joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008bb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rdi, r9
mov rsi, rcx
test r9, r9
je 0x140008ca5
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov r9d, 0x2001b
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREFortemediaHowlingDection
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008c74
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x140008c6b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000c610
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rbx, str.SetRegByKeyName:__s__s_Reg_Set_fail_err_x_n
jmp 0x140008c7b
lea rbx, str.SetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.140006650
xor eax, eax
jmp 0x140008c4e
lea r8, str.SetRegByKeyName:_ValueName_or_SubkeyName_empty_n
mov edx, 1
call fcn.140006650
xor eax, eax
jmp 0x140008c53
Function at 0x140008cc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x80]
mov rdi, r9
mov qword [rsp + 0x30], 0
mov rsi, rcx
mov dword [rsp + 0x38], 4
test r9, r9
je 0x140008dab
test rbx, rbx
je 0x140008dab
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREFortemediaHowlingDection
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008d7c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140008d73
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 1
jmp 0x140008dbe
lea rbx, str.GetRegByKeyName:__s__s_Reg_Set_fail_err_x_n
jmp 0x140008d83
lea rbx, str.GetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r9, str.SOFTWAREFortemediaHowlingDection
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.140006650
jmp 0x140008dbc
lea r8, str.GetRegByKeyName:_ValueName_or_SubkeyName_or_pRetValue_empty_n
mov edx, 1
call fcn.140006650
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140009410
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r8d, dword [rcx + 0x21c]
mov rbx, rdx
mov dword [rsp + 0x34], 4
mov edx, 0xffffffff
mov dword [rsp + 0x30], edx
mov rdi, rcx
bt r8d, 0xf
jb 0x1400094a7
mov rcx, qword [rcx + 0x228]
test rcx, rcx
je 0x1400094ac
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_17
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r8d, dword [rdi + 0x21c]
mov edx, dword [rsp + 0x30]
test eax, eax
jne 0x1400094ac
test edx, edx
jne 0x1400094ac
movzx r8d, r8b
and r8d, 0x80
jmp 0x1400094b1
btr r8d, 0xf
bts r8d, 7
mov dword [rbx], r8d
mov r9d, dword [rdi + 0x220]
mov eax, dword [0x140050d64]
shl r9d, 0x10
and eax, 0x800
or r9d, eax
or r9d, r8d
mov dword [rbx], r9d
test byte [rdi + 0x270], 0x40
je 0x140009501
mov dword [rsp + 0x20], edx
lea r8, str.APO_Support_function_0x_x__key_value:_0x_x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140001140
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
Function at 0x140009530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x40]
mov ebx, r9d
call fcn.140011520
mov r9d, ebx
mov dword [rsp + 0x38], 0x200
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.140008450
test al, al
je 0x14000967b
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.d04e05a6_594b_4fb6_a80d_01af5eed7d1d_14
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140009672
test rbp, rbp
je 0x140009665
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
mov eax, dword [rsp + 0x88]
movups xmmword [rbp], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x80]
movups xmmword [rbp + 0x30], xmm1
movups xmm1, xmmword [rsp + 0x9e]
movsd qword [rbp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0x8e]
mov dword [rbp + 0x48], eax
mov eax, 0xa
mov word [rbp + 0x4c], ax
mov eax, dword [rsp + 0xd6]
movups xmmword [rbp + 0x4e], xmm0
movups xmm0, xmmword [rsp + 0xae]
movups xmmword [rbp + 0x5e], xmm1
movups xmm1, xmmword [rsp + 0xbe]
movups xmmword [rbp + 0x6e], xmm0
movsd xmm0, qword [rsp + 0xce]
movups xmmword [rbp + 0x7e], xmm1
movsd qword [rbp + 0x8e], xmm0
mov dword [rbp + 0x96], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, 1
jmp 0x14000967d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009c20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x38], 0
mov rdi, r9
mov rbx, rcx
je 0x140009da3
cmp edx, 1
jne 0x140009da3
cmp r8d, edx
jne 0x140009da3
mov eax, edx
lea rcx, str.OnDefaultDeviceChanged_eCapture__eMultimedia_n
mov word [0x140051070], ax
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor ebp, ebp
mov ecx, 0x114
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
call fcn.14000c668
mov rsi, rax
test rdi, rdi
je 0x140009d85
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], bp
jne 0x140009c96
mov edx, 0x80
mov r9, rsi
cmp ecx, edx
jg 0x140009cb1
lea eax, [rcx + 1]
movsxd rdx, eax
mov r8, rdi
mov rcx, r9
call fcn.140017e40
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 0x100], xmm0
mov dword [rsi + 0x110], ebp
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 0x28], rbp
jne 0x140009d55
mov ecx, dword [rbx + 0x30]
test rcx, rcx
je 0x140009cfe
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 0x18
jb 0x140009dba
lea rcx, [rcx + rcx*2]
shl rcx, 3
add rcx, 8
call fcn.140018980
test rax, rax
je 0x140009dba
mov rcx, qword [rbx + 0x20]
mov qword [rax], rcx
mov qword [rbx + 0x20], rax
mov r8d, dword [rbx + 0x30]
lea ecx, [r8 - 1]
lea rdx, [rcx*2 + 1]
add rdx, rcx
sub r8d, 1
lea rdx, [rax + rdx*8]
js 0x140009d55
nop dword [rax + rax]
mov rax, qword [rbx + 0x28]
mov qword [rdx], rax
mov qword [rbx + 0x28], rdx
sub rdx, 0x18
sub r8d, 1
jns 0x140009d40
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
mov qword [rcx + 0x10], rsi
mov qword [rbx + 0x28], rax
mov qword [rcx + 8], rdi
mov qword [rcx], rbp
inc qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140009d7d
mov qword [rax], rcx
jmp 0x140009d81
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov rbx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x2b0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 0x2b8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140003de0
int3
Function at 0x14000b9f0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14000ba77
mov rcx, qword [rbx + 0x10]
lea rax, str.CppWindowsService_in_OnStart
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 + 2]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xor r8d, r8d
lea rcx, [0x14000b9c0]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x14000baaa
lea r8d, [rax + 4]
mov rcx, rbx
lea rdx, str.CreateThreadpoolWork_failed
call fcn.14000c1c0
mov rax, qword [rbx + 0x48]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SubmitThreadpoolWork]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14000bad0
Capabilities:
Access the windows event log
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
xorps xmm0, xmm0
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x14000bb60
mov rcx, qword [rbx + 0x10]
lea rax, str.CppWindowsService_in_OnStop
mov qword [rsp + 0x40], rsi
lea edx, [rsi + 4]
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov qword [rsp + 0x58], rax
lea ecx, [rsi + 2]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, str.Stop_FMAPOCTL_service_r_n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor edx, edx
mov byte [0x140050d6a], 1
lea rcx, [0x140041f10]
lea r8d, [rdx + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
mov edx, eax
lea rcx, str.RpcServerUnregisterIf_returned:_0x_x_n
call fcn.140009e50
mov rdx, qword [0x140051088]
lea rcx, [0x140041f10]
xor r8d, r8d
call qword [sym.imp.RPCRT4.dll_RpcEpUnregister]
mov edx, eax
lea rcx, str.RpcEpUnregister_returned:_0x_x_n
call fcn.140009e50
cmp qword [0x140051088], rsi
je 0x14000bbd7
lea rcx, [0x140051088]
call qword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
mov qword [0x140051088], rsi
mov rbx, qword [rbx + 0x50]
test rbx, rbx
je 0x14000bc01
mov rcx, qword [rbx + 0x280]
mov byte [rbx + 0x2c0], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 0x288]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000c610
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000c1c0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000c246
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000c270
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14004e038]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000c319
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x140018ca0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140018b2b
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140018b2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018b2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018b2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018b2b
cmp dword [rcx + 0x84], 0xe
jbe 0x140018b2b
cmp dword [rcx + 0xf8], 0
je 0x140018b2b
mov ecx, ebx
call fcn.140018bcc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400189a8
cmp dword [rbp + 0x20], 0
je 0x140018b78
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140018b80
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018ac4
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test al, 0x17
invalid
Function at 0x1400030e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rcx + 0xd0]
mov r14, r9
mov rsi, rdx
mov rdi, rcx
test al, 0x20
je 0x140003135
mov eax, 1
mov dword [r9], eax
test rdx, rdx
je 0x14000312e
test r8d, r8d
je 0x14000312e
or ebx, 0xffffffff
jmp 0x1400031c6
xor ebx, ebx
jmp 0x1400031c6
mov rcx, qword [rcx + 0x30]
xor r9d, r9d
test al, al
jns 0x140003180
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
test eax, eax
jle 0x140003188
cmp byte [rdi + 0x28], 0
jne 0x140003188
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0x14], eax
movzx eax, word [rsp + 0x3a]
mov word [rdi + 0x10], ax
jmp 0x140003188
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
je 0x14000319b
jns 0x140003197
call fcn.140003044
test eax, eax
jne 0x14000319b
xor eax, eax
jmp 0x1400031a0
mov eax, 1
mov dword [r14], eax
test ebx, ebx
jle 0x1400031c6
test dword [rdi + 0xd0], 0x200
je 0x1400031c6
movsxd rdx, ebx
mov rcx, rsi
call fcn.140004130
mov rcx, rax
call fcn.140019e44
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012de0
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400031e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rcx + 0xd0]
mov r14, r9
movsxd rdi, r8d
mov rbp, rdx
mov rsi, rcx
test al, 0x20
je 0x140003231
mov eax, 1
mov dword [r9], eax
test rdx, rdx
je 0x14000322a
test r8d, r8d
je 0x14000322a
or ebx, 0xffffffff
jmp 0x1400032d3
xor ebx, ebx
jmp 0x1400032d3
xor r9d, r9d
mov r8d, edi
test al, al
jns 0x140003289
xor eax, eax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea eax, [r9 + 2]
mov word [rsp + 0x30], ax
movzx eax, word [rcx + 0x10]
mov word [rsp + 0x32], ax
mov eax, dword [rcx + 0x14]
mov rcx, qword [rcx + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
jmp 0x140003293
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test eax, eax
je 0x1400032a8
jns 0x1400032a4
call fcn.140003044
test eax, eax
jne 0x1400032a8
xor eax, eax
jmp 0x1400032ad
mov eax, 1
mov dword [r14], eax
test ebx, ebx
jle 0x1400032d3
test dword [rsi + 0xd0], 0x200
je 0x1400032d3
mov rdx, rdi
mov rcx, rbp
call fcn.140004130
mov rcx, rax
call fcn.140019e44
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140012de0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003408
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, 1
mov dword [rsp + 0x20], 4
mov rbx, rcx
mov dword [rsp + 0x40], r8d
mov rcx, qword [rcx + 0x30]
lea r9, [rsp + 0x40]
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x30]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x140003460
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov edi, dword [rcx + 0xd0]
lea rdx, [rsp + 0x40]
and edi, 0x80
mov rbx, rcx
call fcn.140002c14
mov eax, edi
neg eax
sbb edx, edx
xor r8d, r8d
neg edx
inc edx
lea esi, [r8 + 2]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
movsxd rcx, eax
mov qword [rbx + 0x30], rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400034da
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.socket__:__d
mov rcx, rbx
mov r8d, eax
call fcn.1400025ac
jmp 0x140003590
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140002558
test edi, edi
jne 0x140003590
mov rcx, qword [rbx + 0x30]
lea r8d, [rdi + 0x10]
xor eax, eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x32], ax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x34], eax
mov word [rsp + 0x30], si
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test eax, eax
jns 0x14000355d
call fcn.140003044
test eax, eax
je 0x14000355d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x14000355f
xor eax, eax
test eax, eax
je 0x14000357d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.connect:__d
mov rcx, rbx
mov r8d, eax
call fcn.1400025ac
jmp 0x140003585
mov rcx, rbx
call fcn.140003408
test edi, edi
jns 0x140003590
or dword [rbx + 0xd0], 0x10
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140012de0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret