joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d77f0
Capabilities:
Set socket configuration

Disassembly:
test rcx, rcx
je 0x1400d7a1c
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2080
call fcn.140170e10
sub rsp, rax
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov qword [rsp + 0x2098], rbp
mov rbx, rcx
mov dword [rsp + 0x54], esi
mov rcx, qword [rcx + 0x8f8]
lea r8, [rsp + 0x58]
mov edx, 0x8004667e
mov dword [rsp + 0x5c], 4
lea edi, [rsi - 2]
movaps xmmword [rsp + 0x2070], xmm6
mov dword [rsp + 0x58], esi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx + 0x8f8]
mov ebp, 1
mov edx, ebp
call qword [sym.imp.WS2_32.dll_shutdown]
movsd xmm6, qword [0x1401ece90]
nop
mov r9d, 0x2000
movsd qword [rsp + 0x20], xmm6
lea r8, [rsp + 0x60]
mov rdx, rbx
xor ecx, ecx
call fcn.1400e8e90
test eax, eax
jg 0x1400d7880
mov rax, qword [rbx + 0x8e8]
movaps xmm6, xmmword [rsp + 0x2070]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400d78e5
call fcn.140188e58
mov edi, eax
test eax, eax
js 0x1400d78e5
lea ecx, [rax + 0x3e7]
mov word [rsp + 0x50], bp
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov word [rsp + 0x52], dx
jmp 0x1400d78f2
mov dword [rsp + 0x50], esi
cmp edi, 0xffffffff
jl 0x1400d79d8
mov rcx, qword [rbx + 0x8f8]
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x1400d7959
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018a088
mov qword [rsp + 0x30], rax
lea r8, str.close_socket_gracefully
lea rax, str._s:_getsockopt_SOL_SOCKET_SO_ERROR__failed:__s
mov qword [rsp + 0x28], r8
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 0x45ab
mov rcx, rbx
call fcn.1400e1360
jmp 0x1400d79d8
cmp dword [rsp + 0x54], 0x2746
je 0x1400d79d8
mov rcx, qword [rbx + 0x8f8]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400d79d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018a088
movzx ecx, word [rsp + 0x52]
lea r8, str.close_socket_gracefully
movzx edx, word [rsp + 0x50]
mov r9d, 0x45c2
mov qword [rsp + 0x40], rax
lea rax, str._s:_setsockopt_SOL_SOCKET_SO_LINGER__i__i___failed:__s
mov dword [rsp + 0x38], ecx
mov rcx, rbx
mov dword [rsp + 0x30], edx
xor edx, edx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
call fcn.1400e1360
mov rcx, qword [rbx + 0x8f8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbp, qword [rsp + 0x2098]
mov qword [rbx + 0x8f8], 0xffffffffffffffff
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1401702b0
lea r11, [rsp + 0x2080]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400e0a80
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
push r15
xor r10d, r10d
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov r15, rcx
mov rsi, 0xffffffffffffffff
test r9, r9
je 0x1400e0ab1
mov rsi, qword [r9]
mov qword [r9], r10
mov qword [rsp + 0x28], r12
mov rbx, r10
mov qword [rsp + 0x30], r13
test rdi, rdi
je 0x1400e0c92
mov r12, r15
lea r11, [rcx + 2]
mov r13d, 1
not r12
sub r13, r15
nop word [rax + rax]
movzx r8d, byte [r11 - 2]
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x1400e0af3
sub r8b, 0x41
jmp 0x1400e0b0d
lea eax, [r8 - 0x61]
cmp al, 0x19
ja 0x1400e0b01
sub r8b, 0x47
jmp 0x1400e0b0d
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x1400e0b1a
add r8b, 4
cmp r8b, 0xfe
jb 0x1400e0b2e
mov eax, ebx
jmp 0x1400e0cb0
cmp r8b, 0x2b
jne 0x1400e0b25
mov r8b, 0x3e
jmp 0x1400e0b2e
cmp r8b, 0x2f
jne 0x1400e0b13
mov r8b, 0x3f
lea rax, [r11 + r12]
cmp rax, rdi
jae 0x1400e0b6a
movzx r9d, byte [r11 - 1]
lea eax, [r9 - 0x41]
cmp al, 0x19
ja 0x1400e0b4a
sub r9b, 0x41
jmp 0x1400e0b64
lea eax, [r9 - 0x61]
cmp al, 0x19
ja 0x1400e0b58
sub r9b, 0x47
jmp 0x1400e0b64
lea eax, [r9 - 0x30]
cmp al, 9
ja 0x1400e0b72
add r9b, 4
cmp r9b, 0xfe
jb 0x1400e0b86
lea eax, [rbx + 1]
jmp 0x1400e0cb0
cmp r9b, 0x2b
jne 0x1400e0b7d
mov r9b, 0x3e
jmp 0x1400e0b86
cmp r9b, 0x2f
jne 0x1400e0b6a
mov r9b, 0x3f
mov rax, r11
sub rax, r15
cmp rax, rdi
jae 0x1400e0bbc
movzx ecx, byte [r11]
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x1400e0ba1
sub cl, 0x41
jmp 0x1400e0bb7
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x1400e0bad
sub cl, 0x47
jmp 0x1400e0bb7
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400e0bc4
add cl, 4
cmp cl, 0xfe
jne 0x1400e0bdd
lea eax, [rbx + 2]
jmp 0x1400e0cb0
cmp cl, 0x2b
jne 0x1400e0bcd
mov cl, 0x3e
jmp 0x1400e0bdd
cmp cl, 0x2f
jne 0x1400e0bd6
mov cl, 0x3f
jmp 0x1400e0bdd
cmp cl, 0x3d
jne 0x1400e0bbc
mov cl, 0xff
lea rax, [r11 + r13]
cmp rax, rdi
jae 0x1400e0c12
movzx edx, byte [r11 + 1]
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x1400e0bf7
sub dl, 0x41
jmp 0x1400e0c0d
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x1400e0c03
sub dl, 0x47
jmp 0x1400e0c0d
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x1400e0c1a
add dl, 4
cmp dl, 0xfe
jne 0x1400e0c33
lea eax, [rbx + 3]
jmp 0x1400e0cb0
cmp dl, 0x2b
jne 0x1400e0c23
mov dl, 0x3e
jmp 0x1400e0c33
cmp dl, 0x2f
jne 0x1400e0c2c
mov dl, 0x3f
jmp 0x1400e0c33
cmp dl, 0x3d
jne 0x1400e0c12
mov dl, 0xff
cmp r10, rsi
jae 0x1400e0c4a
movzx eax, r9b
shl r8b, 2
shr al, 4
add al, r8b
mov byte [r10 + rbp], al
inc r10
cmp cl, 0xff
je 0x1400e0c81
cmp r10, rsi
jae 0x1400e0c68
movzx eax, cl
shl r9b, 4
shr al, 2
add al, r9b
mov byte [r10 + rbp], al
inc r10
cmp dl, 0xff
je 0x1400e0c81
cmp r10, rsi
jae 0x1400e0c7e
shl cl, 6
add cl, dl
mov byte [r10 + rbp], cl
inc r10
add rbx, 4
add r11, 4
cmp rbx, rdi
jb 0x1400e0ae0
cmp r10, rsi
jae 0x1400e0c9c
mov byte [r10 + rbp], 0
inc r10
test r14, r14
je 0x1400e0ca7
mov qword [r14], r10
cmp rsi, r10
sbb eax, eax
neg eax
dec eax
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e10c0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x22c0
call fcn.140170e10
sub rsp, rax
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov rbx, qword [rsp + 0x2300]
mov rdi, r9
mov rsi, rcx
call fcn.140005170
xor ebp, ebp
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
mov r8d, 0x2000
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rax]
or rcx, 1
call fcn.14017ff24
mov byte [rsp + 0x22af], bpl
test rsi, rsi
jne 0x1400e1142
lea rcx, [rsp + 0x2b0]
call fcn.140188bd8
jmp 0x1400e1333
mov rax, qword [rsi + 0x8e0]
mov r8, qword [rax + 0x7d00]
test r8, r8
je 0x1400e116b
lea rdx, [rsp + 0x2b0]
mov rcx, rsi
call r8
test eax, eax
jne 0x1400e1333
mov rax, qword [rsi + 0x8e8]
mov qword [rsp + 0x22e8], r14
mov r14, qword [rax + 0xa0]
test r14, r14
je 0x1400e132b
movzx ecx, byte [r14]
mov rdx, r14
mov qword [rsp + 0x60], rbp
test cl, cl
je 0x1400e132b
movabs r8, 0xd0000404ffffffff
cmp cl, 0x3f
ja 0x1400e11b7
bt r8, rcx
jb 0x1400e132b
cmp cl, 0x7c
je 0x1400e132b
movzx ecx, byte [rdx + 1]
inc rdx
test cl, cl
jne 0x1400e11a8
lea r8, [rsp + 0x40]
mov rdx, r14
mov rcx, rsi
call fcn.1400e5590
mov r9d, 0x104
lea r8, [rsp + 0xa0]
mov rdx, r14
mov rcx, rsi
mov ebx, eax
call fcn.1400e7680
lea rdx, [0x1401b9a74]
lea rcx, [rsp + 0xa0]
call fcn.1401821a8
mov qword [rsp + 0x60], rax
mov rdi, rax
test ebx, ebx
jne 0x1400e122b
lea r8, [rsp + 0x40]
mov rdx, r14
mov rcx, rsi
call fcn.1400e5590
mov rdi, qword [rsp + 0x60]
test rdi, rdi
mov eax, ebp
setne al
test eax, eax
je 0x1400e132b
test rdi, rdi
je 0x1400e132b
lea rcx, [0x14031fd00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call fcn.140187930
lea rcx, [rsi + 0x91c]
mov byte [rsp + 0x68], bpl
mov rbx, rax
test rcx, rcx
je 0x1400e12a9
movzx edx, word [rcx]
cmp dx, 2
jne 0x1400e127c
mov edx, reloc.WS2_32.dll_recv
jmp 0x1400e1287
cmp dx, 0x17
jne 0x1400e12a9
mov edx, 0x1c
mov dword [rsp + 0x30], 2
lea r8, [rsp + 0x68]
mov dword [rsp + 0x28], ebp
mov r9d, 0x32
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea r9, [rsp + 0x68]
mov r8d, ebx
lea rdx, str.__010lu___error___client__s_
mov rcx, rdi
call fcn.140005180
mov r8, qword [rsi + 0x10]
test r8, r8
je 0x1400e12ea
mov rax, qword [rsi + 0x18]
lea r9, [0x1401e1235]
test rax, rax
lea rdx, str._s__s:
mov rcx, rdi
cmovne r9, rax
call fcn.140005180
lea r8, [rsp + 0x2b0]
mov rcx, rdi
lea rdx, [0x1401e16f8]
call fcn.140005180
mov rdx, rdi
mov ecx, 0xa
call fcn.140185150
mov rcx, rdi
call fcn.1401810b8
lea rcx, [0x14031fd00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
call fcn.140181244
mov r14, qword [rsp + 0x22e8]
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.1401702b0
mov rbx, qword [rsp + 0x22f0]
add rsp, 0x22c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e1ce0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x60
xorps xmm0, xmm0
mov ebp, ecx
movups xmmword [rsp + 0x28], xmm0
mov eax, dword [rsp + 0x28]
mov r10, rdx
mov dword [rsp + 0x2c], ecx
mov r15, r9
mov ecx, 4
lea r9, [rsp + 0x20]
mov r14, r8
xor esi, esi
cmp dword [rsp + 0xa0], esi
lea r8, [rsp + 0x28]
movups xmmword [rsp + 0x38], xmm0
cmove eax, ecx
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x28], eax
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400e1d55
xor eax, eax
mov rbp, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x80], rbx
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400e1dc9
mov qword [rsp + 0x88], rdi
mov rax, rbx
mov rdi, rbx
mov rdx, rbx
mov rcx, rbx
mov r9, rbx
nop
mov r8, qword [rax + 0x10]
cmp r15, r8
jb 0x1400e1da7
mov rdx, qword [rdx + 0x20]
mov rcx, r9
movzx eax, word [rdx]
cmp eax, ebp
jne 0x1400e1da7
mov rcx, r14
call fcn.1401726d0
mov rcx, rdi
mov esi, 1
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x20], rax
mov rdx, rax
mov rcx, rax
mov r9, rax
mov rdi, rax
test rax, rax
jne 0x1400e1d80
mov rdi, qword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [rsp + 0x80]
mov eax, esi
mov rbp, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rsi
ret
Function at 0x1400e1df0
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1d0
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov esi, ecx
and esi, 0x9d
cmp dword [0x14031fcfc], 0
jg 0x1400e1e29
lea rcx, [0x14031fd28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x1e0], rbx
lea rcx, [0x14031fd28]
mov qword [rsp + 0x1e8], rbp
mov qword [rsp + 0x1f0], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14031fcfc]
test eax, eax
jg 0x1400e1ff2
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14031fd50], eax
cmp eax, 0xffffffff
je 0x1400e1ea7
lea rcx, [0x14031fd00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400e1ec8
lea rcx, [0x14031fd00]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x14031fd50]
call qword [sym.imp.KERNEL32.dll_TlsFree]
lea rcx, [0x14031fd28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14031fd28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
jmp 0x1400e200a
mov rcx, qword [0x1401b8a00]
lea rbp, [0x1401b8a00]
xor ebx, ebx
mov edi, 1
mov edx, edi
test rcx, rcx
je 0x1400e1f20
mov r8d, ebx
nop word [rax + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x1400e1ef7
add rax, rdx
test r8, r8
lea rdx, [rax + 2]
cmovle rdx, rax
inc r8
mov rax, r8
shl rax, 5
mov rcx, qword [rax + rbp]
test rcx, rcx
jne 0x1400e1ef0
mov rcx, rdx
call fcn.140184ca0
mov qword [0x14031fd70], rax
mov r9, rax
test rax, rax
je 0x1400e1ea7
mov byte [rax], bl
cmp qword [0x1401b8a00], rbx
je 0x1400e1fe8
mov rdx, rbp
nop dword [rax]
test rbx, rbx
jle 0x1400e1fb2
lea rcx, [r9 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400e1f60
movzx eax, word [0x1401e1c3c]
mov word [rcx], ax
movzx eax, byte [0x1401e1c3e]
mov byte [rcx + 2], al
lea rax, [r9 - 1]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400e1f82
mov r8, qword [rdx]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400e1fa0
jmp 0x1400e1fd1
mov rcx, qword [rdx]
mov rdx, r9
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400e1fc0
inc rbx
mov rdx, rbx
shl rdx, 5
add rdx, rbp
cmp qword [rdx], 0
jne 0x1400e1f50
mov eax, dword [0x14031fcfc]
test eax, eax
jle 0x1400e1ff5
lea edi, [rax + 1]
lea rcx, [0x14031fd28]
mov dword [0x14031fcfc], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov rdi, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x1d0
pop rsi
ret
Function at 0x1400e2550
Capabilities:
Create directory

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r9d, 0x104
lea r8, [rsp + 0x20]
call fcn.1400e7680
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x248
ret

Function at 0x1400e25b0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1400e25ec
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400e26be
mov ecx, 0x568
mov qword [rsp + 0x258], rbx
call fcn.140184ca0
mov rbx, rax
test rax, rax
jne 0x1400e2617
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x1400e26b6
mov r9d, 0x104
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.1400e7680
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x1400e2644
add rcx, 2
cmp rcx, 0x104
jae 0x1400e26ac
cmp eax, 0xffffffff
je 0x1400e26ac
test al, 0x10
je 0x1400e26ac
lea rax, [rsp + 0x20]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400e2670
mov ecx, dword [0x1401ba2cc]
lea rdx, [rbx + 8]
mov dword [rax], ecx
movzx ecx, word [0x1401ba2d0]
mov word [rax + 4], cx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
mov rax, rbx
mov byte [rbx + 0x258], 0
jmp 0x1400e26b6
mov rcx, rbx
call fcn.140180564
xor eax, eax
mov rbx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401702b0
mov rsi, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
Function at 0x1400e2f80
Capabilities:
Delete file

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r9d, 0x104
lea r8, [rsp + 0x20]
call fcn.1400e7680
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x248
ret
Function at 0x1400e7680
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0x8a0
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x870], rax
cmp byte [rdx], 0
lea r15, [0x1400e5e90]
mov qword [r11 - 0x28], rsi
mov r14, r8
mov qword [r11 - 0x30], rdi
lea r8, [rsp + 0x40]
mov qword [r11 - 0x38], r12
mov rsi, rcx
mov r12, r9
mov r9d, 0x30c
je 0x1400e76f1
lea rax, [rsp + 0x40]
sub rdx, rax
cmp r9, 1
jbe 0x1400e76f1
movzx eax, byte [rdx + r8]
dec r9
mov byte [r8], al
inc r8
cmp byte [rdx + r8], 0
jne 0x1400e76d6
xor r13d, r13d
mov byte [r8], 0
movzx eax, byte [rsp + 0x40]
mov edi, r13d
mov qword [rsp + 0x8c8], rbx
test al, al
je 0x1400e7765
lea rbx, [rsp + 0x40]
cmp al, 0x2f
jne 0x1400e771a
mov byte [rbx], 0x5c
mov al, 0x5c
test edi, edi
jle 0x1400e7758
cmp al, 0x5c
jne 0x1400e7758
movzx eax, byte [rbx + 1]
cmp al, 0x5c
je 0x1400e772e
cmp al, 0x2f
jne 0x1400e7758
movsxd rax, edi
lea rcx, [rsp + 0x41]
add rcx, rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], r13b
jne 0x1400e7740
lea rdx, [rsp + 0x42]
add rdx, rax
call fcn.1401726d0
jmp 0x1400e7722
movzx eax, byte [rbx + 1]
inc rbx
inc edi
test al, al
jne 0x1400e7711
lea r8, [r12 + r12]
xor edx, edx
mov rcx, r14
call fcn.140172d70
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x560]
mov qword [rsp + 0x30], r13
mov r9d, r12d
mov dword [rsp + 0x28], 0x30c
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r12, qword [rsp + 0x880]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x560]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400e77f3
inc rax
test ecx, ecx
jne 0x1400e77e0
test edx, edx
je 0x1400e77fb
mov word [r14], r13w
test rsi, rsi
je 0x1400e7855
mov rax, qword [rsi + 0x8e8]
mov rdi, qword [rax + 0x48]
test rdi, rdi
je 0x1400e7855
mov qword [rsp + 0x898], rbp
lea rsi, [0x1401b8df4]
nop
movzx ecx, byte [rsi]
mov rbp, rdi
call fcn.140185968
movzx ecx, byte [rdi]
mov ebx, eax
call fcn.140185968
inc rdi
lea rsi, [rsi + 1]
cmp eax, ebx
jne 0x1400e784d
cmp byte [rbp], r13b
jne 0x1400e7820
lea r15, [fcn.140187a90]
mov rbp, qword [rsp + 0x898]
xor edx, edx
lea rcx, [rsp + 0x350]
mov r8d, 0x20a
call fcn.140172d70
mov r8d, 0x104
lea rdx, [rsp + 0x350]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rdi, qword [rsp + 0x888]
mov rsi, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x8c8]
test eax, eax
jne 0x1400e78aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400e78c7
jmp 0x1400e78b1
cmp eax, 0x105
jae 0x1400e78c3
lea rdx, [rsp + 0x350]
mov rcx, r14
call r15
test eax, eax
je 0x1400e78c7
mov word [r14], r13w
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x8a0
pop r15
pop r14
pop r13
ret
Function at 0x1400e8c10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov r14, rdx
mov ecx, dword [0x14031fd50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, qword [rsi + 0x28]
lea rbx, [rsi + 0x28]
mov r9, rbx
test r8, r8
je 0x1400e8c6d
nop dword [rax + rax]
lea r9, [r8 + 0x18]
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x1400e8c60
mov qword [rdi + 0x18], 0
mov rcx, rsi
mov qword [r9], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebp, ebp
test eax, eax
sete bpl
test eax, eax
je 0x1400e8cea
mov rcx, rsi
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx]
test rax, rax
je 0x1400e8cd2
nop dword [rax + rax]
cmp rax, rdi
je 0x1400e8d11
lea rbx, [rax + 0x18]
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400e8cc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rsp + 0x30]
lea eax, [rbp - 1]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, qword [rdi + 0x18]
xor ebp, ebp
mov rcx, rsi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400e8cea
Function at 0x1400e8e90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov ebp, r9d
mov rbx, r8
mov r14, rdx
test rcx, rcx
je 0x1400e8efc
call fcn.1401882c4
mov ecx, eax
mov r8d, ebp
mov rdx, rbx
call fcn.14018b728
mov ebx, eax
test eax, eax
jns 0x1400e8ee6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rsi, [r14 + 0x8e0]
jmp 0x1400e8f95
jne 0x1400e8ef0
test ebp, ebp
jg 0x1400e8f70
lea rsi, [r14 + 0x8e0]
jmp 0x1400e8f95
mov rax, qword [rdx + 0x8f8]
lea rsi, [r14 + 0x8e0]
movsd xmm0, qword [rsp + 0x90]
lea rcx, [rsp + 0x28]
mulsd xmm0, qword [0x1401bcac8]
mov edx, 1
mov r9, qword [rsi]
add r9, 0x28
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], dx
cvttsd2si r8d, xmm0
call fcn.1400e26e0
mov rcx, qword [rsi]
mov edx, dword [rcx + 0x28]
test edx, edx
jne 0x1400e8f70
test eax, eax
jle 0x1400e8f91
mov rcx, qword [r14 + 0x8f8]
xor r9d, r9d
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x1400e8f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
jle 0x1400e8f70
jmp 0x1400e8f95
js 0x1400e8f70
xor ebx, ebx
mov rax, qword [rsi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
jne 0x1400e8f70
test ebx, ebx
jg 0x1400e8fbe
jne 0x1400e8fb0
test ebp, ebp
je 0x1400e8fbe
mov eax, 0xffffffff
jmp 0x1400e8f75
jns 0x1400e8fa9
cmp edi, 0x274c
jne 0x1400e8f70
xor eax, eax
jmp 0x1400e8f75
mov eax, ebx
jmp 0x1400e8f75