joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002662
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14018af70
sub rsp, 0x4c8
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x70], 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14018b050
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x14018b045
lea rdx, str.dbghelp.dll
lea rcx, [rsp + 0x28]
call fcn.140009061
mov rcx, rax
call fcn.1400073c9
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14018b023
lea rdx, str.dbgcore.dll
lea rcx, [rsp + 0x48]
call fcn.140009061
mov rcx, rax
call fcn.1400073c9
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14018b032
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14018b052
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x14018afc7
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x4c8
ret

Function at 0x140002680
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1401eef70
sub rsp, 0x28
xor eax, eax
lea r8, [rsp + 0x38]
test edx, edx
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x140002743
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14012d530
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14012d551
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14012d5d5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14012d5a0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14012d5a8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d544
add rsp, 0x18
ret
Function at 0x140002a95
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
jmp 0x14018d080
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.14000626c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x58
ret

Function at 0x140002cc0
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
jmp 0x14022a840
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
mov rbx, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.14022aae0
lea r8, [rbx + 7]
mov rcx, rsi
lea rdx, [rdi + 8]
call fcn.14022aae0
lea r8, [rbx + 0xe]
mov rcx, rsi
lea rdx, [rdi + 0x10]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14022aae0
Function at 0x140002ff9
Capabilities:
Get common file path

Disassembly:
jmp 0x1401558d0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14015591b
cmp dword [rsp + 0x24], 0x105
jbe 0x140155971
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004c9b
mov qword [rsp + 0x38], rax
lea rdx, [0x140004958]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14029ef08]
mov rcx, qword [rsp + 0x270]
call fcn.14000375b
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
jmp 0x140155a03
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp word [rax + rcx*2], 0
jne 0x140155984
mov rax, qword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x4e]
cmp eax, 0x5c
jne 0x1401559de
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x1401559bc
mov rax, qword [rsp + 0x30]
xor ecx, ecx
mov word [rsp + rax*2 + 0x4e], cx
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x270]
call fcn.14000375b
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140003080
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x1401186c0
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xfaba0065
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140118724
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x1401187ef
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401187ef
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x1401187ef
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x1401187ea
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x1401187e3
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x1401187ef
mov rax, qword [rsp + 0x30]
jmp 0x140118806
jmp 0x14011875a
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x1401186e4
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1400033ff
Capabilities:
Move file

Disassembly:
jmp 0x1401f3c60
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rbx, rdx
call fcn.14000793c
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
movups xmm6, xmmword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1401f3cf0
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.14000793c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140008d46
cmp rax, 0x3e8
ja 0x1401f3d02
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1401f3ca0
xor eax, eax
mov rbx, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 1
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
Function at 0x140003774
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
jmp 0x140155710
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x140155739
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x1401557a3
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x140155869
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140155864
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x1401557ff
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x140155864
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14015582f
xor eax, eax
jmp 0x14015586b
cmp qword [rsp + 0x90], 0
je 0x14015584c
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x14015586b
jmp 0x140155799
xor eax, eax
add rsp, 0x78
ret
Function at 0x140003ce7
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1402372c0
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14023734d
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14023734d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14023734d
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140237334
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14023732e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140237336
add rdx, 0x28
jmp 0x140237313
xor edx, edx
test rdx, rdx
jne 0x14023733f
xor al, al
jmp 0x140237353
cmp dword [rdx + 0x24], 0
jge 0x140237349
xor al, al
jmp 0x140237353
mov al, 1
jmp 0x140237353
xor al, al
jmp 0x140237353
add rsp, 0x18
ret

Function at 0x140003f08
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401f8ea0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [0x14039ad68]
mov rdi, rax
test rax, rax
je 0x1401f8f1d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1401f8f48
cmp ebx, esi
je 0x1401f8f48
cmp ebx, 0x8000
ja 0x1401f8f48
cmp ebx, esi
jb 0x1401f8f43
mov edx, ebx
mov rcx, rdi
call qword [0x14039ad68]
mov rdi, rax
test rax, rax
jne 0x1401f8ee0
mov rcx, rbp
call qword [fcn.14023972b]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x1401f8f28
mov rcx, rdi
jmp 0x1401f8f20
Function at 0x140003f35
Capabilities:
Delete file

Disassembly:
jmp 0x14012a540
push rdi
sub rsp, 0x2c0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14011fea0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x31]
call fcn.140122230
lea rcx, [rsp + 0x38]
call fcn.140001e51
lea rcx, [rsp + 0x38]
call fcn.140001e51
lea rcx, [rsp + 0x68]
call fcn.1400016b3
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140003da0
nop
lea rcx, [rsp + 0x38]
call fcn.1400016b3
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140003da0
nop
mov rax, qword [rsp + 0x1b0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x1b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14012a669
mov rax, qword [rsp + 0xa0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0xa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14012a669
lea rcx, [rsp + 0x68]
call fcn.1400016b3
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x38]
call fcn.1400016b3
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [0x1403a2720]
lea rcx, [rsp + 0x1b0]
call fcn.140001ccb
lea rdx, [0x1403a2820]
lea rcx, [rsp + 0xa0]
call fcn.140001ccb
lea rcx, [rsp + 0x1b0]
call fcn.140004c78
lea rcx, [rsp + 0xa0]
call fcn.140004c78
nop
lea rcx, [rsp + 0xa0]
call fcn.140002cd9
nop
lea rcx, [rsp + 0x1b0]
call fcn.140002cd9
add rsp, 0x2c0
pop rdi
ret

Function at 0x14000425f
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140119080
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14000545c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14000882d
lea rcx, [rsp + 0x38]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x140119108
lea rcx, [rsp + 0x38]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140119108
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, 0x53b2070f
jne 0x140119106
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140007167
jmp 0x14011911f
jmp 0x1401190c0
lea rcx, [rsp + 0x28]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x14011908e
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400043c7
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14011b420
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140002fb8
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400043f4
Capabilities:
Get session user name

Disassembly:
jmp 0x140129310
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140129368
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x160]
call fcn.14000457a
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x160]
jmp 0x1401293b3
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0x20]
call fcn.14011f170
mov rcx, rax
call fcn.14000736f
mov rdx, rax
mov rcx, qword [rsp + 0x160]
call fcn.14000457a
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140004953
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
jmp 0x1401dbd00
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x1a0]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov rax, rcx
mov r12, r9
shl rax, 5
mov r15, r8
lea rbx, [rsi + 0x508]
mov rbp, qword [rsi + rcx*8 + 0x4c0]
add rbx, rax
mov rax, qword [rsi + 0x698]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1401dbe07
lea rax, [0x140005f92]
cmp qword [rsi + rcx*8 + 0x4e8], rax
jne 0x1401dbe07
cmp qword [rbx], r13
je 0x1401dbd8e
test rdi, rdi
je 0x1401dbe07
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.140008d05
cmp eax, 0xffffffff
je 0x1401dbe07
test al, 1
je 0x1401dbe07
mov rax, qword [rbx]
test rax, rax
jne 0x1401dbde0
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x1401dbe03
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1401dbe07
add qword [rbx + 0x10], rcx
jmp 0x1401dbe07
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x1401dbe74
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1401dbe40
mov dword [r14], 0x51
mov rax, r13
jmp 0x1401dbe77
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140006b8b
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140008f8a
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400049a3
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14012d2c0
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14012d2f0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14012d372
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14012d33e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14012d346
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d2e5
mov qword [rsp + 8], 0xe3
jmp 0x14012d38a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14012d411
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14012d3db
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14012d3e3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d37d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14012d465
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14012d46d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret

Function at 0x140004a11
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x1401dbab0
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1401dbaf2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret