joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f2020
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor r8d, r8d
lea edx, [r8 + 0x16]
lea rcx, [rsp + 0x40]
call fcn.1400f4e70
nop
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x1400f2140
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400f20ab
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f20ab
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400f20ab
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsi + 0x10]
call fcn.1400f0e70
mov rbx, rax
lea rax, vtable.mb::common::system::ScopedAny_void____ptr64__int____cdecl___void____ptr64___int___cdecl_CloseHandle_void____ptr64___2__0__0_.0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rbx + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400f21b0
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je 0x1400f213b
mov rax, qword [rdi]
mov rbp, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsi + 0x18]
cmp qword [rdx + 0x18], 7
jbe 0x1400f2105
mov rdx, qword [rdx]
mov dword [rsp + 0x38], eax
lea rax, str.Failed_to_duplicate_required_token._Error:__u.
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
mov r9d, 0x1be
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonTokenUtilities.cpp
lea rdx, str.mb::common::system::Impersonator::ImpersonateSystemIfNeeded
mov rcx, rdi
call rbp
xor dil, dil
jmp 0x1400f21be
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400f206e
cmp dword [rsp + 0x50], 1
sete bpl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400f21a3
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f21a3
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400f21a3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
test bpl, bpl
je 0x1400f20ab
mov al, 1
jmp 0x1400f21d5
mov rdx, rbx
mov rcx, rsi
call fcn.1400f1e20
movzx edi, al
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400f21d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14014f4f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400f3f10
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, r9d
mov r14d, r8d
mov r15, rdx
mov ebp, ecx
mov rsi, qword [rsp + 0xc0]
lea rcx, str.SeDebugPrivilege
call fcn.1400f2450
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, ebp
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rax, vtable.mb::common::system::ScopedAny_void____ptr64__int____cdecl___void____ptr64___int___cdecl_CloseHandle_void____ptr64___2__0__0_.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
lea rcx, [rdi + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400f3fde
test rsi, rsi
je 0x1400f3fda
mov rdx, qword [rsi]
mov rbx, qword [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ebp
lea rax, str.Unable_to_open_process_PID:__u_Error:__u
mov qword [rsp + 0x30], rax
lea rax, str.DebugUtils
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x1b7
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonDebugUtils.cpp
lea rdx, str.mb::common::debug::DebugUtils::DumpTargetProcess
mov rcx, rsi
call rbx
xor bl, bl
jmp 0x1400f3ffa
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], ebx
mov r9d, r14d
mov r8, r15
mov edx, ebp
mov rcx, rdi
call fcn.1400f31a0
movzx ebx, al
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400f400d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014f4f0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400f48b0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x40
pop rbx
ret

Function at 0x1400f4910
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x1400f4a90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x1400f4b10
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x1400f5170
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov dword [rsp + 0x68], 4
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x64], ecx
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400f51b2
mov rdx, qword [rbx]
lea rax, [rsp + 0x68]
mov r9d, 0x20010010
mov qword [rsp + 0x30], rax
lea rsi, str.DefaultSecureProtocols
lea rax, [rsp + 0x64]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, 0xfffffffd
je 0x1400f5253
test rdi, rdi
je 0x1400f530b
cmp qword [rbx + 0x18], 7
mov rcx, qword [rdi]
mov r10, qword [rcx + 0x20]
jbe 0x1400f5209
mov rbx, qword [rbx]
mov qword [rsp + 0x40], rbx
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWinHttpDefaultSecureProtocols.cpp
mov dword [rsp + 0x38], eax
lea rdx, str.EnableWinHttpTLSProtocols
lea rax, str.Unexpected_result__u_querying__ls
mov r9d, 0x17
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, str.WinHttpDefaultSecureProtocols
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call r10
xor al, al
jmp 0x1400f5373
mov eax, dword [rsp + 0x64]
or eax, 0xa00
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x64], eax
je 0x1400f5371
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x1400f5277
mov rdx, qword [rbx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edx, eax
test eax, eax
je 0x1400f530f
test rdi, rdi
je 0x1400f530b
cmp qword [rbx + 0x18], 7
mov rcx, qword [rdi]
mov r10, qword [rcx + 0x20]
jbe 0x1400f52bb
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x60]
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWinHttpDefaultSecureProtocols.cpp
mov dword [rsp + 0x50], eax
mov r9d, 0x21
mov qword [rsp + 0x48], rsi
lea rax, str.Unexpected_result__u_setting__ls_____ls_to_0x_08X
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov dword [rsp + 0x38], edx
lea rdx, str.EnableWinHttpTLSProtocols
mov qword [rsp + 0x30], rax
lea rax, str.WinHttpDefaultSecureProtocols
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call r10
xor al, al
jmp 0x1400f5373
test rdi, rdi
je 0x1400f5371
cmp qword [rbx + 0x18], 7
mov rax, qword [rdi]
mov r10, qword [rax + 0x20]
jbe 0x1400f5325
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x60]
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWinHttpDefaultSecureProtocols.cpp
mov dword [rsp + 0x48], eax
lea rdx, str.EnableWinHttpTLSProtocols
mov qword [rsp + 0x40], rsi
lea rax, str.Successfully_updated_HKLM_ls_____ls_to_0x_08X
mov qword [rsp + 0x38], rbx
mov r9d, 0x25
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, str.WinHttpDefaultSecureProtocols
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call r10
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014f4f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400f53a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov dword [rsp + 0x68], 4
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x64], ecx
mov rdx, rbx
mov dword [rsp + 0x60], ecx
cmp qword [rbx + 0x18], 7
jbe 0x1400f53e6
mov rdx, qword [rbx]
lea rax, [rsp + 0x68]
mov r9d, 0x20000010
mov qword [rsp + 0x30], rax
lea rsi, str.DisabledByDefault
lea rax, [rsp + 0x64]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400f542e
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x64], eax
je 0x1400f5535
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x1400f543b
mov rdx, qword [rbx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edx, eax
test eax, eax
je 0x1400f54d3
test rdi, rdi
je 0x1400f54cf
cmp qword [rbx + 0x18], 7
mov rcx, qword [rdi]
mov r10, qword [rcx + 0x20]
jbe 0x1400f547f
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x60]
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWinHttpDefaultSecureProtocols.cpp
mov dword [rsp + 0x50], eax
mov r9d, 0x3b
mov qword [rsp + 0x48], rsi
lea rax, str.Unexpected_result__u_setting_HKLM_ls_____ls_to__u
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov dword [rsp + 0x38], edx
lea rdx, str.EnableSChannelTLSProtocol
mov qword [rsp + 0x30], rax
lea rax, str.WinHttpDefaultSecureProtocols
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call r10
xor al, al
jmp 0x1400f5537
test rdi, rdi
je 0x1400f5535
cmp qword [rbx + 0x18], 7
mov rax, qword [rdi]
mov r10, qword [rax + 0x20]
jbe 0x1400f54e9
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x60]
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonWinHttpDefaultSecureProtocols.cpp
mov dword [rsp + 0x48], eax
lea rdx, str.EnableSChannelTLSProtocol
mov qword [rsp + 0x40], rsi
lea rax, str.Successfully_updated_HKLM_ls_____ls_to__u
mov qword [rsp + 0x38], rbx
mov r9d, 0x3f
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, str.WinHttpDefaultSecureProtocols
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call r10
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014f4f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400fa5e0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400857c0
cmp qword [rax + 0x18], 7
jbe 0x1400fa5fd
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 7
jbe 0x1400fa646
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fa641
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fa64e
call fcn.14014f510
mov eax, ebx
add rsp, 0x40
pop rbx
ret
call fcn.14015fa1c
int3

Function at 0x1400fa660
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov rbx, rdx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400fa70c
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400fa6b0
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x1400fa6ff
mov qword [rsp + 0x260], rdi
mov rdi, rbx
cmp rax, 7
jbe 0x1400fa6d7
mov rdi, qword [rbx]
mov qword [rbx + 0x10], rdx
mov rcx, rdi
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.1403ebbf0
xor eax, eax
mov word [rbx + rdi], ax
mov rdi, qword [rsp + 0x260]
jmp 0x1400fa70c
lea r9, [rsp + 0x30]
mov rcx, rbx
call fcn.140023ce0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14014f4f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400faec0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400faf07
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400faf07
xor al, al
jmp 0x1400faf17
mov ecx, dword [rsp + 0x20]
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014f4f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fb330
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov eax, r8d
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov r8d, 0x400000
cmp eax, r8d
cmovbe r8d, eax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rdi, rdi
je 0x1400fb381
mov ecx, dword [rsp + 0x30]
mov dword [rdi], ecx
test eax, eax
je 0x1400fb389
xor eax, eax
jmp 0x1400fb3c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400fb3ad
mov r8, qword [rcx]
mov r9, qword [r8]
mov r8d, eax
mov rdx, qword [rbx + 0x80]
call r9
jmp 0x1400fb3c2
test eax, eax
jne 0x1400fb3b8
mov eax, 0x80004005
jmp 0x1400fb3c2
jle 0x1400fb3c2
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014f4f0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400fb960
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov r14, r9
mov esi, r15d
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
mov r12d, 0x400000
nop word [rax + rax]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov dword [rsp + 0x30], r15d
cmp ebx, r12d
mov qword [rsp + 0x20], r15
mov rdx, rdi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x30]
add esi, ecx
test eax, eax
je 0x1400fb9df
test ecx, ecx
je 0x1400fb9db
add rdi, rcx
sub ebx, ecx
jne 0x1400fb9a0
mov al, 1
jmp 0x1400fb9e1
xor al, al
mov ecx, esi
add qword [rbp + 0x20], rcx
test r14, r14
je 0x1400fb9ef
mov dword [r14], esi
test al, al
je 0x1400fb9f8
mov eax, r15d
jmp 0x1400fba13
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400fba09
mov eax, 0x80004005
jmp 0x1400fba13
jle 0x1400fba13
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014f4f0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400fe480
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x100
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rbp - 9], rax
mov r12d, r9d
movzx r9d, r8w
mov r8, rdx
mov r15d, dword [rbp + 0x67]
mov r14d, dword [rbp + 0x6f]
mov rsi, qword [rbp + 0x77]
mov rdi, qword [rbp + 0x7f]
mov ebx, dword [rbp + 0x87]
mov r11d, dword [rbp + 0x8f]
mov r10, qword [rbp + 0x97]
mov rdx, qword [rbp + 0x9f]
mov rax, qword [rcx]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
lea rdx, [rbp - 0x49]
call qword [rax + 0x50]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov r8d, 1
lea rdx, [0x140505098]
lea rcx, [rbp - 0x69]
call fcn.14001fb40
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
mov r8d, 1
lea rdx, [0x140502150]
lea rcx, [rsp + 0x70]
call fcn.14001fb40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x140516800]
movdqu xmmword [rbp - 0x19], xmm1
xor ebx, ebx
mov word [rbp - 0x29], bx
mov byte [rsp + 0x20], bl
lea r9, [rbp - 0x69]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.140086f50
mov rdx, qword [rbp - 0x31]
cmp rdx, 7
jbe 0x1400fe5d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe5ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe6eb
call fcn.14014f510
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbp - 0x39], xmm1
mov rdx, qword [rbp - 0x71]
cmp rdx, 7
jbe 0x1400fe624
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe61f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe6f1
call fcn.14014f510
movdqa xmm0, xmmword [0x140516800]
movdqu xmmword [rbp - 0x79], xmm0
mov word [rsp + 0x70], bx
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x1400fe676
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe6f7
call fcn.14014f510
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 7
cmova rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 7
jbe 0x1400fe6c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe6c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe6e5
call fcn.14014f510
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14014f4f0
add rsp, 0x100
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14015fa1c
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
int3
Function at 0x140104640
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x238
mov ecx, 0x202
lea rdx, [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140104666
add rsp, 0x238
ret
lea rdx, str.Failed_to_initialize_network_subsystem
lea rcx, [rsp + 0x20]
call fcn.14001cc20
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140104b00
lea rdx, [0x1405746d0]
lea rcx, [rsp + 0x40]
call fcn.140152094
int3

Function at 0x1401225c0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x1401225d0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.14014fc5c
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140122623
mov rcx, rdi
call fcn.14014f510
mov ecx, dword [rsp + 0x38]
call fcn.14014fc5c
mov rdi, rax
jmp 0x140122627
test eax, eax
jne 0x14012267e
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140122676
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x140122676
test dl, dl
jne 0x140122676
cmp dword [rax + 0x1a4], 6
jne 0x14012266e
cmp dword [rax + 0x194], 6
jne 0x14012266e
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x140122643
mov rcx, rdi
call fcn.14014f510
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401225d0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x1401225d0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.14014fc5c
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140122623
mov rcx, rdi
call fcn.14014f510
mov ecx, dword [rsp + 0x38]
call fcn.14014fc5c
mov rdi, rax
jmp 0x140122627
test eax, eax
jne 0x14012267e
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140122676
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x140122676
test dl, dl
jne 0x140122676
cmp dword [rax + 0x1a4], 6
jne 0x14012266e
cmp dword [rax + 0x194], 6
jne 0x14012266e
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x140122643
mov rcx, rdi
call fcn.14014f510
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret