joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f9060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov rbp, rcx
mov ecx, 0x18
mov rdi, rdx
mov rsi, r8
mov r12d, r9d
call fcn.1400e69e0
pxor xmm0, xmm0
mov edx, 0x40
mov qword [rax], 0
mov rbx, rax
mov rcx, rax
movups xmmword [rax + 8], xmm0
call fcn.1400e93d0
mov rax, qword [rbx]
mov byte [rax], 0
mov r8d, dword [rdi]
mov r9d, dword [rdi + 4]
cmp r8d, r9d
je 0x1400f91a8
lea rdx, str._d__d
mov rcx, rbx
call fcn.1400e9c90
test rsi, rsi
je 0x1400f90fc
mov r8d, dword [rsi]
mov r9d, dword [rsi + 4]
cmp r8d, r9d
je 0x1400f91e0
lea rdx, [0x1403ca896]
mov rcx, rbx
call fcn.1400e9c90
mov rax, qword [rbx + 8]
lea rdx, [rax + 1]
cmp rdx, qword [rbx + 0x10]
jae 0x1400f91c0
mov rcx, qword [rbx]
mov qword [rbx + 8], rdx
mov byte [rcx + rax], 0x3a
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov byte [rdx + rax], 0
mov r8, r14
mov rdx, r13
mov rcx, rbx
call fcn.1400e9b40
mov eax, dword [0x1404cb510]
mov rsi, qword [rbx]
test eax, eax
je 0x1400f9190
test rbp, rbp
je 0x1400f916a
cmp qword [rbp], 0
je 0x1400f9210
mov r9, rsi
lea r8, [0x1403ca8d8]
mov edx, 0x10
lea rcx, [0x1403ca0fa]
call fcn.1400d2190
mov rcx, qword [rbx]
call fcn.14034efb0
mov rdx, rbx
mov ecx, 0x18
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1400e6130
lea rcx, str.g_variant_parse_error_quark
call fcn.1400daa90
mov dword [0x1404cb510], eax
jmp 0x1400f913f
lea rdx, [0x1403ca88d]
mov rcx, rbx
call fcn.1400e9c90
jmp 0x1400f90d8
mov r8d, 0x3a
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400e9a70
jmp 0x1400f9124
lea rax, str.other__start___other__end
lea r9, str.parser_set_error_va
mov r8d, 0x73
mov qword [rsp + 0x20], rax
lea rdx, [0x1403ca56f]
lea rcx, [0x1403ca0fa]
call fcn.1400e7f70
nop dword [rax]
mov r8, rsi
mov edx, r12d
mov ecx, eax
call fcn.1400cac00
mov qword [rbp], rax
jmp 0x1400f916a
Function at 0x1400fd680
Capabilities:
Get geographical location

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
lea rcx, str.LC_ALL
call fcn.1400c71c0
test rax, rax
je 0x1400fd6a4
cmp byte [rax], 0
jne 0x1400fd7b8
lea rcx, str.LC_MESSAGES
call fcn.1400c71c0
test rax, rax
je 0x1400fd6be
cmp byte [rax], 0
jne 0x1400fd7b8
lea rcx, [0x1403cae56]
call fcn.1400c71c0
test rax, rax
je 0x1400fd6d8
cmp byte [rax], 0
jne 0x1400fd7b8
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea rdi, [rsp + 0x50]
mov r9d, 0x14
mov rsi, qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov r8, rdi
mov edx, 0x59
mov ecx, eax
call rsi
test eax, eax
je 0x1400fd7d0
lea rbp, [rsp + 0x30]
mov r9d, 0x14
mov edx, 0x5a
mov ecx, ebx
mov r8, rbp
call rsi
test eax, eax
je 0x1400fd7d0
mov eax, ebx
shr bx, 0xa
and eax, 0x3ff
cmp eax, 0x2c
je 0x1400fd7f0
cmp eax, 0x43
je 0x1400fd7f0
xor r12d, r12d
cmp eax, 0x1a
je 0x1400fd820
xor r8d, r8d
mov rcx, rdi
mov edx, 0xffffffff
call fcn.1402b36b0
xor r8d, r8d
mov rcx, rbp
mov edx, 0xffffffff
mov rsi, rax
call fcn.1402b36b0
mov r9, r12
lea rdx, [0x1403cae5d]
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov r8, rax
mov rdi, rax
call fcn.1400e4ea0
mov rcx, rdi
mov rbx, rax
call fcn.14034efb0
mov rcx, rsi
call fcn.14034efb0
mov rax, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400e4a90
lea rcx, [0x1403cae5b]
call fcn.1400e4a90
mov rbx, rax
mov rax, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, str._Latn
cmp bx, 1
je 0x1400fd74e
cmp bx, 2
lea r12, str._Cyrl
mov eax, 0
cmovne r12, rax
jmp 0x1400fd74e
and ebx, 0xfffffffb
lea r12, str._Latn
mov eax, 0
cmp bx, 2
cmovne r12, rax
jmp 0x1400fd74e

Function at 0x1401001a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [0x14048d860]
mov rsi, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi]
mov ebx, eax
test eax, eax
jne 0x140100229
mov rbp, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rbp
mov ebx, eax
test eax, eax
jne 0x1401001df
call rbp
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsFree]
lea eax, [rbx - 1]
cmp eax, 0xfffffffd
ja 0x14010024b
mov rbp, qword [rsi + 8]
test rbp, rbp
je 0x14010021e
mov ecx, 0x18
call sub.msvcrt.dll_malloc
mov rdx, rax
test rax, rax
je 0x140100260
mov dword [rax], ebx
mov qword [rax + 8], rbp
mov rax, qword [0x1404cb560]
mov qword [rdx + 0x10], rax
lock cmpxchg qword [0x1404cb560], rdx
jne 0x140100274
mov edx, ebx
xor eax, eax
lock cmpxchg qword [rsi], rdx
jne 0x14010023d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.g_private_get_impl_2_
xor ecx, ecx
call fcn.1401000d0
lea rdx, str.TlsAlloc
xor ecx, ecx
call fcn.1401000d0
nop dword [rax]
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.malloc
mov ecx, dword [rax]
call fcn.1401000d0
lea rdx, str.g_private_get_impl_1_
xor ecx, ecx
call fcn.1401000d0
nop
nop word cs:[rax + rax]
nop
Function at 0x140100290
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, rdx
mov qword [rsp + 0x60], r8
mov rsi, rcx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x68], r9
mov r8, rax
lea r9, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], r9
call fcn.1402b7d40
mov rbx, rax
test rax, rax
je 0x1401002f0
mov r8, qword [rsp + 0x28]
mov r9, rsi
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
mov rsi, rax
call fcn.14034efb0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
mov eax, 0xffffffff
jmp 0x1401002e9

Function at 0x14010e270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x14035cce0]
lea rdi, [0x14035cce0]
mov rsi, rcx
mov ecx, eax
test eax, eax
jne 0x14010e299
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14010e360
lea rbp, [0x1404cb558]
lea rdi, [0x1404cb538]
mov rcx, rbp
call fcn.140341618
call qword [sym.imp.KERNEL32.dll_GetACP]
lea rdx, str.CP_u
mov rcx, rdi
mov r8d, eax
call fcn.1400f7a00
mov rcx, rbp
call fcn.140341260
mov rbp, qword [rbx + 8]
test rbp, rbp
je 0x14010e2f9
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14010e348
mov rcx, rbp
call fcn.14034efb0
mov rcx, qword [rbx + 0x10]
call fcn.14034efb0
mov rcx, rdi
call fcn.1400e4a90
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov qword [rbx + 8], rax
call fcn.14010e0d0
mov rcx, qword [rsp + 0x38]
mov dword [rbx], eax
call fcn.1400e4a90
mov qword [rbx + 0x10], rax
mov qword [rsi], rax
mov eax, dword [rbx]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rbx + 0x10]
mov qword [rsi], rax
mov eax, dword [rbx]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x14010e39c
mov rax, qword [0x14035cce0]
mov ecx, eax
test eax, eax
jne 0x14010e38e
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14010e2ab
mov qword [rsp + 0x20], 0x18
lea r9, [0x1403cc963]
lea r8, [0x1403cbb08]
mov edx, 4
lea rcx, [0x1403cbb2a]
call fcn.1400d2190
jmp 0x14010e3c4
Function at 0x14010e3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x14035ccc0]
lea rdi, [0x14035ccc0]
mov rsi, rcx
mov ecx, eax
test eax, eax
jne 0x14010e3f9
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14010e4c0
lea rbp, [0x1404cb558]
lea rdi, [0x1404cb538]
mov rcx, rbp
call fcn.140341618
call qword [sym.imp.KERNEL32.dll_GetACP]
lea rdx, str.CP_u
mov rcx, rdi
mov r8d, eax
call fcn.1400f7a00
mov rcx, rbp
call fcn.140341260
mov rbp, qword [rbx + 8]
test rbp, rbp
je 0x14010e459
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14010e4a8
mov rcx, rbp
call fcn.14034efb0
mov rcx, qword [rbx + 0x10]
call fcn.14034efb0
mov rcx, rdi
call fcn.1400e4a90
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov qword [rbx + 8], rax
call fcn.14010e0d0
mov rcx, qword [rsp + 0x38]
mov dword [rbx], eax
call fcn.1400e4a90
mov qword [rbx + 0x10], rax
mov qword [rsi], rax
mov eax, dword [rbx]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rbx + 0x10]
mov qword [rsi], rax
mov eax, dword [rbx]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x14010e4fc
mov rax, qword [0x14035ccc0]
mov ecx, eax
test eax, eax
jne 0x14010e4ee
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14010e40b
mov qword [rsp + 0x20], 0x18
lea r9, [0x1403cc963]
lea r8, [0x1403cbb08]
mov edx, 4
lea rcx, [0x1403cbb2a]
call fcn.1400d2190
jmp 0x14010e524
Function at 0x14010e530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, qword [0x14035cca0]
lea rsi, [0x14035cca0]
mov rdi, rcx
mov ecx, eax
test eax, eax
jne 0x14010e55b
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14010e6c0
lea rcx, str.LANG
call fcn.1400c71c0
test rax, rax
je 0x14010e5c0
cmp byte [rax], 0
je 0x14010e5c0
mov edx, 0x2e
mov rcx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14010e5c0
lea rsi, [rax + 1]
mov edx, 0x40
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14010e615
sub rax, rsi
mov rbp, rax
cmp rax, 0x16
jbe 0x14010e6a0
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov r8d, eax
test eax, eax
jne 0x14010e680
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 6
je 0x14010e60e
call rsi
mov ecx, eax
call fcn.1400f7740
lea rcx, [0x1403cbb2a]
mov edx, 0x10
lea r8, str.Failed_to_determine_console_output_code_page:__s._Falling_back_to_UTF_8
mov rsi, rax
mov r9, rax
call fcn.1400d2190
mov rcx, rsi
call fcn.14034efb0
lea rsi, [0x1403cc94e]
mov rbp, qword [rbx + 8]
test rbp, rbp
je 0x14010e62d
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14010e667
mov rcx, rbp
call fcn.14034efb0
mov rcx, qword [rbx + 0x10]
call fcn.14034efb0
mov rcx, rsi
call fcn.1400e4a90
lea rdx, [rsp + 0x38]
mov rcx, rsi
mov qword [rbx + 8], rax
call fcn.14010e0d0
mov rcx, qword [rsp + 0x38]
mov dword [rbx], eax
call fcn.1400e4a90
mov qword [rbx + 0x10], rax
test rdi, rdi
je 0x14010e673
mov rax, qword [rbx + 0x10]
mov qword [rdi], rax
mov eax, dword [rbx]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [rsp + 0x40]
lea rdx, str.CP_u
mov rcx, r12
call fcn.1400f7a00
mov rsi, r12
jmp 0x14010e615
lea r12, [rsp + 0x40]
mov r8, rax
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbp + 0x40], 0
jmp 0x14010e694
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x14010e6fc
mov rax, qword [0x14035cca0]
mov ecx, eax
test eax, eax
jne 0x14010e6ee
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14010e56d
mov qword [rsp + 0x20], 0x18
lea r9, [0x1403cc963]
lea r8, [0x1403cbb08]
mov edx, 4
lea rcx, [0x1403cbb2a]
call fcn.1400d2190
jmp 0x14010e724
Function at 0x140123120
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x260]
mov rbx, rcx
mov rdi, r8
mov rsi, r9
test rax, rax
je 0x1401231b0
mov rcx, qword [rcx + 0xd0]
mov r8, qword [rbx + 0xd8]
test rcx, rcx
je 0x1401231d0
movzx ebp, byte [rcx + 0x18b]
test bpl, bpl
jne 0x1401231c0
test r8, r8
je 0x1401231c5
movzx ebp, byte [r8 + 0x18b]
mov byte [r8 + 0x18b], 1
mov rcx, qword [rbx + 0x1d0]
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x140123230
mov byte [rax + 0x18b], bpl
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp edx, 2
jbe 0x1401231e0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test r8, r8
jne 0x14012316d
mov byte [rcx + 0x18b], 1
jmp 0x140123175
xor ebp, ebp
test r8, r8
jne 0x140123165
jmp 0x140123175
mov eax, edx
mov r9, qword [rbx + 0x1c8]
mov r8d, 1
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x1403f13f0]
add rcx, rax
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx + 0x1c8]
mov rdx, rsi
mov rcx, rdi
mov r8d, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msvcrt.dll_fwrite
mov rax, qword [rbx + 0xd0]
test rax, rax
jne 0x14012319c
jmp 0x1401231b5

Function at 0x140124170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
mov r11, rcx
setne al
test rdx, rdx
setne r8b
xor r10d, r10d
or r11, rdx
sete r10b
and al, r8b
mov r9d, eax
jne 0x1401241a0
mov eax, r10d
ret
movzx r8d, byte [rcx]
mov r10, qword [0x14048f880]
test r8b, r8b
jne 0x1401241f0
movzx eax, byte [rdx]
xor r9d, r9d
test al, al
sete r10b
xor r10d, r9d
movzx r10d, r10b
mov eax, r10d
ret
movzx eax, byte [r10 + rax]
cmp byte [r10 + r8], al
jne 0x140124200
movzx r8d, byte [rcx + 1]
add rcx, 1
lea rax, [rdx + 1]
test r8b, r8b
je 0x140124208
mov rdx, rax
movzx eax, byte [rdx]
test al, al
jne 0x1401241d0
jmp 0x1401241b6
xor r10d, r10d
jmp 0x140124192
movzx eax, byte [rdx + 1]
xor r9d, r9d
jmp 0x1401241b6
Function at 0x140128060
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rdi, qword [rcx + 0x18]
mov r14, qword [rsp + 0x1a0]
mov rax, qword [rdi + 0x388]
movsxd rbx, edx
mov r12, r8
mov rbp, rcx
mov r13, r9
mov rsi, rbx
mov r15, qword [rdi + rbx*8 + 0x1b8]
shl rsi, 5
add rsi, rdi
mov r8, qword [rsi + 0x218]
mov rdx, qword [rsi + 0x220]
test byte [rax + 0x84], 3
je 0x1401280cc
lea rax, [0x14013c650]
cmp qword [rdi + rbx*8 + 0x1e0], rax
je 0x140128110
mov rdx, r12
xor r9d, r9d
mov r8d, r13d
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
mov dword [r14], 0
movsxd rdx, eax
cmp eax, 0xffffffff
je 0x1401281a0
mov rax, rdx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r10, r8
sub r10, rdx
cmp qword [rsi + 0x210], 0
je 0x140128125
test r10, r10
je 0x1401280cc
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rcx, r15
mov qword [rsp + 0x28], r10
mov rdx, 0xffffffffffffffff
call fcn.140122e00
cmp eax, 0xffffffff
je 0x1401280cc
test al, 1
je 0x1401280cc
mov r8, rbx
mov r10, qword [rsp + 0x28]
shl r8, 5
add r8, rdi
mov rdx, qword [r8 + 0x210]
test rdx, rdx
je 0x140128200
add rdx, qword [rsi + 0x220]
xor r9d, r9d
mov r8d, r10d
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1401280cc
cdqe
add qword [rsi + 0x220], rax
jmp 0x1401280cc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1401281c8
mov dword [r14], 0x51
mov rdx, 0xffffffffffffffff
jmp 0x1401280f1
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov ecx, eax
call fcn.140127c70
lea rdx, str.Send_failure:__s
mov rcx, rbp
mov r8, rax
call fcn.1401234a0
mov dword [rbp + 0xd84], ebx
mov dword [r14], 0x37
jmp 0x1401281b6
mov eax, dword [rbp + 0x704]
mov qword [rsp + 0x28], r8
lea ecx, [rax + rax]
mov rax, qword [0x14048b5c0]
mov qword [r8 + 0x218], rcx
call qword [rax]
mov r8, qword [rsp + 0x28]
mov qword [r8 + 0x210], rax
test rax, rax
je 0x140128252
shl rbx, 5
pxor xmm0, xmm0
movups xmmword [rbx + rdi + 0x220], xmm0
mov r10, qword [r8 + 0x218]
mov rdx, qword [r8 + 0x210]
jmp 0x14012816b
mov dword [r14], 0x1b
jmp 0x1401281b6
Function at 0x140128260
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov r15, qword [rcx + 0x18]
movsxd r12, edx
mov rbp, rcx
mov r13, r8
mov rdi, r9
mov rsi, r12
mov r14, qword [r15 + r12*8 + 0x1b8]
shl rsi, 5
add rsi, r15
mov rcx, qword [rsi + 0x210]
test rcx, rcx
je 0x1401282bd
mov rbx, qword [rsi + 0x220]
mov rax, qword [rsi + 0x228]
cmp rax, rbx
jb 0x140128300
cmp rbx, rax
je 0x140128350
mov r8d, edi
xor r9d, r9d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov rdi, qword [rsp + 0x190]
movsxd rbx, eax
mov dword [rdi], 0
cmp eax, 0xffffffff
je 0x140128390
mov rax, rbx
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rbx, rax
lea rdx, [rcx + rax]
mov rcx, r13
cmp rbx, r9
cmova rbx, r9
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi + 0x228]
add rax, rbx
mov qword [rsi + 0x228], rax
cmp rax, qword [rsi + 0x220]
je 0x1401283b8
test rbx, rbx
jle 0x1401282bd
mov rax, qword [rsp + 0x190]
mov dword [rax], 0
jmp 0x1401282e9
xor ebx, ebx
mov rax, qword [0x14048b5b0]
call qword [rax]
mov rax, r12
pxor xmm0, xmm0
shl rax, 5
mov qword [r15 + rax + 0x210], 0
movups xmmword [r15 + rax + 0x218], xmm0
mov qword [rsi + 0x228], 0
jmp 0x140128337
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2733
jne 0x1401283c8
mov rax, qword [rsp + 0x190]
mov dword [rax], 0x51
jmp 0x1401282e9
mov rcx, qword [rsi + 0x210]
jmp 0x140128352
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov ecx, eax
call fcn.140127c70
lea rdx, str.Recv_failure:__s
mov rcx, rbp
mov r8, rax
call fcn.1401234a0
mov rax, qword [rsp + 0x190]
mov dword [rbp + 0xd84], esi
mov dword [rax], 0x38
jmp 0x1401282e9

Function at 0x140129620
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rbx, rdx
mov r13, r8
test r8, r8
je 0x140129704
mov r12, qword [0x14048b6f0]
lea rbp, [rsp + 0x2c]
nop word [rax + rax]
mov esi, 4
mov rax, qword [r12]
mov rdx, rbp
mov rcx, rdi
cmp r13, rsi
mov r8d, 4
cmovbe rsi, r13
call qword [rax + 0x50]
cmp eax, 4
je 0x1401296a8
test eax, eax
jne 0x140129696
mov eax, dword [rsp + 0x2c]
lea rdx, [rbx + rsi]
add rbx, 1
mov byte [rbx - 1], al
shr eax, 8
cmp rbx, rdx
jne 0x140129680
sub r13, rsi
jne 0x140129650
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp byte [0x1404cb5b0], 0
je 0x1401296d0
imul eax, dword [0x1404cb5ac], 0x41c64e6d
add eax, 0x3039
mov dword [0x1404cb5ac], eax
rol eax, 0x10
jmp 0x14012967c
xor ecx, ecx
mov r9d, 2
mov rdx, rbp
mov r8d, 4
mov dword [rsp + 0x2c], 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x140129678
mov eax, 2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 0x2b
jmp 0x140129696
Function at 0x140129790
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movabs r13, 0x20c49ba5e353f6
movabs r12, 0x4189374bc6a7ec
lea rdi, [rsp + 0x20]
mov rsi, rcx
mov rbx, rdx
mov rcx, rdi
call fcn.1401284e0
mov rcx, rsi
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
call sub.msvcrt.dll__strdup_1
mov rcx, rbx
mov rsi, rax
call sub.msvcrt.dll__strdup_1
mov rbp, qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rbx, rax
jmp 0x140129825
sub ecx, r15d
imul rdx, rdx, 0x3e8
movsxd rax, ecx
sar ecx, 0x1f
imul rax, rax, 0x10624dd3
sar rax, 0x26
sub eax, ecx
cdqe
add rax, rdx
cmp rax, 0x3e8
ja 0x140129855
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call rbp
test eax, eax
jne 0x140129880
mov rcx, rdi
call fcn.1401284e0
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
sub rdx, r14
lea rax, [rdx + r13]
cmp r12, rax
jae 0x1401297f0
test rsi, rsi
je 0x140129862
mov rcx, rsi
call fcn.14034efb0
test rbx, rbx
je 0x14012986f
mov rcx, rbx
call fcn.14034efb0
mov eax, 1
jmp 0x14012989c
test rsi, rsi
je 0x14012988d
mov rcx, rsi
call fcn.14034efb0
test rbx, rbx
je 0x14012989a
mov rcx, rbx
call fcn.14034efb0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401324f0
Capabilities:
Convert ip address from string

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov eax, 0xe
mov rbx, rdx
movzx edx, byte [rdx]
mov rdi, rcx
mov rsi, r8
test dl, dl
je 0x140132534
cmp dl, 0x5b
je 0x140132548
lea rdx, str.__r_n_t_:______________
mov rcx, rbx
call sub.msvcrt.dll_strcspn
mov rdx, rax
mov eax, 0x15
cmp rdx, rsi
jne 0x140132534
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp r8, 3
jbe 0x1401325e8
cmp byte [rbx + r8 - 1], 0x5d
lea rbp, [rbx + 1]
lea r13, [r8 - 2]
jne 0x1401325e8
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rbp
call sub.msvcrt.dll_strspn
mov rsi, rax
lea r12, [rbp + rax]
cmp r13, rax
je 0x140132644
cmp byte [r12], 0x25
jne 0x1401325e8
lea r13, [rbp + rax + 1]
cmp byte [r13], 0x32
je 0x1401325f8
movzx edx, byte [r13]
test dl, dl
setne al
cmp dl, 0x5d
setne cl
and eax, ecx
test al, al
je 0x1401325db
mov r8, r13
mov eax, 1
lea rcx, [rsp + 0x2f]
nop dword [rax]
mov byte [rcx + rax], dl
movzx edx, byte [r8 + rax]
test dl, dl
je 0x140132618
cmp dl, 0x5d
je 0x14013261d
add rax, 1
cmp rax, 0x10
jne 0x1401325c0
mov eax, 3
jmp 0x140132534
mov eax, 0x16
jmp 0x140132534
cmp byte [r13 + 1], 0x35
jne 0x140132599
movzx edx, byte [r13 + 2]
cmp dl, 0x5d
je 0x140132599
test dl, dl
je 0x140132599
lea r8, [r13 + 2]
jmp 0x1401325b2
cmp dl, 0x5d
jne 0x1401325db
cdqe
lea rcx, [rsp + 0x30]
mov byte [rsp + rax + 0x30], 0
mov rax, qword [0x14048b600]
call qword [rax]
mov qword [rdi + 0x28], rax
test rax, rax
je 0x1401326c9
mov byte [r13], 0
lea rdi, [rsp + 0x20]
mov byte [r12], 0
mov rdx, rbp
mov ecx, 0x17
mov r8, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1401325e8
lea r13, [rsp + 0x30]
mov r9d, 0x2e
mov rdx, rdi
mov ecx, 0x17
mov r8, r13
call qword [sym.imp.WS2_32.dll_inet_ntop]
test rax, rax
je 0x140132692
mov rcx, r13
call sub.msvcrt.dll_strlen
cmp rax, rsi
jb 0x14013269e
mov byte [r12], 0x5d
xor eax, eax
jmp 0x140132534
lea rdx, [rax + 1]
cmp edx, 8
jae 0x1401326d3
test dl, 4
jne 0x14013271d
test edx, edx
je 0x1401326bd
movzx ecx, byte [rsp + 0x30]
mov byte [rbx + 1], cl
test dl, 2
jne 0x140132731
mov byte [rbp + rax + 1], 0
lea r12, [rbp + rax]
jmp 0x140132692
mov eax, 7
jmp 0x140132534
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 8]
and r9, 0xfffffffffffffff8
mov qword [rbx + 1], rcx
mov ecx, edx
mov r8, qword [r13 + rcx - 8]
mov qword [rbp + rcx - 8], r8
mov rcx, rbp
sub rcx, r9
add edx, ecx
sub r13, rcx
and edx, 0xfffffff8
cmp edx, 8
jb 0x1401326bd
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov r10, qword [r13 + r8]
mov qword [r9 + r8], r10
cmp ecx, edx
jb 0x140132708
jmp 0x1401326bd
mov ecx, dword [rsp + 0x30]
mov edx, edx
mov dword [rbx + 1], ecx
mov ecx, dword [r13 + rdx - 4]
mov dword [rbp + rdx - 4], ecx
jmp 0x1401326bd
mov edx, edx
movzx ecx, word [r13 + rdx - 2]
mov word [rbp + rdx - 2], cx
jmp 0x1401326bd
Function at 0x1401334b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14048b5b0]
mov rbx, rcx
mov rcx, qword [rcx + 0x1b0]
call qword [rsi]
mov rcx, qword [rbx + 0x198]
mov qword [rbx + 0x1b0], 0
call qword [rsi]
mov rcx, qword [rbx + 0x1b8]
mov qword [rbx + 0x198], 0
test rcx, rcx
je 0x140133520
add rcx, 8
call fcn.1402c4cf0
mov rcx, qword [rbx + 0x1b8]
add rcx, 0x240
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1402c4cf0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14013c9d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [0x1404cb6c0]
mov dword [rsp + 0x3c], 0x4020
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x34], 4
test eax, eax
je 0x14013ca60
cmp eax, 2
je 0x14013ca52
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14013ca30
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x38], eax
jg 0x14013ca52
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov edx, 0xffff
mov rcx, rbx
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rbx
ret
mov ecx, 3
call fcn.140280ac0
test al, al
je 0x14013ca80
mov dword [0x1404cb6c0], 2
add rsp, 0x40
pop rbx
ret
mov dword [0x1404cb6c0], 1
jmp 0x14013c9ff