joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec2d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov r15b, 5
test r9, r9
je 0x1400ec38b
mov rdi, r9
mov rbx, r8
mov r12d, 0xffffffff
nop word cs:[rax + rax]
cmp rdi, r12
mov r14d, 0xffffffff
cmovb r14, rdi
mov rcx, rbx
mov edx, r14d
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1400ec336
add rbx, r14
sub rdi, r14
jne 0x1400ec310
jmp 0x1400ec38b
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp - 0x10], rdi
movzx eax, byte [0x140202701]
mov ecx, 8
mov edx, 8
call fcn.14001c710
test rax, rax
je 0x1400ec3a1
mov qword [rax], rdi
lea rcx, str.couldnt_generate_random_bytes
mov qword [rsi], rcx
mov qword [rsi + 8], 0x1e
mov qword [rsi + 0x10], rax
lea rax, fcn.140028db0
mov qword [rsi + 0x18], rax
xor r15d, r15d
mov byte [rsi + 0x20], r15b
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 8
call fcn.140155720
ud2

Function at 0x1400ec900
Capabilities:
Encode data using xor

Disassembly:
movabs rdx, 0x67452301efcdab89
mov rax, qword [rcx]
movabs r10, 0x98badcfe10325476
xor r8d, r8d
xor r9d, r9d
nop dword [rax]
bt rax, r9
mov r11, rdx
cmovae r11, r8
xor r11, r10
rol r11, 1
lea r10d, [r9 + 1]
movzx r10d, r10b
bt rax, r10
mov r10, rdx
cmovae r10, r8
xor r10, r11
rol r10, 1
add r9, 2
cmp r9, 0x40
jne 0x1400ec920
xor r10, rax
mov qword [rcx], r10
ret
Function at 0x1400ecac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x868
mov rdi, rcx
mov rbp, qword [rcx + 8]
call rbp
mov rsi, rax
xor r12d, r12d
lea rbx, [rsp + 0x58]
mov r8d, 0x800
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x858], rsi
mov qword [rsp + 0x860], 0
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
xor r15d, r15d
xor esi, esi
xor eax, eax
mov qword [rsp + 0x28], rax
mov r13, r12
cmp r12, 0x65
mov r12d, 0x64
cmovae r12, r13
inc r12
nop dword [rax]
cmp r13, 0x190
jae 0x1400ecc0a
call rbp
mov r14, rax
mov rcx, rdi
mov rdx, rbx
mov r8b, 1
call fcn.1400ec890
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.1400ec780
mov rbp, qword [rdi + 8]
call rbp
xor edx, edx
test r14, r14
je 0x1400ecc7a
test rax, rax
je 0x1400ecc7a
mov ecx, eax
sub ecx, r14d
je 0x1400ecc78
inc r13
cmp r12, r13
jne 0x1400ecb40
mov edx, dword [rsp + 0x860]
mov dword [rsp + 0x860], ecx
sub edx, ecx
sete r8b
cmp edx, dword [rsp + 0x864]
sete r9b
or r9b, r8b
movzx r8d, r9b
add qword [rsp + 0x30], r8
cmp r14, rax
sbb r15d, 0xffffffff
imul eax, ecx, 0xc28f5c29
add eax, 0x51eb850
ror eax, 2
cmp eax, 0x28f5c29
adc qword [rsp + 0x38], 0
mov eax, ecx
sub eax, esi
mov r8d, eax
neg r8d
cmovs r8d, eax
mov dword [rsp + 0x864], edx
movsxd rax, r8d
add qword [rsp + 0x28], rax
mov esi, ecx
jmp 0x1400ecb25
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
mov dl, 2
cmp r15d, 3
jg 0x1400ecc7a
mov dl, 3
cmp qword [rsp + 0x28], 0x12c
jb 0x1400ecc7a
mov dl, 1
cmp qword [rsp + 0x38], 0x10e
ja 0x1400ecc7a
mov dl, 4
cmp qword [rsp + 0x30], 0x10e
ja 0x1400ecc7a
movabs rcx, 0x6d3a06d3a06d3a07
mov r8, qword [rsp + 0x28]
mov rax, r8
mul rcx
shr rdx, 7
cmp r8, 0x12bf
jbe 0x1400ecc90
test rdx, rdx
je 0x1400ecca3
bsr rax, rdx
xor rax, 0x3f
jmp 0x1400ecca8
mov dl, 1
mov al, 1
add rsp, 0x868
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [0x140174720]
movaps xmmword [rsp + 0x40], xmm0
movzx edx, byte [rsp + rdx + 0x40]
jmp 0x1400eccb7
mov eax, 0x40
mov cl, 0x40
sub cl, al
mov dl, 0xbf
sub dl, al
movzx eax, dl
div cl
mov edx, eax
xor eax, eax
jmp 0x1400ecc7c

Function at 0x1400f10c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140104df0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 0x20], 0
cmp qword [rdx + 0x10], 0
je 0x140104eeb
mov qword [rbp - 0x10], rdx
lea rcx, [0x1401ab506]
call sub.oleaut32.dll_SysAllocString
mov rdi, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa0]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8, rbx
mov r9d, 0x30
call rax
mov r14d, eax
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
test r14d, r14d
mov rdx, qword [rbp - 0x10]
js 0x140104eeb
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
cmp qword [rdx + 0x20], 0
je 0x140104eaf
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140104eaf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 0x20], 1
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x30]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov rax, qword [rcx + 0x28]
mov qword [rsi + 0x28], rax
jmp 0x140104efa
mov qword [rsi], 2
mov rcx, rdx
call fcn.140103d50
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1401097a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rdi, rcx
lea rdx, [rbp - 0x1c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x1401098a3
mov rsi, rax
mov qword [rbp - 0x28], rdi
movsxd rax, dword [rbp - 0x1c]
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 8
mov qword [rbp - 8], 0
lea r13, [rsi + rax*8]
lea rbx, [rbp - 0x40]
lea r14, [rbp - 0x58]
lea r15, [rbp - 0x18]
mov rdi, rsi
jmp 0x140109841
add rdi, 8
mov rax, qword [rbp - 0x10]
lea rcx, [rdx + rdx*2]
mov rdx, qword [rbp - 0x30]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rax + rcx*8], xmm0
inc qword [rbp - 8]
cmp rdi, r13
je 0x140109886
mov r12, qword [rdi]
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rax
mov word [rbp - 0x48], 0
mov rcx, rbx
mov rdx, r14
call fcn.14010b510
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp - 0x18]
jne 0x140109820
mov rcx, r15
call fcn.140033ff0
mov rdx, qword [rbp - 8]
jmp 0x140109820
mov rcx, rsi
call sub.KERNEL32.dll_LocalFree
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x28]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rcx], xmm0
jmp 0x1401098ba
mov qword [rdi], 0
mov qword [rdi + 8], 8
mov qword [rdi + 0x10], 0
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14011a030
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x38]
movups xmm1, xmmword [rdx + 0x48]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rax, qword [rdx + 0x28]
movzx ebx, byte [rdx + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], bl
movzx eax, byte [0x140202701]
mov ecx, 0x5f0
mov edx, 8
call fcn.14001c710
test rax, rax
mov qword [rbp - 8], r14
je 0x14011a2a0
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [r14 + 0x60]
mov qword [rbp - 0x18], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
mov r12d, 1
lock xadd qword [0x140202770], r12
mov r14, r12
xor r14, rcx
lea r15, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r15
lea r15, [rax + r8]
rol rax, 0x15
add r14, r9
mov r13, r14
xor r13, r10
rol r14, 0x20
xor r12, r15
add r12, r13
rol r13, 0xd
xor r15, r11
xor r13, r12
rol r12, 0x20
xor r15, rax
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r15, r12
xor r13, r14
rol r14, 0x20
xor r12, r11
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
xor r14, 0xff
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
add r14, r15
rol r15, 0x10
xor r15, r14
rol r15, 0x15
xor r13, r12
add r14, r13
rol r13, 0x11
mov r12, r14
rol r12, 0x20
xor r12, r13
xor r12, r15
xor r12, r14
je 0x14011a0f0
mov rcx, qword [rbp - 8]
mov rax, qword [rcx + 0x58]
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rdx, qword [rbp - 0x10]
mov qword [rsi + 0x138], rdx
mov byte [rsi + 0x140], bl
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov rdx, qword [rbp - 0x18]
mov qword [rsi + 0x100], rdx
mov qword [rsi + 0x108], r12
mov qword [rsi + 0x110], rax
mov rdx, qword [rcx + 0x10]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14011a28c
test rdx, rdx
je 0x14011a28c
mov rcx, qword [rcx + 0x18]
mov r8d, 1
call fcn.14001c720
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.140155720
ud2
Function at 0x140123850
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x58
ret

Function at 0x140123890
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x400], 2
mov qword [rbp + 0x408], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140123930
jmp 0x14012391f
jae 0x1401239ef
cmp r8, 0x201
jae 0x140123930
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x140123987
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14012395f
lea rcx, [rbp + 0x3f8]
mov rdx, rbx
call fcn.140149b80
mov rsi, qword [rbp + 0x3f8]
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x408], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3e8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1401239b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140123a69
mov r8d, r13d
cmp r12, r8
jne 0x140123910
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140123a9d
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14012391f
jmp 0x140123930
cmp r14, r8
jb 0x140123ab7
lea rcx, [rbp + 0x3c8]
mov rdx, r15
call fcn.140126bd0
movups xmm0, xmmword [rbp + 0x3c8]
movups xmm1, xmmword [rbp + 0x3d8]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmmword [rbp + 0x3a0], xmm0
mov rsi, qword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
je 0x140123a52
mov rcx, qword [rbp + 0x400]
add rdx, rdx
mov r8d, 2
call fcn.14001c720
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3f0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
jne 0x140123a3d
jmp 0x140123a52
lea rcx, str.internal_error:_entered_unreachable_code_rustc_9b00956e56009bab2aa15d7bff10916599e3d6d6library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140155a10
jmp 0x140123acc
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140155e90
ud2
Function at 0x140126a20
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rcx, qword [rcx]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
cmp esi, 0xffffffff
jne 0x140126a6c
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
xor ecx, ecx
cmp esi, 0xffffffff
sete cl
mov edx, dword [rsp + 0x3c]
cmove rdx, rax
mov rax, rcx
add rsp, 0x40
pop rsi
ret

Function at 0x140126b20
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x140126b4f
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x28
ret

Function at 0x140126b70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140126ba2
movsxd rdx, eax
xor ecx, ecx
mov rax, rcx
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x140126b9a
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x28
ret
Function at 0x14012dff0
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
in al, dx
jo case.0x140127a06.286
mov eax, edx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14012fef0
add byte [rax], al
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
cmp eax, ebx
je 0x14012e055
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140130f10
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
cmp edi, ebx
jne 0x14012e060
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14012e08a
test rdi, rdi
je 0x14012e0b6
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.14001c720
xor eax, eax
shr bl, 0xce
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14012e058
add rdi, rdi
mov r8d, 2
mov eax, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.14001c720
jmp 0x14012e055
lahf
xor eax, eax
jmp 0x14012e058

Function at 0x14012e4d0
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1401b1148]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14012e508
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14012e56a
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14012e575
xor edx, edx
jmp 0x14012e585
cmp eax, 0x103
je 0x14012e5b0
test eax, eax
js 0x14012e590
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1401b11b0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.140126040
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.140121a60
mov ecx, 7
int 0x29
ud2
Function at 0x14012e620
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1401b1148]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14012e658
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14012e6c1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14012e6f5
test eax, eax
js 0x14012e6d5
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1401b11b0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.140126040
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.140121a60
mov ecx, 7
int 0x29
ud2

Function at 0x14012e760
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
cmp word [rcx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14012e836
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x14012e7be
mov esi, eax
cmp eax, 0x2726
jne 0x14012e829
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14012e821
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14012e836
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x14012e836
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14012f500
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140202701]
mov ecx, 0x10
mov edx, 8
call fcn.14001c710
test rax, rax
je 0x14012f5df
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14012f690]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14012f5d1
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14012f5a8
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.14001c720
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.14001c720
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.140155720
ud2

Function at 0x140131a30
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x200
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rsp + 0x26], ax
mov rax, qword [0x140202858]
cmp rax, 3
jne 0x140131b3e
lea rax, [rsp + 0x26]
mov qword [rsp + 0x30], rax
cmp rdi, 0x17f
ja 0x140131b60
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x80], 0
inc rdi
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r8, rdi
call fcn.14013ec70
cmp qword [rsp + 0x38], 0
je 0x140131ac2
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140131b30
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140131b15
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140131b29
mov rax, qword [rsp + 0x28]
movzx ecx, word [rsp + 0x26]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x200
pop rbx
pop rdi
pop rsi
ret
mov rbx, rdx
call fcn.140154780
mov rdx, rbx
lea rax, [rsp + 0x26]
mov qword [rsp + 0x30], rax
cmp rdi, 0x17f
jbe 0x140131a78
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8, rdi
call fcn.1401547f0
jmp 0x140131b30