
mov byte [rax + 0x1e], r9b
mov byte [rax + 0x1f], dil
cmp r10d, 0x3c
je 0x35e041a70
mov ecx, r10d
and ecx, 7
je 0x35e0419e0
cmp ecx, 4
jne 0x35e041a0e
movzx edx, dl
movzx r8d, r8b
movzx esi, r9b
movzx ecx, dil
movzx edx, byte [r11 + rdx]
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + rsi]
movzx edi, byte [r11 + rcx]
jmp 0x35e041a0e
pop rbx
pop rsi
pop rdi
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 2]
mov byte [rax + 2], cl
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
movzx ecx, byte [rdx + 4]
mov byte [rax + 4], cl
movzx ecx, byte [rdx + 5]
mov byte [rax + 5], cl
movzx ecx, byte [rdx + 6]
mov byte [rax + 6], cl
movzx ecx, byte [rdx + 7]
mov byte [rax + 7], cl
movzx ecx, byte [rdx + 8]
mov byte [rax + 8], cl
movzx ecx, byte [rdx + 9]
mov byte [rax + 9], cl
movzx ecx, byte [rdx + 0xa]
mov byte [rax + 0xa], cl
movzx ecx, byte [rdx + 0xb]
mov byte [rax + 0xb], cl
movzx ecx, byte [rdx + 0xc]
mov byte [rax + 0xc], cl
movzx ecx, byte [rdx + 0xd]
mov byte [rax + 0xd], cl
movzx ecx, byte [rdx + 0xe]
mov byte [rax + 0xe], cl
movzx ecx, byte [rdx + 0xf]
mov byte [rax + 0xf], cl
movzx ecx, byte [rdx + 0x10]
mov byte [rax + 0x10], cl
movzx ecx, byte [rdx + 0x11]
mov byte [rax + 0x11], cl
movzx ecx, byte [rdx + 0x12]
mov byte [rax + 0x12], cl
movzx ecx, byte [rdx + 0x13]
mov byte [rax + 0x13], cl
movzx ecx, byte [rdx + 0x14]
mov byte [rax + 0x14], cl
movzx ecx, byte [rdx + 0x15]
mov byte [rax + 0x15], cl
movzx ecx, byte [rdx + 0x16]
mov byte [rax + 0x16], cl
movzx ecx, byte [rdx + 0x17]
mov byte [rax + 0x17], cl
movzx ecx, byte [rdx + 0x18]
mov byte [rax + 0x18], cl
movzx ecx, byte [rdx + 0x19]
mov byte [rax + 0x19], cl
movzx ecx, byte [rdx + 0x1a]
mov byte [rax + 0x1a], cl
movzx ecx, byte [rdx + 0x1b]
mov byte [rax + 0x1b], cl
movzx ecx, byte [rdx + 0x1c]
mov byte [rax + 0x1c], cl
movzx ecx, byte [rdx + 0x1d]
mov byte [rax + 0x1d], cl
movzx ecx, byte [rdx + 0x1e]
mov byte [rax + 0x1e], cl
movzx edx, byte [rdx + 0x1f]
mov byte [rax + 0x1f], dl
jmp 0x35e0419b7
Function at 0x35e04c900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
cmp r8, 3
mov r9, rdx
not eax
jbe 0x35e04c9d0
lea rdx, [r8 - 4]
lea r10, [0x35e103a40]
shr rdx, 2
lea rcx, [r9 + rdx*4 + 4]
nop dword [rax]
mov edx, eax
xor al, byte [r9]
add r9, 4
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 3]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
mov edx, eax
xor al, byte [r9 - 2]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 1]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
cmp r9, rcx
jne 0x35e04c928
and r8d, 3
test r8, r8
je 0x35e04c9c4
lea rdx, [0x35e103a40]
mov r9d, eax
xor al, byte [rcx]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 1
mov eax, r9d
je 0x35e04c9c4
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 2
mov eax, r9d
je 0x35e04c9c4
xor al, byte [rcx + 2]
mov r8d, r9d
shr r8d, 8
movzx eax, al
xor r8d, dword [rdx + rax*4]
mov eax, r8d
not eax
ret
mov rcx, rdx
jmp 0x35e04c974
Function at 0x35e060b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movzx esi, byte [rcx + 0x40]
test sil, sil
mov rbx, rcx
je 0x35e060b40
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x48]
mov r8d, 0xa
movzx edx, word [rcx + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rdi, rax
je 0x35e060be8
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x35e060be8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r13, rax
je 0x35e060be8
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
movsxd r12, eax
mov qword [rbx + 0x38], rdx
lea rcx, [r12 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x35e060bcb
mov r8, r12
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov qword [rbx + 0x30], rdi
mov byte [rbx + 0x40], sil
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edi, edi
jmp 0x35e060bcb
Function at 0x35e06b450
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rax, dword [r8 + 0x3c]
add rax, r8
mov r13, rdx
mov r14, rcx
movzx edx, word [rax + 6]
mov r12, r8
test dx, dx
je 0x35e06b56b
movzx ecx, word [rax + 0x14]
lea rsi, [rsp + 0x48]
mov r15d, dword [0x35e104c00]
movzx edi, word [0x35e104c04]
lea rbx, [rax + rcx + 0x18]
lea rax, [rdx + rdx*4]
lea rbp, [rbx + rax*8]
jmp 0x35e06b4b5
add rbx, 0x28
cmp rbp, rbx
je 0x35e06b56b
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x48], r15d
mov word [rsp + 0x4c], di
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x35e06b4a8
mov edi, dword [rbx + 0xc]
mov rdx, rsi
mov r9d, 0x40
mov rcx, r14
mov eax, dword [rbx + 8]
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
add r13, rdi
mov qword [rsp + 0x48], r13
lea r13, [rsp + 0x34]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r13
call rbp
mov edx, eax
mov eax, 0xa
test edx, edx
jne 0x35e06b570
mov r9d, dword [rbx + 8]
lea rbx, [rsp + 0x38]
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [r12 + rdi]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov edx, eax
mov eax, 0xc
test edx, edx
jne 0x35e06b570
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rsi
mov rcx, r14
mov r9d, 0x20
call rbp
neg eax
sbb eax, eax
and eax, 0xb
jmp 0x35e06b570
mov eax, 0xd
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x35e078af0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.35e082e90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.35e082e90
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x35e078b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x35e12a614]
test esi, esi
mov rbx, rcx
jle 0x35e078c90
mov rax, qword [0x35e12a618]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x35e078bab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x35e078c35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x35e078b90
mov rcx, rbx
call fcn.35e0793e0
test rax, rax
mov rdi, rax
je 0x35e078cb2
mov rax, qword [0x35e12a618]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.35e079520
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x35e12a618]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x35e078c97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x35e078c2e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x35e078c40
add dword [0x35e12a614], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x35e12a618]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x35e078c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.35e078af0
nop dword [rax]
xor esi, esi
jmp 0x35e078bb8
mov rax, qword [0x35e12a618]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.35e078af0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.35e078af0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x35e079030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x35e12a640]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x35e12a620]
test rbx, rbx
je 0x35e07908c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x35e079083
test rsi, rsi
je 0x35e079083
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x35e079068
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x35e0792a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x35e0792d8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x35e0792e0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x35e0792b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x35e0792d8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x35e0792e0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x35e0792c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x35e0792d8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x35e0792e0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x35e0793e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x35e109b20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x35e079400
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x35e079408
ret
cmp word [r8 + 0x18], 0x20b
jne 0x35e079400
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x35e07945d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x35e079454
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x35e079400
add rax, 0x28
cmp rax, r9
jne 0x35e079440
xor eax, eax
ret

Function at 0x35e079460
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x35e109b20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x35e07947f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x35e079488
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x35e07947f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x35e079520
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x35e109b20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x35e07953f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x35e079548
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x35e0ff920
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x35e102f40]
jmp 0x35e07a250
Function at 0x1400012d0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x400
lea rbx, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea r15, [rbp - 1]
nop word [rax + rax]
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x1400014e0
cmp word [rax + 0x10], 2
jne 0x140001407
cmp word [rax + 0x12], 4
jne 0x140001407
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140001402
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.140001230
mov qword [rsi], rax
test rax, rax
je 0x1400014d9
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x1400013d0
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rdi
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
cmp qword [r13], rbp
jne 0x140001481
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x140001426
test rax, rax
je 0x1400014fa
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001454
inc rax
test ecx, ecx
jne 0x140001441
test edx, edx
je 0x1400014fa
inc r12d
cmp r12d, 0x10
je 0x1400014fa
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x140001390
cmp dword [rsp + 0x8c0], ebp
je 0x14000150d
nop
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x140001490
lea rdx, [r15 + 1]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
jne 0x1400014b7
mov rbx, rbp
jmp 0x1400014c7
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x14000150d
mov ebp, 8
jmp 0x14000150d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x140001508
sub ecx, 1
je 0x140001501
sub ecx, 1
jne 0x140001508
mov ebp, 0x2afb
jmp 0x14000150d
mov ebp, 0x2afa
jmp 0x14000150d
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400033d0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001c60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1400089c8], 0
lea rax, [0x1400015a0]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140001a20]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x140001540]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x140001e39
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140001e2f
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140001d56
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001db8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140001e27
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001db8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001e27
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop word [rax + rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x140001e16
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140001dd0
mov rax, qword [rsp + 0x28]
mov qword [0x140008080], rax
mov rax, qword [rsp + 0x38]
mov qword [0x140008090], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1400080a0], rax
jmp 0x140001e1f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1400089c8], 1
mov rax, rbp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400033d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret