joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001968d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401b1410]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x1400194e0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1401b1420]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14001960a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x1400195e0
movdqa xmm1, xmmword [0x1401b1420]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x1401b1430], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x1400196ab
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140019020
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14001a490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x828
mov ecx, dword [0x1401b0018]
test ecx, ecx
je 0x14001a4c3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14001a4dc
cmp qword [rax + 8], 0
je 0x14001a4dc
add rax, 0x10
jmp 0x14001a6d7
lea rcx, section..data
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14001a4b3
mov ecx, dword [0x1401b0018]
test ecx, ecx
je 0x14001a6b8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14001a6d5
mov rsi, rax
test rax, rax
jne 0x14001a54c
movzx eax, byte [0x140254141]
mov edx, 0x18
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x14001a6fa
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1401b0018]
test ecx, ecx
je 0x14001a6fc
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [0x140254030]
cmp rax, 3
jne 0x14001a6e4
mov rdi, qword [0x140254038]
lock inc qword [rdi]
jle 0x14001a6fa
mov eax, 0x60
movups xmm0, xmmword [0x1401c1ba0]
movups xmm1, xmmword [0x1401c1b90]
nop word cs:[rax + rax]
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x14001a590
movzx eax, byte [0x140254141]
mov edx, 0x980
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x14001a6fa
mov r14, rax
and r14, 0xffffffffffffff80
lea rbx, [r14 + 0x80]
mov qword [r14 + 0x78], rax
mov qword [r14 + 0x80], 0
mov qword [r14 + 0x88], rdi
lea rcx, [r14 + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [r14 + 0x890], xmm0
mov qword [r14 + 0x8a0], 1
mov qword [r14 + 0x8a8], 0
mov qword [r14 + 0x900], 0
mov rcx, qword [0x140254038]
mov rax, qword [rcx + 0x200]
nop word cs:[rax + rax]
mov qword [rbx], rax
lock cmpxchg qword [rcx + 0x200], rbx
jne 0x14001a660
lea rax, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rbx
je 0x14001a6d7
mov rdx, qword [rcx + 0x820]
lea r8, [rdx - 1]
mov qword [rcx + 0x820], r8
cmp qword [rcx + 0x818], 0
jne 0x14001a6d7
cmp rdx, 1
jne 0x14001a6d7
mov rsi, rax
call fcn.140019970
mov rax, rsi
jmp 0x14001a6d7
lea rcx, section..data
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14001a4fb
xor eax, eax
add rsp, 0x828
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140019da0
mov rdi, qword [0x140254038]
lock inc qword [rdi]
jg 0x14001a56e
ud2
lea rcx, section..data
call fcn.140091a10
mov ecx, eax
jmp 0x14001a544
Function at 0x140024e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401b0128]
test ecx, ecx
je 0x140024e40
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140024e59
cmp qword [rax + 8], 0
je 0x140024e59
add rax, 0x10
jmp 0x140024f15
lea rcx, [0x1401b0110]
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140024e30
mov ecx, dword [0x1401b0128]
test ecx, ecx
je 0x140024ef6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140024f13
test rax, rax
jne 0x140024ec5
movzx eax, byte [0x140254141]
mov edx, 0x18
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140024f32
lea rcx, [0x1401b0110]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401b0128]
test ecx, ecx
je 0x140024f1c
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x140024edf
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x140024ee1
mov rcx, qword [rsi + 8]
jmp 0x140024ee1
xor ecx, ecx
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x140024f15
lea rcx, [0x1401b0110]
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140024e78
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401b0110]
mov rdi, rax
call fcn.140091a10
mov ecx, eax
mov rax, rdi
jmp 0x140024eb7
ud2
Function at 0x1400303e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 8], r8
jne 0x140030495
mov rsi, r8
test r8, r8
je 0x140030495
mov rdi, rdx
mov rbx, qword [rcx]
xor eax, eax
cmp rsi, 4
jb 0x140030460
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x20
jb 0x140030460
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x140030430
cmp rax, rsi
je 0x1400304de
mov r8, rsi
mov rdx, rax
and r8, 3
je 0x140030487
mov r9, rax
nop
lea rdx, [r9 + 1]
mov r10, qword [rbx + r9*8]
not r10
mov qword [rdi + r9*8], r10
mov r9, rdx
dec r8
jne 0x140030470
sub rax, rsi
cmp rax, 0xfffffffffffffffc
jbe 0x1400304a0
test rsi, rsi
jne 0x1400304de
ud2
mov rax, qword [rbx + rdx*8]
not rax
mov qword [rdi + rdx*8], rax
mov rax, qword [rbx + rdx*8 + 8]
not rax
mov qword [rdi + rdx*8 + 8], rax
mov rax, qword [rbx + rdx*8 + 0x10]
not rax
mov qword [rdi + rdx*8 + 0x10], rax
mov rax, qword [rbx + rdx*8 + 0x18]
not rax
mov qword [rdi + rdx*8 + 0x18], rax
lea rax, [rdx + 4]
mov rdx, rax
cmp rsi, rax
jne 0x1400304a0
or byte [rdi], 1
mov r14, rsi
shl r14, 6
sub r14, qword [rcx + 0x20]
je 0x140030526
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.14019c2c0
dec r14
jne 0x140030510
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140034880
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov al, 1
test rdx, rdx
je 0x14003498e
movzx r9d, byte [rcx]
mov r10, qword [r8]
movzx r10d, byte [r10]
not r10b
test r9b, r10b
jne 0x14003498e
mov r10, qword [r8 + 0x10]
test r10, r10
je 0x140034994
mov r8, qword [r8 + 8]
xor byte [r8], r9b
mov r11d, 1
cmp r10, 1
je 0x140034988
lea rbx, [rdx - 1]
lea rdi, [r10 - 2]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [r8 + 1]
inc rsi
cmp rsi, 0x10
jbe 0x14003495e
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x14003490e
add rdi, r8
add rdi, 2
lea rbx, [rcx + 1]
cmp rbx, rdi
jb 0x14003495e
mov r11d, esi
and r11d, 0xf
mov r14d, 0x10
cmovne r14, r11
mov rdi, rsi
sub rdi, r14
lea rbx, [r9 + rdi]
neg r14
lea r11, [rsi + r14]
inc r11
xor esi, esi
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + rsi + 1]
movups xmm1, xmmword [r9 + rsi]
xorps xmm1, xmm0
movups xmmword [r9 + rsi], xmm1
add rsi, 0x10
cmp rdi, rsi
jne 0x140034940
mov r9, rbx
add r8, r10
nop word cs:[rax + rax]
cmp rdx, r11
je 0x14003498e
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, r8
jne 0x140034970
cmp r11, rdx
setne al
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x140075110
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x140075179
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x140075138
add rdi, rbx
sub rsi, rbx
je 0x140075179
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140075130
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140075130
test ebp, 0x7fffffff
setne al
jmp 0x14007517b
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140076660
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400766a2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400766aa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400766bb
jmp 0x1400766d2
xor r10d, r10d
jmp 0x14007675d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400766d2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400766e9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140076709
add r11, r8
jmp 0x14007683b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400767d2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140076780
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400767f0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140076802
jmp 0x14007681d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14007681d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140076837
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400826d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
movzx r8d, byte [rdx + 0x3a]
test r8b, r8b
setne al
cmp r9b, 1
ja 0x140082752
test r8b, r8b
jne 0x14008272a
movzx esi, byte [rdx + 0x10]
lea r8d, [rsi - 5]
cmp r8b, 1
ja 0x14008272a
mov r10, qword [rdx]
mov r8, qword [rdx + 8]
xor r11d, r11d
test r9b, r9b
jne 0x140082721
cmp sil, 6
je 0x140082721
mov r11d, 2
cmp r8, 1
jbe 0x140082907
cmp r11, r8
jne 0x140082865
xor r8d, r8d
xor eax, eax
xor r8d, r8d
add r8, r10
lea rsi, [r10 + r11]
inc rsi
cmp rsi, r8
mov byte [rcx + 0xf], 0x94
rol byte [rdi + 0xf], 0xb6
adc al, 0x1a
test r8b, 1
jne 0x1400828f7
cmp r10b, 0x2e
jne 0x1400828f7
movzx r8d, byte [rsi]
cmp r10b, 0x2e
sete r10b
and r8b, r10b
jmp 0x14008272d
Function at 0x140085f10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov edi, 0xffffffff
xor esi, esi
xor r15d, r15d
cmp r8, 0x201
jae 0x140085fb0
jmp 0x140085f8f
jae 0x14008605a
cmp r8, 0x201
jae 0x140085fb0
mov ebx, 0x200
lea r12, [rsp + 0x98]
mov r13, r8
jmp 0x140085fdb
sub r8, r15
sub rsi, r15
cmp rsi, r8
jb 0x140086039
cmp r14, rdi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x38], r15
mov rsi, r14
mov rbx, r15
mov r12, qword [rsp + 0x48]
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x140086000
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140086127
mov r8d, ebp
cmp r13, r8
jne 0x140085f80
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140086154
add r13, r13
cmp r13, rdi
cmovae r13, rdi
mov r8, r13
cmp r8, 0x201
jb 0x140085f8f
jmp 0x140085fb0
lea rcx, [rsp + 0x28]
mov rdx, r15
call fcn.140098330
mov r14, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x140085fbb
cmp rbx, r8
jb 0x140086154
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, r12
call fcn.1400873b0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.140084410
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x1400860a8
lea rdx, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0x60]
mov r8d, 3
call fcn.140085680
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.14008f0c0
cmp qword [rsp + 0x60], 0
je 0x1400860db
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rcx], xmm0
cmp qword [rsp + 0x28], 0
je 0x140086112
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000001
mov qword [rcx], rax
cmp qword [rsp + 0x28], 0
jne 0x1400860ff
jmp 0x140086112
ud2
Function at 0x1400877a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401b00d8]
test ecx, ecx
je 0x1400877d0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400877e9
cmp qword [rax + 8], 0
je 0x1400877e9
add rax, 0x10
jmp 0x1400878ca
lea rcx, case.0x140086fb6.471
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400877c0
mov ecx, dword [0x1401b00d8]
test ecx, ecx
je 0x1400878ab
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400878c8
test rax, rax
jne 0x140087859
movzx eax, byte [0x140254141]
mov edx, 0x18
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x1400878ea
lea rcx, case.0x140086fb6.471
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401b00d8]
test ecx, ecx
je 0x1400878d1
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x140087873
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x140087875
mov rdx, qword [rsi + 8]
jmp 0x140087875
xor edx, edx
mov r8, rax
add rax, 0x10
mov rcx, qword [r8 + 0x10]
cmp qword [r8 + 8], 0
mov qword [r8 + 8], 1
mov qword [r8 + 0x10], rdx
je 0x1400878ca
test rcx, rcx
je 0x1400878ca
lock dec qword [rcx]
jne 0x1400878ca
mov rsi, rax
call fcn.1400c1ef0
mov rax, rsi
jmp 0x1400878ca
lea rcx, case.0x140086fb6.471
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140087808
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, case.0x140086fb6.471
mov rdi, rax
call fcn.140091a10
mov ecx, eax
mov rax, rdi
jmp 0x14008784b
ud2
Function at 0x1400878f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401b0060]
test ecx, ecx
je 0x140087920
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140087939
cmp qword [rax + 8], 0
je 0x140087939
add rax, 0x10
jmp 0x140087a1a
lea rcx, str._z_b_
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140087910
mov ecx, dword [0x1401b0060]
test ecx, ecx
je 0x1400879fb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140087a18
test rax, rax
jne 0x1400879a9
movzx eax, byte [0x140254141]
mov edx, 0x18
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140087a3a
lea rcx, str._z_b_
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401b0060]
test ecx, ecx
je 0x140087a21
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x1400879c3
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1400879c5
mov rdx, qword [rsi + 8]
jmp 0x1400879c5
xor edx, edx
mov r8, rax
add rax, 0x10
mov rcx, qword [r8 + 0x10]
cmp qword [r8 + 8], 0
mov qword [r8 + 8], 1
mov qword [r8 + 0x10], rdx
je 0x140087a1a
test rcx, rcx
je 0x140087a1a
lock dec qword [rcx]
jne 0x140087a1a
mov rsi, rax
call fcn.140087690
mov rax, rsi
jmp 0x140087a1a
lea rcx, str._z_b_
call fcn.140091a10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140087958
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, str._z_b_
mov rdi, rax
call fcn.140091a10
mov ecx, eax
mov rax, rdi
jmp 0x14008799b
ud2
Function at 0x140087b60
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp byte [rcx + rcx*4 - 0x3d], cl

Function at 0x140088930
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x14008898e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x14008898e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14008898e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x14008898e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x1400889ce
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400889bc
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x1401d5e68]
add rsp, 0x38
ret

Function at 0x1400889e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140088a3e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140088a3e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140088a3e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140088a3e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140088a7e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140088a6c
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x1401d5e68]
add rsp, 0x38
ret

Function at 0x1400890e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x27], dl
mov rsi, rcx
mov rax, qword [rcx]
lea r15, [rsp + 0x2a]
lea r14, case.0x140086fb6.471
xor ebp, ebp
lea r12, [0x1401d57d0]
mov r13, rax
test rax, rax
jne 0x140089156
jmp 0x14008913b
Function at 0x14008ad50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test dx, dx
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008ad9e
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008ae0e
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x14008adb1
cmp eax, 0x2739
jne 0x14008adfb
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008adf6
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x14008ae15
mov qword [rsi + 8], rdi
jmp 0x14008ad95
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x38
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp sub.ws2_32.dll_closesocket
Function at 0x14008f0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.140090c90
mov rbx, qword [rsp + 0x28]
cmp rbx, r14
jne 0x14008f150
mov rax, qword [rsp + 0x30]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x14008f14b
test rcx, rcx
je 0x14008f14b
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, rbx
call qword [r15]
cmp qword [r15 + 8], 0
je 0x14008f13a
cmp qword [r15 + 0x10], 0x11
jb 0x14008f129
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov qword [rsi], r14
jmp 0x14008f172
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14008f17e
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], r14
test rbx, rbx
je 0x14008f172
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree