joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400049c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14001bf80]
mov rax, qword [rsi]
test rax, rax
je 0x140004bb0
cmp qword [rax + 0x28], 0
jne 0x140004b98
lea rcx, [0x14001f1d8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x140004ba5
call fcn.140003fd0
mov rax, qword [rsi]
test rax, rax
je 0x140004a40
cmp qword [rax + 0x30], 0
jne 0x140004a60
lea rdx, [0x14001a078]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140004a74
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140008ce0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140004a10
test rax, rax
jne 0x140004a60
call fcn.140008ce0
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x140004a2e
call fcn.140003b10
cmp qword [0x140022050], 0
mov rbx, rax
je 0x140004a2e
test rax, rax
je 0x140004a2e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14000ab80
cmp eax, 1
je 0x140004c1d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140019086
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x140004bf8
cmp qword [rax + 0x30], 0
je 0x140004be0
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140019086
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1400049fc
mov rax, qword [rsi]
jmp 0x140004a09
call fcn.140008ce0
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1400049e8
test rax, rax
jne 0x140004b98
call fcn.140008ce0
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1400049fc
jmp 0x140004a01
lea rdx, [0x14001a078]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x140004b6e
call fcn.140008ce0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140004be0
test rax, rax
jne 0x140004b6a
call fcn.140008ce0
jmp 0x140004b6a
call fcn.140003ea0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14001bf80]
mov rdx, qword [rax]
lea rax, [0x14001f1e8]
mov qword [rdx + 0x10], rax
ret
Function at 0x140008b60
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008b80
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008bc8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008b74
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008bb5
Function at 0x140008ce0
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14001f2c0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x140008d03
lea rax, [0x14001f2c8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x140008d4b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008d48
lea rax, [0x14001f300]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x140008d7b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008d78
xor ecx, ecx
mov byte [0x14001f319], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14001f322], rdx
lea r8, [0x14001f2c0]
lea rbx, [0x14001f31a]
mov qword [0x14001f332], rdx
mov qword [0x14001f342], rdx
mov qword [0x14001f352], rdx
xor edx, edx
mov qword [0x14001f31a], rax
mov qword [0x14001f32a], rax
mov qword [0x14001f33a], rax
mov qword [0x14001f34a], rax
mov byte [0x14001f35a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008f56
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008ea1
lea rsi, [0x14001f200]
lea r8, [0x14001f35a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x140008e4d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x140008e40
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x140008f43
lea rcx, [0x140008bf0]
mov qword [0x14001f200], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14001f200]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14001f300]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14001f35a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x140008f76
nop dword [rax]
cmp byte [rax], 0x41
jne 0x140008ef3
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x140008ee0
mov rax, rdx
mov qword [0x14001f200], rax
lea rsi, [0x14001f200]
jmp 0x140008f19
cmp rdx, rsi
je 0x140008e7f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x140008f10
cmp rdx, rsi
je 0x140008e7f
mov qword [rdx + 8], rsi
lea rcx, [0x140008bf0]
call sub.msvcrt.dll__onexit
jmp 0x140008e7f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.140008b60
xor eax, eax
jmp 0x140008e98
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.140008b60
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.140008b60
xor eax, eax
jmp 0x140008eff
Function at 0x140007a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov eax, 0xfffffffe
test rcx, rcx
je 0x140007ab7
mov rsi, rcx
cmp qword [rcx + 0x30], 0
je 0x140007ab7
cmp qword [rsi + 0x38], 0
je 0x140007ab7
mov rdi, qword [rsi + 0x28]
test rdi, rdi
je 0x140007ab7
cmp qword [rdi], rsi
je 0x140007ac6
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14d, r8d
mov rbx, rdx
mov ecx, dword [rdi + 8]
lea edx, [rcx - 0x39]
cmp edx, 0x38
ja 0x140007b33
movabs r8, 0x100400400011001
bt r8, rdx
jae 0x140007b33
test rbx, rbx
je 0x140007ab7
mov ebp, dword [rdi + 0x2c]
cmp ebp, 2
je 0x140007ab7
cmp ebp, 1
jne 0x140007b46
cmp ecx, 0x2a
jne 0x140007ab7
cmp dword [rdi + 0xf0], 0
jne 0x140007ab7
mov ecx, dword [rsi + 0x4c]
mov rdx, rbx
mov r8d, r14d
call fcn.140006af0
mov dword [rsi + 0x4c], eax
mov dword [rdi + 0x2c], 0
mov eax, dword [rdi + 0x94]
cmp eax, r14d
jbe 0x140007bbd
jmp 0x140007bc6
cmp ecx, 0x29a
je 0x140007ae7
cmp ecx, 0x2a
jne 0x140007ab7
jmp 0x140007ae7
cmp dword [rdi + 0xf0], 0
jne 0x140007ab7
mov dword [rdi + 0x2c], 0
mov eax, dword [rdi + 0x94]
cmp eax, r14d
ja 0x140007bc6
test ebp, ebp
jne 0x140007bbd
mov rax, qword [rdi + 0xb8]
mov ecx, dword [rdi + 0xc4]
dec ecx
mov word [rax + rcx*2], 0
mov rcx, qword [rdi + 0xb8]
mov r8d, dword [rdi + 0xc4]
dec r8d
add r8, r8
xor edx, edx
call fcn.140268830
mov dword [rdi + 0xe8], 0
mov dword [rdi + 0xd8], 0
mov dword [rdi + 0x1760], 0
mov eax, dword [rdi + 0x94]
sub r14d, eax
add rbx, r14
mov r14d, eax
mov r15d, dword [rsi + 8]
mov r12, qword [rsi]
mov dword [rsi + 8], r14d
mov qword [rsi], rbx
mov rcx, rdi
call fcn.140007cf0
mov r14d, dword [rdi + 0xf0]
cmp r14d, 3
jae 0x140007c60
mov eax, dword [rdi + 0xe8]
add eax, r14d
mov dword [rdi + 0xe8], eax
mov dword [rdi + 0xd8], eax
mov dword [rdi + 0x1760], r14d
movabs rax, 0x200000000
mov qword [rdi + 0xf0], rax
mov dword [rdi + 0xdc], 2
mov dword [rdi + 0xe4], 0
mov qword [rsi], r12
mov dword [rsi + 8], r15d
mov dword [rdi + 0x2c], ebp
xor eax, eax
jmp 0x140007ab7
mov dword [rdi + 0xe8], ebx
mov dword [rdi + 0xf0], 2
mov rcx, rdi
call fcn.140007cf0
mov r14d, dword [rdi + 0xf0]
cmp r14d, 2
jbe 0x140007be9
mov ebx, dword [rdi + 0xe8]
add r14d, 0xfffffffe
jmp 0x140007cd7
mov eax, dword [rdi + 0xc0]
movzx ecx, byte [rdi + 0xd0]
shl eax, cl
movzx ecx, bx
mov rdx, qword [rdi + 0xa0]
mov r8, qword [rdi + 0xb0]
movzx edx, byte [rcx + rdx + 2]
xor edx, eax
and edx, dword [rdi + 0xcc]
mov dword [rdi + 0xc0], edx
mov rax, qword [rdi + 0xb8]
movzx eax, word [rax + rdx*2]
mov edx, dword [rdi + 0x9c]
and edx, ecx
mov word [r8 + rdx*2], ax
mov rax, qword [rdi + 0xb8]
mov edx, dword [rdi + 0xc0]
mov word [rax + rdx*2], cx
inc ebx
dec r14d
je 0x140007c3b
cmp dword [0x1403a1688], 0
je 0x140007c70
mov rcx, rdi
mov edx, ebx
call fcn.140009d10
jmp 0x140007ccc
Function at 0x14000e670
Capabilities:
Create tcp socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rsi, [rcx + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_EnterCriticalSection
mov ecx, 0x180
call fcn.140023440
mov rbx, rax
lea r14, [rax + 0x58]
lea rcx, [rax + 0x48]
movaps xmm0, xmmword [0x14029fa10]
movups xmmword [rax + 0x28], xmm0
mov r8d, 0x130
xor edx, edx
call fcn.140268830
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x20], rax
mov r10, qword [rdi + 0xd0]
xorps xmm0, xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx], xmm0
mov rcx, qword [rdi + 0xa0]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
mov rdx, rax
mov r8, r14
xor r9d, r9d
call r10
test eax, eax
jne 0x14000e732
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14000e73d
inc dword [rdi + 0xd8]
mov dil, 1
jmp 0x14000e761
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rbx
call fcn.14026e508
mov ecx, edi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov rcx, rsi
call fcn.1400f5920
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140265fe0
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000e790
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdi, [rcx + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_EnterCriticalSection
test byte [rbx + 0x9c], 1
jne 0x14000e7fc
mov rax, qword [rbx + 0xa0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsi + 0x20]
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14000e838
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
dec dword [rbx + 0xd8]
mov rcx, rsi
call fcn.14026e508
mov rcx, rdi
call fcn.1400f5920
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0xe0
call fcn.140266260
mov r15, rax
mov r12, qword [rsi + 0x20]
mov qword [rax + 8], 1
mov qword [rax + 0x18], r12
lea rax, method.icu_68::LanguageBreakEngine.virtual_0
mov qword [r15], rax
lea rax, method.icu_68::LanguageBreakEngine.virtual_0
mov qword [r15 + 0x10], rax
lea rcx, [r15 + 0x20]
call fcn.1400f58d0
mov qword [r15 + 0x58], r12
mov qword [r15 + 0x60], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [r15 + 0x68], xmm0
movups xmmword [r15 + 0x78], xmm0
mov dword [r15 + 0x88], 0
mov eax, dword [0x1402fe190]
mov dword [r15 + 0x8c], eax
mov qword [r15 + 0x90], 0
mov word [r15 + 0x98], 0
mov dword [r15 + 0x9c], 0
mov qword [r15 + 0xa0], r12
mov qword [r15 + 0xa8], 0
mov dword [r15 + 0xb0], reloc.WS2_32.dll_recv
mov qword [r15 + 0xb8], 0
mov byte [r15 + 0xc0], 1
lea rax, [0x14029fc40]
mov qword [r15], rax
lea rax, [0x14029fca0]
mov qword [r15 + 0x10], rax
lea rax, [r15 + 0xc8]
movups xmmword [r15 + 0xc8], xmm0
mov word [r15 + 0xd8], 0
movups xmm1, xmmword [0x14029fba8]
movaps xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x38], xmm0
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
lea r8, [rsp + 0x60]
mov rcx, r12
mov edx, 0xc8000006
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [r15 + 0x50], 3
mov byte [r15 + 0xd8], 1
lock inc qword [r15 + 8]
mov rcx, qword [r15 + 0x58]
mov rdx, r14
mov r8, r15
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [r15 + 0x60], rax
cmp qword [rbx + 0xe0], 0
je 0x14000e9a9
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xd0], r15
jmp 0x14000e9b0
mov qword [rbx + 0xe0], r15
mov qword [rbx + 0xe8], r15
inc dword [rbx + 0xf0]
jmp 0x14000e806
Function at 0x14000f850
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
test rdx, rdx
je 0x14000f865
mov rcx, rdx
call fcn.14026e508
mov rcx, qword [rsi + 0xa0]
mov dword [rsp + 0x20], 0
mov edx, 0xffff
mov r8d, 0x7010
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_setsockopt]
test byte [rsi + 0x9c], 2
jne 0x14000f8a9
lea rcx, [rsi + 0x10]
mov rax, qword [rsi + 0x10]
call qword [rax + 0x40]
test al, 1
je 0x14000f8a9
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
test byte [rsi + 0x9c], 4
jne 0x14000f8c4
mov rax, qword [rsi + 0x10]
add rsi, 0x10
mov rcx, rsi
call qword [rax + 0x40]
test al, 2
jne 0x14000f8ca
add rsp, 0x30
pop rsi
ret
mov rax, qword [rsi]
mov edx, 2
mov rcx, rsi
call qword [rax + 0x28]
mov rcx, rax
mov edx, 2
add rsp, 0x30
pop rsi
jmp fcn.1400e99d0

Function at 0x140013080
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400130cd
mov esi, eax
cdqe
inc esi
lea rcx, [rax*2 + 2]
call sym.dart_precompiled_runtime_product.exe_Dart_ScopeAllocate
mov rdi, rax
mov ecx, esi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rdi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f5c00
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400130e0
Capabilities:
Set current directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rcx, rdx
call fcn.1400f2bb0
mov rsi, rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rax
mov r9d, 0xffffffff
call rbx
movsxd r14, eax
lea rcx, [r14 + r14]
call fcn.140023440
mov rdi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rdi
call fcn.14026e508
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140013700
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140265fe0
mov eax, esi
add rsp, 0x60
pop rsi
ret
Function at 0x140013a60
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14001ef20
test al, al
je 0x140013a87
mov rcx, rdi
mov edx, esi
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
sete al
jmp 0x140013a89
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140013a90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140013b41
mov rsi, rax
xor r14d, r14d
mov rbx, rax
jmp 0x140013ad3
inc r14
mov rcx, rbx
call fcn.1402792b4
lea rbx, [rbx + rax*2]
add rbx, 2
movzx eax, word [rbx]
cmp eax, 0x3d
je 0x140013ac3
test eax, eax
jne 0x140013ac0
mov qword [rdi], r14
lea rcx, [r14*8]
call sym.dart_precompiled_runtime_product.exe_Dart_ScopeAllocate
mov rdi, rax
test r14, r14
jle 0x140013b36
xor r15d, r15d
mov rbx, rsi
jmp 0x140013b15
mov rcx, rbx
call fcn.1402792b4
lea rbx, [rbx + rax*2]
add rbx, 2
cmp r15, r14
jge 0x140013b36
cmp word [rbx], 0x3d
je 0x140013b00
mov rcx, rbx
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.1400f5c00
mov qword [rdi + r15*8], rax
inc r15
jmp 0x140013b00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140013b43
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140015c80
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [rcx + 8]
test rax, rax
je 0x140015cad
add qword [rsi + 0x40], rax
mov rdi, qword [rsi + 0x48]
sub rdi, rax
mov qword [rsi + 0x48], rdi
jmp 0x140015cb1
mov rdi, qword [rsi + 0x48]
lea r14, [rsi + 0x30]
mov byte [rsi + 0x50], 0
xorps xmm6, xmm6
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
nop word cs:[rax + rax]
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
mov rax, qword [rsi + 0x28]
mov qword [rsi + 0x18], rax
test rdi, rdi
je 0x140015d00
mov rbx, qword [rsi + 0x38]
mov edx, 0x4000
sub rdx, rdi
jmp 0x140015d49
mov ecx, reloc.WS2_32.dll_recv
call fcn.140266260
mov rbx, rax
mov edi, 0x4000
mov ecx, 0x4000
call fcn.140266008
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov rax, qword [rsi + 0x38]
add rax, 8
cmp qword [rsi + 0x30], 0
cmove rax, r14
mov qword [rax], rbx
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x48], 0x4000
xor edx, edx
add rdx, qword [rbx]
mov byte [rsi + 0x50], 1
mov rcx, qword [rsi + 0x20]
mov qword [rsp + 0x20], rsi
mov r8d, edi
xor r9d, r9d
call r15
test eax, eax
je 0x140015d82
mov rax, qword [rsi + 8]
mov rdi, qword [rsi + 0x48]
add qword [rsi + 0x40], rax
sub rdi, rax
mov qword [rsi + 0x48], rdi
mov byte [rsi + 0x50], 0
jmp 0x140015cd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete al
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140015db0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [0x1403a16f8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x1403a16f0]
test rax, rax
je 0x140015ded
nop word cs:[rax + rax]
cmp dword [rax], esi
je 0x140015e12
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x140015de0
mov rcx, rdi
call fcn.1400a1310
xor edi, edi
mov ecx, 1
xor edx, edx
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140015e1e
jmp 0x140015e32
mov rsi, qword [rax + 8]
mov rcx, rdi
call fcn.1400a1310
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400162a0
Capabilities:
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
test r8d, r8d
je 0x140016364
mov ebx, r8d
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
mov rcx, rdi
mov edx, 0x40000001
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1400163f0
xor eax, eax
cmp ebx, 1
lea r9, [rsp + 0x40]
cmovne r9, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000100
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x40000000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
jmp 0x1400163d8
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
mov rcx, rdi
mov edx, 0x40000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400163f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x40]
mov rcx, rdi
mov edx, 0x80000000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov sil, 1
cmp rax, 0xffffffffffffffff
jne 0x140016406
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFile_failed__d_n
jmp 0x1400163fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateNamedPipe_failed__d_n
mov edx, eax
call fcn.140001240
xor esi, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140265fe0
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001ef20
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, qword [0x1403a1780]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov bl, 1
cmp byte [0x1403a1788], 0
jne 0x14001ef88
lea rdx, [rsp + 0x28]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete bl
je 0x14001ef81
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.Unable_to_initialize_Winsock:__d_n
mov edx, eax
call fcn.140001240
jmp 0x14001ef88
mov byte [0x1403a1788], 1
mov rcx, rsi
call fcn.1400a1310
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140265fe0
mov eax, ebx
add rsp, 0x1c8
pop rbx
pop rsi
ret

Function at 0x14001f080
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x24], 0x80
mov rcx, qword [rcx + 0xa0]
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14001f0cd
lea rcx, [rsp + 0x28]
call fcn.14001e9f0
mov rsi, rax
jmp 0x14001f0cf
xor esi, esi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
add rsp, 0xb0
pop rsi
ret