joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401464aa
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14023d740
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp dword [rsp + 0x58], 0
je 0x14023d775
mov dword [rsp + 0x34], 1
jmp 0x14023d77d
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14014a9ba
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x140146ae5
Capabilities:
Delete file

Disassembly:
jmp 0x1403c7a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1403c7a4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140146fe5
mov eax, 0xffffffff
jmp 0x1403c7a4e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401471ca
Capabilities:
Move file

Disassembly:
jmp 0x1401d98d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
lea rdi, [rsp + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x140471b00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x3e8
lea rcx, [rsp + 0x78]
call fcn.14014b225
lea rcx, [rsp + 0x38]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xf0]
call fcn.14014ba4f
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xf8]
call fcn.14014ba4f
mov qword [rsp + 0x60], rax
mov r8d, 1
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1401d99b7
cmp qword [rsp + 0x58], 0
je 0x1401d998b
mov rcx, qword [rsp + 0x58]
call fcn.1401476a7
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1401d9970
cmp qword [rsp + 0x60], 0
je 0x1401d99ac
mov rcx, qword [rsp + 0x60]
call fcn.1401476a7
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1401d9991
jmp 0x1401d9a7a
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x88]
call fcn.14014b225
lea rcx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.14014c477
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jl 0x1401d9a21
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
jle 0x1401d9a6a
cmp qword [rsp + 0x58], 0
je 0x1401d9a3c
mov rcx, qword [rsp + 0x58]
call fcn.1401476a7
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1401d9a21
cmp qword [rsp + 0x60], 0
je 0x1401d9a5d
mov rcx, qword [rsp + 0x60]
call fcn.1401476a7
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1401d9a42
mov eax, 1
jmp 0x1401d9a7c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401d9956
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14014a9ba
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14014847b
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x1401480de
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1402e5150
mov rax, rcx
neg rcx
test rax, 7
je 0x1402e516d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1402e51c8
test al, 7
jne 0x1402e5160
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1402e5181
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402e51f2
test dh, dh
je 0x1402e51ec
shr rdx, 0x10
test dl, dl
je 0x1402e51e6
test dh, dh
je 0x1402e51e0
shr rdx, 0x10
test dl, dl
je 0x1402e51da
test dh, dh
je 0x1402e51d4
shr edx, 0x10
test dl, dl
je 0x1402e51ce
test dh, dh
jne 0x1402e5181
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x140148124
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403be240
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1403bddc0
lea rcx, [rsp + 0x20]
call fcn.1403bde10
movzx eax, al
test eax, eax
jne 0x1403be285
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1403bddf0
mov rax, qword [rsp + 0x40]
jmp 0x1403be37f
lea rcx, [rsp + 0x20]
call fcn.1403bdf10
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1403bdeb0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1401485c0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14014788c
lea rcx, [rsp + 0x28]
call fcn.140148bd3
movzx eax, al
test eax, eax
jne 0x1403be31f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14014a6d1
lea rcx, [rsp + 0x20]
call fcn.1403bddf0
mov rax, qword [rsp + 0x50]
jmp 0x1403be37f
lea rcx, [rsp + 0x20]
call fcn.1403bdf10
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14014bbb7
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1401484b2
lea rcx, [rsp + 0x28]
call fcn.14014c828
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14014a6d1
lea rcx, [rsp + 0x20]
call fcn.1403bddf0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1401487c8
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1402d9cf0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402d9670
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d9d2f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140497020]
jmp 0x1402d9d39
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140148acf
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403bdf90
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1403bddc0
lea rcx, [rsp + 0x40]
call fcn.1403bdf40
movzx eax, al
test eax, eax
jne 0x1403bdfd8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1403bddf0
mov rax, qword [rsp + 0x70]
jmp 0x1403be1a9
lea rcx, [rsp + 0x40]
call fcn.1403bdf10
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1403bdeb0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1403bdf10
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14014a1d6
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1403be07e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1403bddf0
mov rax, qword [rsp + 0x80]
jmp 0x1403be1a9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1401485c0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1401482eb
lea rcx, [rsp + 0x48]
call fcn.140147b4d
movzx eax, al
test eax, eax
jne 0x1403be0e5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1401460bd
lea rcx, [rsp + 0x40]
call fcn.1403bddf0
mov rax, qword [rsp + 0x88]
jmp 0x1403be1a9
lea rcx, [rsp + 0x48]
call fcn.14014913c
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1403bdf10
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14014a1d6
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1403be17b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1401460bd
lea rcx, [rsp + 0x40]
call fcn.1403bddf0
mov rax, qword [rsp + 0xa0]
jmp 0x1403be1a9
lea rcx, [rsp + 0x48]
call fcn.140148291
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1401460bd
lea rcx, [rsp + 0x40]
call fcn.1403bddf0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140148afc
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402d9c20
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1402d95f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d9c61
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140497020]
jmp 0x1402d9c67
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140148be2
Capabilities:
Get geographical location

Disassembly:
jmp 0x1403a9280
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1403a81f0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1403a92e7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140497030]
jmp 0x1403a9309
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140147aa8
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140148bfb
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b4b10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401490ab
Capabilities:
Print debug messages

Disassembly:
jmp 0x1403cd0f0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140471b00]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1403cd116
jmp 0x1403cd193
mov rcx, qword [rbp + 0x30]
call fcn.1401480de
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1403cd12f
jmp 0x1403cd193
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1403cd14c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140146360
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140146b9e
test eax, eax
jne 0x1403cd193
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14014847b
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140149263
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1401ae500
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x30]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x230]
mov rax, qword [0x140471b00]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x230]
and eax, 2
test eax, eax
je 0x1401ae5d7
mov eax, 0x202
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1f4], eax
cmp dword [rsp + 0x1f4], 0
je 0x1401ae57d
mov eax, 2
jmp 0x1401ae72b
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x38]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1401ae5c7
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x38]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1401ae5d7
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1401ae72b
call fcn.14014bf90
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
je 0x1401ae5f9
mov eax, dword [rsp + 0x1f8]
jmp 0x1401ae72b
lea rcx, str.iphlpapi.dll
call fcn.14014b121
mov qword [0x140474700], rax
cmp qword [0x140474700], 0
je 0x1401ae64c
lea rdx, str.if_nametoindex
mov rcx, qword [0x140474700]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x1401ae64c
mov rax, qword [rsp + 0x200]
mov qword [0x1404746e0], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401ae6b1
lea rdx, str.FreeAddrInfoExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404746e8], rax
lea rdx, str.GetAddrInfoExCancel
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404746f0], rax
lea rdx, str.GetAddrInfoExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404746f8], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14014aaa0
movzx eax, al
test eax, eax
je 0x1401ae6de
mov byte [0x140477544], 1
jmp 0x1401ae6e5
mov byte [0x140477544], 0
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
mov edx, 2
mov ecx, 6
call fcn.14014aaa0
movzx eax, al
test eax, eax
je 0x1401ae715
mov byte [0x140477539], 1
jmp 0x1401ae71c
mov byte [0x140477539], 0
lea rcx, [0x140477548]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14014a9ba
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14014847b
add rsp, 0x220
pop rdi
ret

Function at 0x1401495fb
Capabilities:
Set environment variable

Disassembly:
jmp 0x1403c00f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140149a6f
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402b7290
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402b72b0
xor al, al
jmp 0x1402b7331
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402b72c3
xor al, al
jmp 0x1402b7331
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402b72ed
xor al, al
jmp 0x1402b7331
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402b7301
xor al, al
jmp 0x1402b7331
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402b7313
xor al, al
jmp 0x1402b7331
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402b732f
xor al, al
jmp 0x1402b7331
mov al, 1
add rsp, 0x38
ret

Function at 0x140149d35
Capabilities:
Get common file path

Disassembly:
jmp 0x1403ade20
push rdi
sub rsp, 0x270
mov rax, qword [0x140471b00]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x1403ade79
lea rcx, [rsp + 0x50]
call fcn.1403adc10
jmp 0x1403adf4c
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], Ordinal_41
lea r9, [0x140431e70]
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.14014c66b
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14014788c
lea rcx, [rsp + 0x38]
call fcn.14014bbb7
test rax, rax
jne 0x1403adee1
call fcn.140147756
mov dword [rax], recv
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.14014a6d1
mov eax, dword [rsp + 0x40]
jmp 0x1403adf4c
lea rcx, [rsp + 0x38]
call fcn.14014bbb7
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1403adf28
call fcn.140147756
mov dword [rax], recv
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.14014a6d1
mov eax, dword [rsp + 0x48]
jmp 0x1403adf4c
lea rcx, [rsp + 0x38]
call fcn.14014bbb7
mov rcx, rax
call fcn.1403adc10
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.14014a6d1
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14014847b
add rsp, 0x270
pop rdi
ret
Function at 0x14014a569
Capabilities:
Terminate process

Disassembly:
jmp 0x1402dafe0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402db00e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14014b51d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14014b121
Capabilities:
Get common file path

Disassembly:
jmp 0x1401ae7e0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401ae81d
xor eax, eax
jmp 0x1401ae9b9
lea rdx, str.LoadLibraryExA
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
lea rdx, [0x140461460]
mov rcx, qword [rsp + 0x70]
call fcn.140147314
test rax, rax
je 0x1401ae889
cmp qword [rsp + 0x28], 0
je 0x1401ae86a
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x50], rax
jmp 0x1401ae87a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x1401ae9b4
cmp qword [rsp + 0x28], 0
je 0x1401ae8c3
lea rdx, str.AddDllDirectory
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401ae8c3
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x20], rax
jmp 0x1401ae9b4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1401ae9b4
mov rcx, qword [rsp + 0x70]
call fcn.1401480de
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
inc eax
mov eax, eax
add rax, qword [rsp + 0x40]
mov rcx, rax
call qword [fcn.14014903d]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401ae9a9
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401ae9a9
mov rcx, qword [rsp + 0x48]
call fcn.1401480de
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x140461478]
mov rcx, rax
call fcn.140147404
mov rcx, qword [rsp + 0x48]
call fcn.1401480de
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.140147404
cmp qword [rsp + 0x28], 0
je 0x1401ae98f
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [rsp + Ordinal_41]
mov qword [rsp + 0x58], rax
jmp 0x1401ae99f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
call qword [fcn.1401476a7]
mov rax, qword [rsp + 0x20]
add rsp, 0x60
pop rdi
ret
Function at 0x14014b4eb
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14021e500
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, Ordinal_27
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x74], 4
cmp dword [0x140474790], 0
jne 0x14021e581
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14014aaa0
movzx eax, al
test eax, eax
je 0x14021e577
mov dword [0x140474790], 2
jmp 0x14021e581
mov dword [0x140474790], 1
cmp dword [0x140474790], 2
jne 0x14021e58c
jmp 0x14021e5ea
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14021e5c4
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x54], eax
jle 0x14021e5c4
jmp 0x14021e5ea
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14014a9ba
add rsp, 0x90
pop rdi
ret
Function at 0x14014b5bd
Capabilities:
Print debug messages

Disassembly:
jmp 0x14039dcf0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14014b789
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1402d9d60
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402d96b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d9da9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140497020]
jmp 0x1402d9db8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14014b8ec
Capabilities:
Set environment variable

Disassembly:
jmp 0x1403d3170
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140147828
lea rcx, [rsp + 0x48]
call fcn.140147828
call fcn.140148a0c
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14014741d
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1403d31df
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140147f30
lea rcx, [rsp + 0x78]
call fcn.140147f30
mov eax, dword [rsp + 0x24]
jmp 0x1403d3270
call fcn.140148a0c
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14014741d
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1403d3226
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140147f30
lea rcx, [rsp + 0x78]
call fcn.140147f30
mov eax, dword [rsp + 0x2c]
jmp 0x1403d3270
lea rcx, [rsp + 0x48]
call fcn.1401476e3
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1401476e3
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140147f30
lea rcx, [rsp + 0x78]
call fcn.140147f30
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret