joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402bd3ec
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140297968
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1402bd476
cmp byte [rbp - 0x21], r15b
je 0x1402bd471
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1402bd4ac
call fcn.1402accf0
test eax, eax
jne 0x1402bd498
cmp byte [rbp - 0x21], r15b
je 0x1402bd490
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1402bd4ac
cmp byte [rbp - 0x21], r15b
je 0x1402bd4a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1402a105c
test eax, eax
jne 0x1402bd54c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140297968
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1402bd4eb
cmp byte [rbp - 0x21], r15b
je 0x1402bd520
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1402bd520
call fcn.1402accf0
test eax, eax
jne 0x1402bd50c
cmp byte [rbp - 0x21], r15b
je 0x1402bd505
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1402bd520
cmp byte [rbp - 0x21], r15b
je 0x1402bd51d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1402a105c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1402bd54c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1402bd54f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1402bd55d
mov rcx, rdi
call fcn.1402ab228
cmp byte [rbp + 0x3f], r15b
je 0x1402bd56c
mov rcx, qword [rbp + 0x27]
call fcn.1402ab228
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1402bde10
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1402b0358
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1402b0358
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1402bdf60
cmp rax, 0xffffffffffffffff
je 0x1402bdf60
xor edi, edi
test rbp, rbp
jle 0x1402bdf0b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1402ac958
mov rbx, rax
test rax, rax
jne 0x1402bde98
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1402bdf01
mov edx, 0x8000
mov ecx, r14d
call fcn.1402a349c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1402b1bfc
cmp eax, 0xffffffff
je 0x1402bdee1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1402bdea8
mov edx, r15d
mov ecx, r14d
call fcn.1402a349c
jmp 0x1402bdf01
cmp byte [rsi + 0x38], dil
je 0x1402bdef8
cmp dword [rsi + 0x34], 5
jne 0x1402bdef8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x1402bdf01
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1402ab228
jmp 0x1402bdf74
jns 0x1402bdf74
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1402b0358
cmp rax, 0xffffffffffffffff
jne 0x1402bdf2c
cmp byte [rsi + 0x30], dil
je 0x1402bdf74
mov edi, dword [rsi + 0x2c]
jmp 0x1402bdf74
mov ecx, r14d
call fcn.1402b3eb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1402bdf74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1402bdf74
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1402bdf6d
mov eax, dword [rsi + 0x2c]
jmp 0x1402bdf72
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1402b0358
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1402c26ac
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140352440]
mov rbp, rcx
call fcn.1402b7a24
xor edi, edi
test rax, rax
je 0x1402c2792
mov ebx, edi
call fcn.14028f26c
mov r14d, dword [rax]
call fcn.14028f26c
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.1402c2be8
mov rsi, rax
test rax, rax
je 0x1402c2723
call fcn.14028f26c
mov dword [rax], r14d
jmp 0x1402c274d
call fcn.14028f26c
cmp dword [rax], 0x22
jne 0x1402c278a
call fcn.14028f26c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1402c2be8
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1402c278a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1402c2751
cmp rax, 3
je 0x1402c276c
mov rcx, rsi
call fcn.1402c2608
test al, al
je 0x1402c277d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1402c277d
mov dil, 1
mov rcx, rbx
call fcn.140294df4
mov al, dil
jmp 0x1402c2794
mov rcx, rbx
call fcn.140294df4
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14027f960
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140134c90
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 0x20], r9
xchg r8, r13
mov qword [rsp + 0x18], r13
xchg r8, r13
mov dword [rsp + 0x10], edx
jmp 0x140134cc1
invalid
jmp 0x140134d49
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
xchg rbx, rax
mov qword [rsp + 0x10], rax
jmp 0x140134ca9
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, [0x140134ef0]
xchg r14, rax
mov qword [rsp + 0x18], r14
xchg r14, rax
mov dword [rsp + 8], 0
jmp 0x140134cae
mov rax, qword [rsp + 0x10]
inc rax
xchg r10, rax
mov qword [rsp + 0x10], r10
xchg r10, rax
je 0x140134d12
jne 0x140134d12
syscall
ret
jmp 0x140134d49
xchg r10, rax
cmp qword [rsp + 0x10], rax
jae 0x140134ee6
mov byte [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140134d44
jmp 0x140134d91
mov eax, dword [rsp + 0x38]
xchg rcx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rcx
add rcx, rax
xchg r10, rax
mov r10, rcx
jmp 0x140134d26
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x140134d91
xchg rcx, rdi
mov rax, rdi
xchg rdi, rcx
cmp qword [rsp + 0x10], rax
jae 0x140134dfd
mov byte [rsp], 1
jmp 0x140134e02
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 4], eax
jae 0x140134e02
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8]
cmp qword [rsp + 0x10], rax
jmp 0x140134db6
jb 0x140134dfd
mov eax, dword [rsp + 4]
mov ecx, dword [rsp + 4]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rdx + rcx*4]
mov rdx, qword [rsp + 0x40]
add rcx, qword [rdx + rax*8]
jne 0x140134ddf
je 0x140134ddf
jmp rax
jmp 0x140134d74
jmp 0x140134d65
movzx eax, byte [rsp]
test eax, eax
je 0x140134e18
jmp 0x140134e13
jmp 0x140134ce7
xor edx, edx
mov eax, dword [rsp + 8]
mov ecx, 0x20
jmp 0x140134edb
xchg r12, rcx
mov r12, qword [rsp + 0x18]
xchg rcx, r12
je 0x140134e4f
jne 0x140134e4f
mul r13
jmp rax
jmp 0x140134e6d
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x10]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
jne 0x140134eb4
je 0x140134eb4
jmp 0x14013577c
jmp 0x140134ec5
mov rcx, qword [rsp + 0x10]
mov byte [rcx], al
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
jmp 0x140134ce7
div ecx
mov eax, edx
mov eax, eax
jmp 0x140134e28
add rsp, 0x28
ret
Function at 0x14001e4e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001e4ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001e4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14001e4e5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14001e515
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14001e502
sub eax, 3
jb 0x14001e52f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14001e566
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14001e556
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14001e554
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14001e543
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14001e4a2
jmp 0x14001e4ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7000
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14001e5b2
cmp rsi, rcx
jae 0x14001e5ba
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14001e599
cmp al, 0x8f
ja 0x14001e599
cmp byte [rsi - 2], 0xf
je 0x14001e59f
sub al, 0xe8
cmp al, 1
ja 0x14001e583
cmp rsi, rcx
jae 0x14001e5ba
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14001e589
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14001e5ba
lodsb al, byte [rsi]
jmp 0x14001e599
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1c000]
mov eax, dword [rdi]
or eax, eax
je 0x14001e617
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x29748]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14001e5c7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14001e611
mov qword [rbx], rax
add rbx, 8
jmp 0x14001e5e7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14001e651
cmp al, 0xef
ja 0x14001e643
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14001e623
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14001e632
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14001e6d0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14001e6d0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14001e6c0
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140004a70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
xor esi, esi
mov rdi, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov rdx, qword [rax]
mov qword [rbx + 0x28], rdx
mov byte [rdi + 0xdc6], 1
mov byte [rdi + 0x4bf], sil
mov byte [rbx + 0x18], 1
mov ecx, 0xfffffffe
lea rax, [rbx + 0x11c]
nop word [rax + rax]
mov dword [rax], 0xfffffffe
mov dword [rax + 4], ecx
mov dword [rax + 0xc], 0xffffffff
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], esi
mov dword [rax + 0x1c], ecx
mov dword [rax + 0x24], 1
mov dword [rax + 0x28], ecx
mov dword [rax + 0x30], 2
mov dword [rax + 0x34], ecx
lea rax, [rax + 0x3c]
inc ecx
cmp ecx, 2
jle 0x140004ad0
mov qword [rbx + 0x1ac], rsi
cmp byte [rbx + 0xc0], sil
je 0x140004b95
cmp qword [rbx + 0xd8], rsi
jne 0x140004b47
lea rdx, [rdi + 0x300]
lea rcx, [rbx + 0xc8]
cmp rcx, rdx
je 0x140004b47
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140004b42
mov rdx, qword [rdx]
call fcn.1400069b0
cmp dword [rbx + 0x108], esi
jne 0x140004b95
cmp dword [rbx + 0x10c], esi
jne 0x140004b95
movss xmm0, dword [rdi + 0x448]
mulss xmm0, dword [0x1401d1f9c]
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
cvttss2si eax, xmm0
mov dword [rbx + 0x108], eax
movss xmm0, dword [rdi + 0x44c]
mulss xmm0, dword [0x1401d1f9c]
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
cvttss2si eax, xmm0
mov dword [rbx + 0x10c], eax
mov ecx, reloc.WS2_32.dll_recv
call fcn.14012adc0
mov qword [rax], rbx
lea rcx, [0x140006700]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400071e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140004c47
cmp dword [rbx + 0x10], 0
jne 0x140004c40
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rbx + 8], xmm1
cmp dword [rbx + 0x10], 0
je 0x140004c34
movaps xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140004c34
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012ada0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400072e0
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x1401fc4b0]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x1400072fc
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14000730a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140007315
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140007320
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14000732b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140007336
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140007341
bts eax, 1
test cl, 2
je 0x14000734a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
mov edx, 0x1e
cmovns r8d, eax
xor ecx, ecx
test r8b, 1
je 0x1400073e3
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x1400073ef
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x1400073d7
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x1400072f0
mov dword [0x1401fc4a8], 1
ret
Function at 0x140008510
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x40], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14000853f
xor eax, eax
jmp 0x1400086fa
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x1400086d7
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xd0]
jne 0x1400086d7
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xc8]
jne 0x1400086d7
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xcc]
jne 0x1400086d7
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x1400086d7
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.1400076e0
cmp rsi, qword [rbx + 0x50]
jae 0x1400085c5
mov qword [rbx + 0x50], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x1400085ff
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xfc]
jae 0x14000860d
mov dword [rbx + 0xfc], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x140008626
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0x100]
jae 0x140008634
mov dword [rbx + 0x100], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x58], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x5c], eax
mov dword [rbp + 0x80], 1
mov ecx, dword [rbx + 0x40]
test r14, r14
je 0x1400086bc
lea eax, [rcx - 5]
cmp eax, 1
jbe 0x140008682
cmp dword [rbx + 0x58], 0
je 0x140008677
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b60]
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b58]
xor eax, eax
mov dword [rbx + 0x40], 5
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0xa0], rax
mov dword [rbx + 0xac], eax
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1f8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x1400086f5
xor eax, eax
mov rdx, rbx
cmp ecx, 1
mov rcx, rbp
sete al
lea r8d, [rax + 3]
call fcn.1400074a0
xor eax, eax
jmp 0x1400086f5
xor eax, eax
mov r8d, 9
mov rdx, rbx
mov dword [rbx + 0x1f8], eax
mov rcx, rbp
call fcn.1400074a0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000c350
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
cmp dword [0x1401fbc18], ebx
jne 0x14000c406
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x48]
mov edi, 1
mov dword [0x1401fbc18], edi
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
mov dword [0x1401fbc1c], eax
test eax, eax
je 0x14000c3b9
lea rcx, [0x1401fd060]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
divsd xmm0, qword [0x1401d20f8]
jmp 0x14000c3f9
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x107b2
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x26], rdi
mov word [rsp + 0x2e], bx
call qword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
movsd xmm0, qword [0x1401d20a8]
shl rcx, 0x20
or rcx, rax
mov qword [0x1401fd060], rcx
mov rdi, qword [rsp + 0x70]
movsd qword [0x1401fd068], xmm0
cmp dword [0x1401fbc1c], ebx
je 0x14000c420
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
jmp 0x14000c43f
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
shl rax, 0x20
or rax, rcx
mov qword [rsp + 0x40], rax
sub rax, qword [0x1401fd060]
xorps xmm0, xmm0
movabs r9, 0x431bde82d7b634db
cvtsi2sd xmm0, rax
mov rax, r9
divsd xmm0, qword [0x1401fd068]
cvttsd2si rcx, xmm0
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xf4240
sub ecx, eax
imul eax, ecx, 0x3e8
movsxd r8, eax
movsxd rax, edx
imul rcx, rax, 0x3b9aca00
add r8, rcx
lock xadd qword [0x1401fbc20], rbx
test rbx, rbx
jne 0x14000c4be
lea rcx, [r8 - 0xf4240]
xor eax, eax
lock cmpxchg qword [0x1401fbc20], rcx
mov rbx, rax
cmove rbx, rcx
sub r8, rbx
mov rax, r9
mul r8
shr rdx, 0x12
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14012ada0
add rsp, 0x60
pop rbx
ret
Function at 0x14000c4e0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
mov rax, rdx
lea r8, [rsp + 0x28]
mov rbx, rcx
xor edi, edi
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor edx, edx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14000c53d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000c58a
jmp 0x14000c584
mov r9, qword [rsp + 0x20]
mov rax, r9
test r9, r9
je 0x14000c58a
nop word [rax + rax]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x14000c578
mov ecx, dword [rax + 4]
cmp ecx, 2
je 0x14000c5cc
test ecx, ecx
jne 0x14000c573
cmp qword [rax + 0x10], 0x10
je 0x14000c5cc
cmp qword [rax + 0x10], 0x1c
jmp 0x14000c576
cmp ecx, 0x17
je 0x14000c5aa
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14000c550
mov rcx, r9
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012ada0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
movups xmm0, xmmword [rdx + 8]
mov rcx, r9
movups xmmword [rbx], xmm0
mov rdx, qword [rax + 0x20]
movzx r8d, word [rdx + 0x18]
mov word [rbx + 0x12], r8w
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14000c58f
mov eax, dword [rdx + 4]
test eax, eax
jne 0x14000c5ee
movups xmm0, xmmword [0x1401569c0]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14000c58f
cmp eax, 0xffffffff
jne 0x14000c60e
movups xmm0, xmmword [0x1401569e0]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14000c58f
movups xmm0, xmmword [0x1401569d0]
mov ecx, eax
shr ecx, 8
movups xmmword [rbx], xmm0
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xc], al
mov byte [rbx + 0xe], cl
mov rcx, r9
shr eax, 0x18
mov word [rbx + 0xa], 0xffff
mov byte [rbx + 0xf], al
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14000c58f