joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033c5c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14006cfc0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
lea rcx, [rsp + 0x62]
xor edx, edx
mov word [rsp + 0x60], bp
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rdi
call fcn.140009b30
mov r8d, 0x104
lea rdx, [rsp + 0x60]
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
nop dword [rax + rax]
test eax, eax
jne 0x140033d32
call fcn.14001279c
mov rbx, rax
cmp dword [rax], 3
jbe 0x140033d32
mov rcx, rdi
call fcn.140009b30
mov qword [rsp + 0x48], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140033cf5
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x40], eax
lea rdx, [0x14005d32d]
lea rax, str.QueryDosDeviceW_for_volume_without_a_drive_letter_failed
mov rcx, rbx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000d108
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x60]
call fcn.14000b390
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400165f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c250
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x30], 0
mov rsi, rdx
mov r15, rcx
movzx r12d, r9b
mov rdx, r8
lea rcx, [rbp - 0x30]
mov r14, r8
call fcn.14003bc98
mov ebx, eax
test eax, eax
je 0x14003c2a4
jle 0x14003c3ed
movzx ebx, ax
jmp 0x14003c374
mov eax, dword [rsi + 0x10]
mov rcx, rsi
lea edi, [rax*2 + 2]
call fcn.140009b30
mov rcx, r15
mov rbx, rax
call fcn.140009b30
mov rcx, qword [rbp - 0x30]
lea r9d, [r12*2 + 1]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rdx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003c37c
call fcn.14001279c
mov rdi, rax
cmp dword [rax], 3
jbe 0x14003c36d
mov rcx, rsi
call fcn.140009b30
mov rcx, r14
mov qword [rbp - 0x28], rax
call fcn.140009b30
mov rcx, r15
mov qword [rbp - 0x20], rax
call fcn.140009b30
mov qword [rbp - 0x18], rax
lea rdx, [0x14005dd05]
lea rax, str.Failed_to_set_registry_key
mov dword [rbp + 0x40], ebx
mov qword [rbp - 0x10], rax
mov rcx, rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400037dc
test ebx, ebx
jle 0x14003c3ed
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14003c3ed
call fcn.14001279c
mov rbx, rax
cmp dword [rax], 5
jbe 0x14003c3eb
mov rcx, rsi
call fcn.140009b30
mov rcx, r14
mov qword [rbp - 0x10], rax
call fcn.140009b30
mov rcx, r15
mov qword [rbp - 0x18], rax
call fcn.140009b30
mov qword [rbp - 0x20], rax
lea rdx, [0x14005dc26]
lea rax, str.Write_registry_value
mov rcx, rbx
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.140002264
xor ebx, ebx
lea rcx, [rbp - 0x30]
call fcn.1400158b4
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003d9a0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov byte [rax + 0x20], r9b
mov dword [rax + 0x10], edx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x20], 0
mov r14, rcx
lea rcx, [rbp - 0x20]
mov rdx, r8
mov rsi, r8
call fcn.14003bc98
mov ebx, eax
test eax, eax
je 0x14003d9e8
jle 0x14003db13
movzx ebx, ax
jmp 0x14003daa1
mov rcx, r14
call fcn.140009b30
mov edi, 4
lea rcx, [rbp + 0x28]
mov dword [rsp + 0x28], edi
mov r9d, edi
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003daa9
call fcn.14001279c
mov rdi, rax
cmp dword [rax], 3
jbe 0x14003da9a
mov ecx, dword [rbp + 0x28]
mov dword [rbp + 0x38], ecx
mov rcx, rsi
call fcn.140009b30
mov rcx, r14
mov qword [rbp - 0x18], rax
call fcn.140009b30
mov qword [rbp - 0x10], rax
lea rdx, [0x14005e0b4]
lea rax, str.Failed_to_set_registry_key
mov dword [rbp + 0x40], ebx
mov qword [rbp - 8], rax
mov rcx, rdi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140003e94
test ebx, ebx
jle 0x14003db13
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14003db13
call fcn.14001279c
mov rbx, rax
cmp dword [rax], edi
jbe 0x14003db11
mov ecx, dword [rbp + 0x28]
mov dword [rbp + 0x38], ecx
mov rcx, rsi
call fcn.140009b30
mov rcx, r14
mov qword [rbp - 8], rax
call fcn.140009b30
mov qword [rbp - 0x10], rax
lea rdx, [0x14005e0fc]
lea rax, str.Write_registry_value
mov rcx, rbx
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400023a8
xor ebx, ebx
lea rcx, [rbp - 0x20]
call fcn.1400158b4
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003ead4
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14006cfc0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
mov rbx, rdx
call fcn.140009b30
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rdi, rax
call fcn.14003e320
mov rcx, rax
call fcn.140009b30
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140013e34
xor eax, eax
test ebx, ebx
jne 0x14003eb46
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400165f0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14004198c
Capabilities:
Check if file exists
Modify service

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x14004198c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x38], 0
mov r14, rdx
mov rdx, rcx
mov rdi, rcx
lea rcx, [rbp + 0x38]
mov r8d, 2
call fcn.140011abc
mov ebx, eax
test eax, eax
jns 0x1400419fd
mov rcx, rdi
call fcn.140009b30
mov rcx, qword [rbp + 0x18]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x28], rax
mov r9d, ebx
lea rax, str.Could_not_get_handle_for_service__ws
mov edx, 0x24e
mov qword [rsp + 0x20], rax
call fcn.140012a04
jmp 0x140041b2e
mov rcx, r14
call fcn.140009b30
and qword [rsp + 0x50], 0
or edx, 0xffffffff
and qword [rsp + 0x48], 0
mov r9d, edx
and qword [rsp + 0x40], 0
mov r8d, edx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
nop dword [rax + rax]
test eax, eax
jne 0x140041ad2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.14001279c
mov rsi, rax
cmp dword [rax], 2
jbe 0x140041ac3
mov rcx, r14
call fcn.140009b30
mov rcx, rdi
mov qword [rbp - 0x20], rax
call fcn.140009b30
mov qword [rbp - 0x18], rax
lea rdx, [0x14005e46b]
lea rax, str.Failed_to_update_execution_path_at_SCM
mov dword [rbp + 0x30], ebx
mov qword [rbp - 0x10], rax
mov rcx, rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001b5c
test ebx, ebx
jle 0x140041b2e
movzx ebx, bx
or ebx, 0x80070000
jmp 0x140041b2e
call fcn.14001279c
mov rbx, rax
cmp dword [rax], 4
jbe 0x140041b2c
mov rcx, r14
call fcn.140009b30
mov rcx, rdi
mov qword [rbp + 0x30], rax
call fcn.140009b30
mov qword [rbp - 0x10], rax
lea rdx, [0x14005e4f2]
lea rax, str.Execution_path_updated_at_SCM
mov rcx, rbx
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.14000cfdc
xor ebx, ebx
lea rcx, [rbp + 0x38]
call fcn.140015940
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140041b58
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x70
and qword [rax + 0x18], 0
mov rdi, rcx
mov rdx, rcx
mov r8d, 2
lea rcx, [rax + 0x18]
call fcn.140011abc
mov ebx, eax
test eax, eax
jns 0x140041bbe
mov rcx, rdi
call fcn.140009b30
mov rcx, qword [rsp + 0x78]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x28], rax
mov r9d, ebx
lea rax, str.Could_not_get_handle_for_service__ws
mov edx, 0x17a
mov qword [rsp + 0x20], rax
call fcn.140012a04
jmp 0x140041cab
and qword [rsp + 0x50], 0
or edx, 0xffffffff
and qword [rsp + 0x48], 0
mov r9d, edx
and qword [rsp + 0x40], 0
mov r8d, 3
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x90]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
nop dword [rax + rax]
test eax, eax
jne 0x140041c42
mov rcx, rdi
call fcn.140009b30
mov rcx, qword [rsp + 0x78]
lea r9, str.Cannot_change_the_service_start_type_to__d_for_service__ws
mov qword [rsp + 0x28], rax
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x18c
mov dword [rsp + 0x20], 3
call fcn.140012a44
mov ebx, eax
jmp 0x140041cab
call fcn.14001279c
mov rbx, rax
cmp dword [rax], 4
jbe 0x140041ca9
mov rcx, rdi
call fcn.140009b30
mov qword [rsp + 0x98], rax
lea rdx, [0x14005e4b6]
lea rax, str.Changed_the_service_start_type_successfully
mov dword [rsp + 0x88], 3
mov qword [rsp + 0x60], rax
mov rcx, rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.14000d108
xor ebx, ebx
lea rcx, [rsp + 0x90]
call fcn.140015940
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140041f58
Capabilities:
Stop service

Disassembly:
mov rcx, rdx
jmp 0x140041f58
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14006cfc0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x140041f94
call fcn.14003f47c
and qword [rbp + 0x17], 0
mov r8d, 0x20
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140011abc
mov ebx, eax
test eax, eax
jns 0x140041fe7
mov rcx, rdi
call fcn.140009b30
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x12c
call fcn.140012a04
jmp 0x140042125
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2f], xmm0
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x47], eax
lea r8, [rbp + 0x2f]
lea edx, [rax + 1]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_ControlService]
nop dword [rax + rax]
mov ebx, eax
call fcn.14001279c
mov r8, rax
cmp dword [rax], 4
jbe 0x1400420ad
mov ecx, dword [rbp + 0x47]
mov dword [rbp - 9], ecx
mov ecx, dword [rbp + 0x43]
mov dword [rbp - 5], ecx
mov ecx, dword [rbp + 0x3f]
mov dword [rbp - 1], ecx
mov ecx, dword [rbp + 0x3b]
mov dword [rbp + 3], ecx
mov ecx, dword [rbp + 0x37]
mov dword [rbp + 7], ecx
mov eax, dword [rbp + 0x33]
mov dword [rbp + 0xb], eax
mov eax, dword [rbp + 0x2f]
mov dword [rbp + 0xf], eax
lea rax, str.Service_status
mov qword [rbp + 0x1f], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 5]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 3]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005e533]
mov rcx, r8
call fcn.140003fc0
test ebx, ebx
jne 0x1400420de
mov rcx, rdi
call fcn.140009b30
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x20], rax
lea r9, str.Could_not_stop_service__ws
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov edx, 0x13f
call fcn.140012a44
mov ebx, eax
jmp 0x140042125
call fcn.14001279c
mov rbx, rax
cmp dword [rax], 4
jbe 0x140042123
mov rcx, rdi
call fcn.140009b30
mov qword [rbp + 0x1f], rax
lea rax, str.Stop_command_sent_to_SCM_successfully
mov qword [rbp + 0xf], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005e43a]
mov rcx, rbx
call fcn.14000d994
xor ebx, ebx
lea rcx, [rbp + 0x17]
call fcn.140015940
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400165f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400030a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx], r8
mov qword [r10], rax
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14000326e
mov r11, qword [rsp + 0x60]
cmp rax, r11
je 0x14000326e
nop word cs:[rax + rax]
movzx edi, byte [rsi]
test dil, dil
js 0x140003100
inc rsi
mov qword [rcx], rsi
jmp 0x140003240
cmp dil, 0xbf
jbe 0x140003284
cmp dil, 0xdf
ja 0x14000311c
and edi, 0x1f
mov ebx, 1
mov ebp, edi
jmp 0x140003160
cmp dil, 0xef
ja 0x14000312e
and edi, 0xf
mov ebx, 2
mov ebp, edi
jmp 0x140003160
cmp dil, 0xf7
ja 0x140003140
and edi, 7
mov ebx, 3
mov ebp, edi
jmp 0x140003160
mov ebp, edi
and ebp, 3
xor ebx, ebx
cmp dil, 0xfc
setb bl
xor ebx, 5
nop word cs:[rax + rax]
mov rax, r9
sub rax, rsi
lea edi, [rbx + 1]
cmp rax, rdi
jl 0x14000326e
lea rax, [rsi + 1]
mov qword [rcx], rax
movzx edi, byte [rsi + 1]
mov eax, 2
cmp dil, 0xbf
jg 0x140003276
shl ebp, 6
and edi, 0x3f
or edi, ebp
lea r14, [rsi + 2]
mov qword [rcx], r14
cmp ebx, 2
jb 0x140003240
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x140003276
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 3]
mov qword [rcx], r14
cmp ebx, 3
jb 0x140003240
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x140003276
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 4]
mov qword [rcx], r14
cmp ebx, 4
jb 0x140003240
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x140003276
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 5]
mov qword [rcx], r14
cmp ebx, 5
jb 0x140003240
movzx ebx, byte [r14]
cmp bl, 0xbf
jg 0x140003276
shl edi, 6
and ebx, 0x3f
or edi, ebx
add rsi, 6
jmp 0x1400030eb
cmp byte [rdx], 0
jne 0x140003248
mov byte [rdx], 1
cmp edi, 0x10ffff
ja 0x14000327d
mov rax, qword [r10]
lea rsi, [rax + 2]
mov qword [r10], rsi
mov word [rax], di
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14000326e
cmp qword [r10], r11
jne 0x1400030e0
xor eax, eax
cmp rsi, r8
sete al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, 2
jmp 0x140003276
inc rsi
mov qword [rcx], rsi
mov eax, 2
jmp 0x140003276
Function at 0x140003440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rax, qword [rsp + 0x48]
mov rcx, r8
test rax, rax
je 0x1400035db
mov rcx, r8
cmp r8, r9
je 0x1400035db
movzx r10d, byte [rdx]
dec rax
mov rcx, r8
nop dword [rax + rax]
movzx r11d, byte [rcx]
test r11b, r11b
js 0x140003490
lea rsi, [rcx + 1]
jmp 0x1400035a0
cmp r11b, 0xc0
jb 0x1400035db
cmp r11b, 0xdf
ja 0x1400034ae
and r11d, 0x1f
mov edi, 1
mov ebx, r11d
jmp 0x1400034f0
cmp r11b, 0xef
ja 0x1400034c2
and r11d, 0xf
mov edi, 2
mov ebx, r11d
jmp 0x1400034f0
cmp r11b, 0xf7
ja 0x1400034d6
and r11d, 7
mov edi, 3
mov ebx, r11d
jmp 0x1400034f0
mov ebx, r11d
and ebx, 3
xor edi, edi
cmp r11b, 0xfc
setb dil
xor edi, 5
nop dword [rax]
mov r11, r9
sub r11, rcx
lea esi, [rdi + 1]
cmp r11, rsi
jl 0x1400035db
movzx r11d, byte [rcx + 1]
cmp r11b, 0xbf
jg 0x1400035db
lea esi, [rdi - 1]
add rsi, rcx
add rsi, 2
shl ebx, 6
and r11d, 0x3f
or r11d, ebx
cmp edi, 2
jb 0x1400035a0
movzx ebx, byte [rcx + 2]
cmp bl, 0xbf
jg 0x1400035db
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 3
jb 0x1400035a0
movzx ebx, byte [rcx + 3]
cmp bl, 0xbf
jg 0x1400035db
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 4
jb 0x1400035a0
movzx ebx, byte [rcx + 4]
cmp bl, 0xbf
jg 0x1400035db
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 5
jb 0x1400035a0
movzx edi, byte [rcx + 5]
cmp dil, 0xbf
jg 0x1400035db
shl r11d, 6
and edi, 0x3f
or r11d, edi
nop dword [rax]
test r10b, r10b
je 0x1400035b0
cmp r11d, 0x10ffff
jbe 0x1400035bf
jmp 0x1400035db
mov byte [rdx], 1
mov r10b, 1
cmp r11d, 0x10ffff
ja 0x1400035db
cmp rsi, rcx
je 0x1400035db
add rax, 0xffffffffffffffff
jae 0x1400035d8
mov rcx, rsi
cmp rsi, r9
jne 0x140003470
jmp 0x1400035db
mov rcx, rsi
sub rcx, r8
cmp rcx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140005530
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x150], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
mov eax, 1
lock xadd dword [0x140033aa8], eax
test eax, eax
je 0x14000556a
test bl, bl
jne 0x140005582
jmp 0x1400055ca
lea rdx, [rbp - 0x60]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140033aac], eax
test bl, bl
je 0x1400055ca
mfence
mov edi, dword [0x140033aac]
test edi, edi
je 0x1400055ca
mov qword [rbp + 0x138], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
je 0x1400055d9
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
test al, al
jne 0x1400055d9
mov rax, rsi
add rsp, 0x1d8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp + 0x148], 3
mov dword [rbp + 0x138], edi
lea rax, [0x1400325c8]
mov qword [rbp + 0x140], rax
lea r8, str.winsock
lea rsi, [rbp - 0x60]
lea rdx, [rbp + 0x138]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3
Function at 0x14000c940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mfence
mov eax, dword [rcx + 0x30]
test eax, eax
je 0x14000ca1f
mov dword [rbp - 0x10], 0
lea rcx, [rbp - 8]
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 8], xmm0
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp - 0x30], ymm0
vmovups ymmword [rbp - 0x40], ymm0
vmovups ymmword [rbp - 0x60], ymm0
lea rax, [rdi + 0x28]
mov qword [rbp + 8], rax
lea r14, [rbp - 0x60]
mov qword [rbp + 0x10], r14
mov ecx, dword [0x140033ab4]
vzeroupper
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp + 0x18], rax
mov ecx, dword [0x140033ab4]
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ebx, ebx
mov r15, 0xffffffffffffffff
nop dword [rax + rax]
mov rcx, rdi
mov edx, 0xffffffff
mov r8, r14
mov r9, rsi
call fcn.14000cb80
test rax, rax
je 0x14000ca01
inc rbx
cmove rbx, r15
jmp 0x14000c9e0
mov rdx, qword [rbp + 0x18]
mov ecx, dword [0x140033ab4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rbp - 0x60]
call fcn.14000d2a0
jmp 0x14000cabf
mov eax, 1
mov ecx, 1
xchg dword [rdi + 0x34], ecx
test ecx, ecx
jne 0x14000caad
xchg dword [rdi + 0x38], eax
test eax, eax
jne 0x14000caad
mov rcx, qword [rdi + 0x28]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x14000caad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp + 8], 0
mov rax, qword [0x1400325d0]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
jne 0x14000ca7d
test edi, edi
setne al
jmp 0x14000ca90
mov rax, qword [0x1400325c8]
lea rcx, [0x1400325c8]
mov edx, edi
call qword [rax + 0x30]
movzx eax, al
or rax, 2
mov qword [rbp + 0x18], rax
mov dword [rbp + 8], edi
lea rcx, [0x1400325c8]
mov qword [rbp + 0x10], rcx
test al, 1
jne 0x14000cad2
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
xor ebx, ebx
mov rax, rbx
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r8, str.pqcs
lea rsi, [rbp - 0x60]
lea rdx, [rbp + 8]
mov rcx, rsi
call fcn.140005680
mov rcx, rsi
call fcn.140005750
int3