joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017d100
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14017d1a0
jmp 0x14017d18f
jae 0x14017d26e
cmp r8, 0x201
jae 0x14017d1a0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14017d206
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14017d1de
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1401a5e40
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14017d22f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14017d2da
mov r8d, r13d
cmp r12, r8
jne 0x14017d180
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14017d30e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14017d18f
jmp 0x14017d1a0
cmp r14, r8
jb 0x14017d328
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14017fad0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14017d2c3
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140011920
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14017d2ae
jmp 0x14017d2c3
lea rcx, str.internal_error:_entered_unreachable_code_rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14library_alloc_src_vecmod.rs
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1401a72e0
jmp 0x14017d33d
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1401a7750
ud2
Function at 0x14017f890
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0xffffffffffffffff
je 0x14014cbd8
add rcx, 0x10
add rsp, 0x28
jmp 0x14014f6b0
lea rcx, [0x1401f6f98]
call fcn.1401a71c0
int3
jmp 0x14017f890
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rbp - 4], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp - 4]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14017f8cd
xor eax, eax
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbp
ret

Function at 0x14017f8f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, qword [rcx]
mov rcx, qword [rax]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14017f925
movsxd rdx, eax
xor ecx, ecx
jmp 0x14017f949
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x14017f949
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x20
pop rbp
ret

Function at 0x14017f960
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, qword [rcx]
mov rcx, qword [rax]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14017f999
movsxd rdx, eax
xor eax, eax
add rsp, 0x20
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14017f9c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp + 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 4]
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
cmp esi, 0xffffffff
jne 0x14017fa13
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
xor ecx, ecx
cmp esi, 0xffffffff
sete cl
mov edx, dword [rbp + 4]
cmove rdx, rax
mov rax, rcx
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x1401851a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x14021cc48]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140185236
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x140185263
test eax, eax
js 0x140185242
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x140185259
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, [0x14021ccb0]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.14017ede0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14017af70
mov ecx, 7
int 0x29
ud2

Function at 0x1401852c0
Capabilities:
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov edi, edx
cmp byte [rcx], 0
mov eax, 0x17
mov r14d, 2
cmovne r14d, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, r14d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401853a0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x140185327
mov esi, eax
cmp eax, 0x2726
jne 0x140185393
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, r14d
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14018538b
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x1401853a0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x1401853a0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140185d50
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
invalid
dec dword [rcx + rcx*4 - 0x39]
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140272341]
mov ecx, 0x10
mov edx, 8
Function at 0x140187370
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov eax, dword [0x140272438]
cmp eax, 3
jne 0x14018749f
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x1401874c5
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.1401937e0
test byte [rbp + 0x158], 1
je 0x14018740e
lea rax, [0x14021c160]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140187490
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140187471
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140187489
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1401a6020
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x1401873c5
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1401a6090
jmp 0x140187490
Function at 0x140187610
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14018769a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 0x17
je 0x1401876aa
cmp ecx, 2
jne 0x1401876e8
cmp eax, 0xf
jbe 0x140187702
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x1401876f8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401876ef
cmp eax, 0x1b
jbe 0x14018771a
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x1401876f8
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in___std_src_sys_common_net.rs
lea r8, [0x14021d570]
mov edx, 0x39
call fcn.1401a72e0
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, [0x14021d5c8]
mov edx, 0x3a
call fcn.1401a72e0
int3
Function at 0x1401990a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
movdqa xmmword [rbp - 0x10], xmm12
movdqa xmmword [rbp - 0x20], xmm11
movdqa xmmword [rbp - 0x30], xmm10
movdqa xmmword [rbp - 0x40], xmm9
movdqa xmmword [rbp - 0x50], xmm8
movdqa xmmword [rbp - 0x60], xmm7
movdqa xmmword [rbp - 0x70], xmm6
lea r10, [rcx + 7]
and r10, 0xfffffffffffffff8
mov r9, r10
sub r9, rcx
mov r8, rdx
sub r8, r9
jb 0x1401990f7
cmp r8, 8
jae 0x140199113
test rdx, rdx
je 0x14019910c
cmp rdx, 4
jae 0x140199129
xor eax, eax
xor r8d, r8d
jmp 0x1401991c0
xor eax, eax
jmp 0x1401996a0
mov eax, r8d
and eax, 7
cmp r10, rcx
jne 0x1401991dc
xor edx, edx
jmp 0x14019928d
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14021f440]
movdqa xmm3, xmmword [0x1401f8d90]
pxor xmm1, xmm1
nop word [rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140199150
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1401996a0
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1401991c0
jmp 0x1401996a0
cmp r9, 4
jae 0x1401991ec
xor edx, edx
xor r10d, r10d
jmp 0x140199276
mov r10d, r9d
and r10d, 4
pxor xmm0, xmm0
xor edx, edx
movdqa xmm2, xmmword [0x14021f440]
movdqa xmm3, xmmword [0x1401f8d90]
pxor xmm1, xmm1
nop dword [rax]

Function at 0x14019d890
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14019d8da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14019d8da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14019d8da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14019d8da
cmp dword [rcx + 0x84], 0xe
jbe 0x14019d8da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14019d8dc
xor al, al
add rsp, 0x28
ret
Function at 0x14019e940
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
test rcx, rcx
je 0x14019e971
mov r8, qword [rcx + 8]
test byte [rcx], 1
mov qword [rcx], 0
jne 0x14019eb4c
call fcn.14017a3f0
mov rsi, rax
test byte [rax], 1
je 0x14019e98f
mov rax, rsi
add rax, 8
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
jmp 0x14019e9c3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rax, rsi
add rax, 8
mov qword [rsi], 1
mov qword [rsi + 0x10], r14
lea rcx, [rbx + 1]
mov qword [rax], rcx
movabs r15, 0x736f6d6570736575
xor r15, rbx
movabs r12, 0x646f72616e646f6d
xor r12, r14
movabs r13, 0x6c7967656e657261
xor r13, rbx
movabs rbp, 0x7465646279746573
xor rbp, r14
mov esi, 1
lea rdi, [rsp + 0x50]
xorps xmm6, xmm6
nop dword [rax + rax]
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r14
movups xmmword [rdi], xmm6
mov qword [rdi + 0x10], 0
mov qword [rsp + 0x68], rsi
mov r8d, 8
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x68]
call fcn.140007a90
mov r9, qword [rsp + 0x50]
shl r9, 0x38
or r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, r9
mov r8, qword [rsp + 0x20]
add r8, rdx
mov rax, qword [rsp + 0x28]
rol rdx, 0xd
add rax, rcx
xor rdx, r8
rol rcx, 0x10
xor rcx, rax
rol r8, 0x20
add rax, rdx
add r8, rcx
rol rdx, 0x11
xor rdx, rax
rol rcx, 0x15
rol rax, 0x20
xor rcx, r8
xor r8, r9
xor rax, 0xff
add r8, rdx
add rax, rcx
rol rdx, 0xd
xor rdx, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rax
add rax, rdx
rol rdx, 0x11
add r8, rcx
xor rdx, rax
rol rcx, 0x15
xor rcx, r8
rol rax, 0x20
add r8, rdx
add rax, rcx
rol rdx, 0xd
xor rdx, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rax
add rax, rdx
rol rdx, 0x11
add r8, rcx
xor rdx, rax
rol rcx, 0x15
xor rcx, r8
rol rax, 0x20
add r8, rdx
add rax, rcx
rol rdx, 0xd
xor rdx, r8
rol rcx, 0x10
xor rcx, rax
add rax, rdx
rol rdx, 0x11
rol rcx, 0x15
mov r8, rax
rol r8, 0x20
xor r8, rdx
xor r8, rcx
inc rsi
cmp r8, rax
je 0x14019ea10
xor r8, rax
mov eax, dword [0x1402724d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], 1
mov qword [rax + 0x10], r8
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401a6090
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14018f090
mov rdx, qword [rbp - 0x28]
mov rax, rdx
neg rax
jno 0x1401a6112
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401a6142
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401a6156
lea rax, [0x14021c160]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jae 0x1401a6176
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140011920
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401a6176
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140011920
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000eed0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000eee0]
mov dword [rax], 1
mov rax, qword [0x14000eef0]
mov dword [rax], 1
mov rax, qword [0x14000ee50]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000eec0]
mov dword [0x14001200c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000efa0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000ef80]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000ee30]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001e50
Capabilities:
Delete network filter via wfp api
Enumerate network filters via wfp api

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0xffffffff
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x34], 0
call sym.FwpmEngineOpen0
test eax, eax
jne 0x140001f60
mov rcx, qword [rsp + 0x38]
xor edx, edx
lea r8, [rsp + 0x40]
call sym.FwpmFilterCreateEnumHandle0
test eax, eax
jne 0x140002030
xor edi, edi
lea rsi, [rsp + 0x48]
lea rbx, [rsp + 0x34]
jmp 0x140001f0c
mov edx, dword [rsp + 0x34]
test edx, edx
je 0x140001f80
mov rcx, qword [rsp + 0x48]
mov rdx, qword [str.Custom_Outbound_Filter]
mov r8, qword [rcx]
mov rcx, qword [r8 + 0x10]
call sym.wcscmp
test eax, eax
je 0x140001fb0
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x40]
mov r9, rsi
mov r8d, 1
mov rcx, qword [rsp + 0x38]
call sym.FwpmFilterEnum0
test eax, eax
je 0x140001ee0
mov edx, eax
lea rcx, str.____FwpmFilterEnum0_failed_with_error_code:_0x_x._n
call sym.printf
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sym.FwpmFilterDestroyEnumHandle0
mov rcx, qword [rsp + 0x38]
call sym.FwpmEngineClose0
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov edx, eax
lea rcx, section..rdata
call sym.printf
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea rsi, [rsp + 0x50]
mov rcx, qword [section..data]
mov rdx, rsi
call sym.GetProviderGUIDByDescription
test eax, eax
jne 0x140002000
test edi, edi
jne 0x140001f3b
lea rcx, str.____Unable_to_find_any_WFP_filter_created_by_this_tool._n
call sym.printf
jmp 0x140001f3b
mov r9, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov r10, qword [r9]
mov rdi, qword [r10 + 0xb0]
mov rdx, rdi
call sym.FwpmFilterDeleteById0
mov rdx, rdi
mov r8d, eax
test eax, eax
je 0x140001ff0
lea rcx, str.____Failed_to_delete_filter_id:__llu_with_error_code:_0x_x._n
call sym.printf
mov edi, 1
jmp 0x140001f0c
lea rcx, str.Deleted_filter_id:__llu._n
call sym.printf
jmp 0x140001fe2
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call sym.FwpmProviderDeleteByKey0
test eax, eax
je 0x140002047
cmp eax, 0x8032000a
je 0x140001f98
mov edx, eax
lea rcx, str.____FwpmProviderDeleteByKey0_failed_with_error_code:_0x_x._n
call sym.printf
jmp 0x140001f98
mov edx, eax
lea rcx, str.____FwpmFilterCreateEnumHandle0_failed_with_error_code:_0x_x._n
call sym.printf
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.Deleted_custom_WFP_provider._n
call sym.printf
jmp 0x140001f98
Function at 0x140002060
Capabilities:
Delete network filter via wfp api

Disassembly:
push rbx
sub rsp, 0x50
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
lea rax, [rsp + 0x38]
mov rbx, rcx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.FwpmEngineOpen0
test eax, eax
jne 0x140002118
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call sym.FwpmFilterDeleteById0
test eax, eax
je 0x140002100
cmp eax, 0x80320003
je 0x140002178
mov r8d, eax
mov rdx, rbx
lea rcx, str.____Failed_to_delete_filter_id:__llu_with_error_code:_0x_x._n
call sym.printf
lea rbx, [rsp + 0x40]
mov rcx, qword [section..data]
mov rdx, rbx
call sym.GetProviderGUIDByDescription
test eax, eax
jne 0x140002130
mov rcx, qword [rsp + 0x38]
call sym.FwpmEngineClose0
nop
add rsp, 0x50
pop rbx
ret
mov rdx, rbx
lea rcx, str.Deleted_filter_id:__llu._n
call sym.printf
jmp 0x1400020d1
mov edx, eax
lea rcx, section..rdata
call sym.printf
nop
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call sym.FwpmProviderDeleteByKey0
test eax, eax
je 0x140002160
cmp eax, 0x8032000a
je 0x1400020e9
mov edx, eax
lea rcx, str.____FwpmProviderDeleteByKey0_failed_with_error_code:_0x_x._n
call sym.printf
jmp 0x1400020e9
lea rcx, str.Deleted_custom_WFP_provider._n
call sym.printf
jmp 0x1400020e9
lea rcx, str.____The_filter_does_not_exist._n
call sym.printf
jmp 0x1400020d1