joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b95c
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov esi, r8d
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14003b9eb
and dword [rax - 0x24], 0
lea rdi, [0x140088478]
movabs rcx, 0x4d54ee85da812030
mov eax, 1
add rcx, qword [0x140088480]
mov ebx, 0x2719
cmp rcx, rax
jbe 0x14003b9b9
mov rax, qword [0x140088478]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x30]
movzx ecx, al
add rcx, 2
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], rcx
or eax, 0xffffffff
mov rcx, qword [rsp + 0x70]
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdi
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
jmp 0x14003ba27
mov r8, rbp
mov edx, esi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rsp + 0x70]
test eax, eax
mov edi, eax
sets dl
call fcn.1400332a4
test edi, edi
js 0x14003ba25
cmp esi, 0x8004667e
jne 0x14003ba25
cmp dword [rbp], 0
mov cl, byte [rbx]
je 0x14003ba20
or cl, 1
jmp 0x14003ba23
and cl, 0xfc
mov byte [rbx], cl
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14003bb38
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14008f884], eax
test eax, eax
je 0x14003bb8f
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14003bbb0
mov rdx, qword [rbx + 8]
lea rcx, [fcn.14000a958]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x14003da88
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rcx
and dword [rbp - 0x29], 0
and dword [rbp - 5], 0
and dword [rbp - 9], 0
mov dword [rbp - 1], 0x67452301
mov dword [rbp + 3], 0xefcdab89
mov dword [rbp + 7], 0x98badcfe
mov dword [rbp + 0xb], 0x10325476
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14003dad7
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14003d8d0
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 9]
call fcn.14003d9d0
and qword [rbx], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rbp - 0x29], 1
xor r8d, r8d
lea edx, [r8 + 0x10]
mov rcx, rbx
call fcn.140027a90
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003db30
mov rax, qword [rbx]
movups xmm0, xmmword [rbp - 0x21]
movdqu xmmword [rax], xmm0
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rbp
ret
Function at 0x14003f618
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x380]
sub rsp, 0x480
and dword [rbp + 0x3b0], 0
lea rax, [rbp + 0x3b0]
and dword [rbp + 0x3b4], 0
lea r9, [rsp + 0x60]
mov rdi, rdx
mov qword [rbp + 0x178], rcx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x170], 1
lea r8, [rbp + 0x170]
mov dword [rsp + 0x60], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x14003f75e
and dword [rbp + 0x3a0], 0
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rax
mov r9d, 0x1007
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x3b8], 4
mov r8d, 0xffff
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140035144
test eax, eax
jne 0x14003f75c
mov ebx, dword [rbp + 0x3a0]
test ebx, ebx
je 0x14003f745
and dword [rsp + 0x44], eax
lea r14, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, 1
jbe 0x14003f716
mov rax, qword [0x140088478]
mov edx, ebx
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14003f71b
test ebx, ebx
setne al
movzx eax, al
mov dword [rsp + 0x40], ebx
add rax, 2
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x14003f75c
and qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rdi + 0x10], xmm0
mov al, 1
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x480
pop r14
pop rdi
pop rbp
ret

Function at 0x14003ff7c
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x18], 0x10
mov rdx, rcx
jb 0x14003ff8f
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x10]
add r8, rdx
cmp qword [rcx + 0x18], 0x10
jb 0x14003ffa0
mov rcx, qword [rcx]
mov rdx, rcx
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001c20
cmp qword [rsp + 0x48], 8
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
lea rdx, str.open
cmovae r8, qword [rsp + 0x30]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea rcx, [rsp + 0x30]
setg bl
call fcn.140027050
mov al, bl
add rsp, 0x50
pop rbx
ret
Function at 0x1400452c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp byte [rcx + 0x19], 0
lea rsi, [rcx + 0x80]
mov r14, r9
mov rdi, r8
mov rbp, rcx
jge 0x140045330
mov r11, qword [rsi]
xor r8d, r8d
mov r10, qword [r11 + 0x10]
mov dword [rax + 8], r10d
test rdi, rdi
je 0x14004531a
mov rax, r8
and eax, 3
mov al, byte [rsp + rax + 0x50]
xor byte [r8 + rdx], al
inc r8
cmp r8, rdi
jb 0x140045301
mov r11, qword [rsi]
mov rax, rdi
and eax, 3
je 0x14004532c
lea ecx, [rax*8]
ror r10, cl
mov qword [r11 + 0x10], r10
mov rax, qword [rsi]
mov r8, rdi
mov rbx, qword [rax]
add rbx, 0x50
mov rcx, rbx
mov r15, qword [rbx + 0x10]
call fcn.140027a18
mov r9, qword [rsi]
mov rax, qword [r9]
cmp dword [rax + 0x70], 1
jne 0x1400453a4
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140045362
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
add r8, rcx
cmp qword [rbx + 0x18], 0x10
jb 0x140045373
mov rbx, qword [rbx]
lea rdx, [r15 + rbx]
lea rcx, [r9 + 0x18]
call fcn.14000a8bc
test al, al
jne 0x1400453a4
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.140033b74
mov qword [rsp + 0x28], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [r14], xmm0
jmp 0x1400453ab
sub qword [rbp + 0x30], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400466d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140046712
cmp rbx, 0x7fffffff
ja 0x140046712
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
jmp 0x140046716
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140047664
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [r11 - 0x48], 0
lea rax, [rbp + 0x30]
and qword [r11 - 0x50], 0
and dword [rbp + 0x38], 0
mov dword [rbp + 0x30], r9d
lea r9, [rbp + 0x38]
mov qword [r11 - 0x58], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rdi, qword [rbp + 0x40]
mov ebx, 1
mov dl, bl
mov rcx, rdi
mov r14d, eax
call fcn.1400332a4
mov r9, qword [rdi + 0x10]
lea r10, [rdi + 8]
movabs r11, 0x4800144005b3
cmp r9, rbx
je 0x1400476d2
mov ecx, dword [rdi]
mov r8d, ecx
jmp 0x140047701
mov rcx, qword [r10]
mov rax, r11
mov r8d, dword [rdi]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x140047744
and dword [rbp - 0x1c], 0
lea rsi, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rbx
jbe 0x14004773b
mov rax, qword [0x140088478]
mov edx, 0x2746
mov rcx, rsi
call qword [rax + 0x30]
mov bl, al
mov dword [rbp - 0x20], 0x2746
jmp 0x1400477bd
cmp r9, rbx
je 0x14004774e
mov eax, r8d
jmp 0x14004777a
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x4d2
jne 0x1400477df
and dword [rbp - 0x1c], 0
lea rsi, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rbx
jbe 0x1400477b6
mov rax, qword [0x140088478]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov bl, al
mov dword [rbp - 0x20], 0x274d
movzx eax, bl
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x140047856
cmp r9, rbx
je 0x1400477e9
mov eax, r8d
jmp 0x140047815
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x2738
je 0x140047860
cmp r9, rbx
jne 0x14004784d
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0xea
je 0x140047860
test r14d, r14d
je 0x140047860
or eax, 0xffffffff
jmp 0x140047878
and qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x38]
movups xmmword [rdi], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rdi + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004a290
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [rax - 0x48], 0
and qword [rax - 0x50], 0
mov rbx, qword [rbp + 0x40]
and dword [rbp + 0x38], 0
mov dword [rax - 0x58], r9d
lea r9, [rbp + 0x38]
call qword [sym.imp.WS2_32.dll_WSASend]
mov edi, 1
mov rcx, rbx
mov dl, dil
mov r14d, eax
call fcn.1400332a4
movabs r9, 0x4800144005b3
cmp qword [rbx + 0x10], rdi
je 0x14004a2f0
mov ecx, dword [rbx]
mov r8d, ecx
jmp 0x14004a320
mov rcx, qword [rbx + 8]
mov rax, r9
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x14004a364
and dword [rbp - 0x1c], 0
lea rsi, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rdi
jbe 0x14004a35b
mov rax, qword [0x140088478]
mov edx, 0x2746
mov rcx, rsi
call qword [rax + 0x30]
mov dil, al
mov dword [rbp - 0x20], 0x2746
jmp 0x14004a3dd
cmp qword [rbx + 0x10], rdi
jne 0x14004a397
mov rcx, qword [rbx + 8]
mov rax, r9
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14004a3fe
and dword [rbp - 0x1c], 0
lea rsi, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rdi
jbe 0x14004a3d6
mov rax, qword [0x140088478]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dil, al
mov dword [rbp - 0x20], 0x274d
movzx eax, dil
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test r14d, r14d
je 0x14004a408
or eax, 0xffffffff
jmp 0x14004a420
and qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x38]
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004b6b4
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
movzx r15d, r8b
mov rsi, r9
mov r14, rdx
mov edi, 1
cmp rcx, 0xffffffffffffffff
jne 0x14004b75e
mov r14d, 0x2719
and dword [rbp - 0x1c], 0
lea rbx, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rdi
jbe 0x14004b71e
mov rax, qword [0x140088478]
mov edx, r14d
mov rcx, rbx
call qword [rax + 0x30]
mov dil, al
movzx eax, dil
mov dword [rbp - 0x20], r14d
add rax, 2
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
test r8b, r8b
jne 0x14004b773
test byte [rdx], dil
je 0x14004b773
mov r14d, 0x2726
jmp 0x14004b6ea
lea r8, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
sets dl
call fcn.1400332a4
test ebx, ebx
js 0x14004b743
mov dl, byte [r14]
mov al, dil
mov cl, dl
or dl, 2
and cl, 0xfd
movzx edx, dl
test r15b, r15b
movzx ecx, cl
cmove edx, ecx
mov byte [r14], dl
jmp 0x14004b745
Function at 0x14004c334
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r10d, r9d
mov r9, rdx
mov r11d, r8d
cmp rcx, 0xffffffffffffffff
jne 0x14004c3bd
and dword [rbp - 0x1c], 0
lea rbx, [0x140088478]
movabs rcx, 0x4d54ee85da812030
mov edx, 1
add rcx, qword [0x140088480]
cmp rcx, rdx
jbe 0x14004c38a
mov rax, qword [0x140088478]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
mov dl, al
movzx ecx, dl
add rcx, 2
mov dword [rbp - 0x20], 0x2719
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp + 0x40]
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
or eax, 0xffffffff
jmp 0x14004c4bf
cmp r11d, 0xa5100000
jne 0x14004c481
mov edx, 1
cmp r10d, 2
jne 0x14004c43a
and dword [rbp - 0x1c], 0
lea rbx, [0x140088478]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140088480]
cmp rcx, rdx
jbe 0x14004c40a
mov rax, qword [0x140088478]
mov edx, 0x2726
mov rcx, rbx
call qword [rax + 0x30]
mov dl, al
movzx eax, dl
add rax, 2
mov dword [rbp - 0x20], 0x2726
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x40]
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
jmp 0x14004c3b5
cmp r10d, edx
jne 0x14004c496
cmp qword [rbp + 0x38], 4
jne 0x14004c3d5
mov cl, byte [r9]
xorps xmm0, xmm0
mov rax, qword [rbp + 0x30]
mov edx, dword [rax]
mov al, cl
and al, 0xfb
or cl, 4
movzx eax, al
test edx, edx
movzx ecx, cl
cmove ecx, eax
mov rax, qword [rbp + 0x40]
and qword [rbp - 0x10], 0
mov byte [r9], cl
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rax + 0x10], xmm0
xor eax, eax
jmp 0x14004c4bf
cmp r11d, 0xffff
jne 0x14004c496
cmp r10d, 0x80
jne 0x14004c496
or byte [rdx], 8
mov eax, dword [rbp + 0x38]
mov r8d, r10d
mov r9, qword [rbp + 0x30]
mov edx, r11d
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbp + 0x40]
test eax, eax
mov ebx, eax
setne dl
call fcn.1400332a4
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14004caa4
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov dword [rax - 0x20], 1
and dword [rax - 0x28], 0
xor r9d, r9d
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.1400332a4
cmp rdi, 0xffffffffffffffff
jne 0x14004caea
or rax, rdi
jmp 0x14004cb14
cmp esi, 0x17
jne 0x14004cb11
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14004d058
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rsi, r8
mov r10, rdx
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14004d08a
xor r9d, r9d
xor r8d, r8d
jmp 0x14004d099
cmp qword [rdx], 0xffffffffffffffff
jne 0x14004d0a7
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14004d120
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
and qword [rsp + 0x30], 0
mov r8d, r11d
mov rdi, qword [rsp + 0x80]
mov rdx, rsi
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14004d0f9
mov eax, 0x2746
jmp 0x14004d106
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x14004d127
cmp eax, 0x3e5
je 0x14004d127
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.14003f7f0
jmp 0x14004d133
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.14003f88c
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14004d20c
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rbx, r8
mov r10, rdx
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14004d23e
xor r9d, r9d
xor r8d, r8d
jmp 0x14004d24d
cmp qword [rdx], 0xffffffffffffffff
jne 0x14004d25b
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14004d2be
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x78]
mov eax, dword [rsp + 0x70]
mov r8d, r11d
mov rsi, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14004d2c5
cmp eax, 0x3e5
je 0x14004d2c5
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.14003f7f0
jmp 0x14004d2d1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.14003f88c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140050c00
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x140050c42
cmp rbx, 0x7fffffff
ja 0x140050c42
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
jmp 0x140050c46
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f550
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14005f57a
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.14005f5f0
int3

Function at 0x1400607bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060806
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060806
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060806
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060806
cmp dword [rcx + 0x84], 0xe
jbe 0x140060806
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060808
xor al, al
add rsp, 0x28
ret
Function at 0x140002068
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
lea rsi, str.base_stor_vssincworker.hxx
mov qword [rsp + 0x30], rsi
lea r14, str.CVssWorkerThread::StartJob
mov qword [rsp + 0x38], r14
lea r15, str.INCWORKH
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x171
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
xor ebx, ebx
mov dword [rbp - 0x30], 0x1000000
lea r13d, [rbx + 0x78]
mov r8d, r13d
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.14001cce0
nop
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14003dc59
cmp dword [rdi + 0x1c], 2
jne 0x14003dc59
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14003db82
mov byte [rdi + 0x20], 1
lea rcx, [rbp - 0x20]
call fcn.14001ce00
mov eax, ebx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x184
mov dword [rsp + 0x4c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [rdi + 0x1c]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9, qword [rdi + 0x10]
lea r8, str.ResumeThread__p____1__GetLastError____0x_08lx__m_eThreadState___d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.1400dbc64
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x187
mov dword [rsp + 0x4c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov eax, dword [rdi + 0x1c]
mov dword [rsp + 0x20], eax
lea r8, str.ResumeThread_failed._Error:_0x_08lx._State:__d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.14001cc70
mov dword [rdi + 0x1c], 5
mov eax, 0x8007000e
jmp 0x14003dcb4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x176
mov dword [rsp + 0x4c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
mov r9d, dword [rdi + 0x1c]
lea r8, str.Bad_state__d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.14001cc70
mov eax, 0x8000ffff
mov ebx, eax
jmp 0x140002125