joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021320
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14003c1e0], rbx
je 0x14002136c
cmp rax, rbx
jne 0x14002135f
mov ebx, 1
mov esi, ebx
jmp 0x140021371
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140021344
mov ebx, 1
mov eax, dword [0x14003c1e8]
cmp eax, ebx
jne 0x140021387
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400213ec
mov eax, dword [0x14003c1e8]
test eax, eax
jne 0x1400213e6
mov dword [0x14003c1e8], ebx
lea r15, [0x140026030]
lea rdi, [0x140026018]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400213d8
test eax, eax
jne 0x1400213dc
cmp qword [rdi], 0
je 0x1400213cd
mov rax, qword [rdi]
mov rcx, qword [0x140025fc8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400213ae
test eax, eax
je 0x1400213ec
mov eax, 0xff
jmp 0x1400214c8
mov dword [0x14003bac4], ebx
mov eax, dword [0x14003c1e8]
cmp eax, ebx
jne 0x140021413
lea rdx, [0x140026010]
lea rcx, [0x140025fd0]
call sub.msvcrt.dll__initterm
mov dword [0x14003c1e8], 2
test esi, esi
jne 0x140021420
xor eax, eax
xchg qword [0x14003c1e0], rax
cmp qword [0x14003c200], 0
je 0x140021454
lea rcx, [0x14003c200]
call fcn.140021a40
test eax, eax
je 0x140021454
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14003c200]
mov r9, qword [0x140025fc8]
call r9
mov r8, qword [0x14003bad8]
mov rdx, qword [0x14003bad0]
mov ecx, dword [0x14003bac8]
call fcn.140001984
mov dword [0x14003bac0], eax
cmp dword [0x14003bae0], 0
jne 0x140021484
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14003bac4], 0
jne 0x140021499
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14003bac0]
jmp 0x1400214c8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400d4000
add rsp, 0x28
jmp 0x140021320

Function at 0x14002192c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140021978
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140021970
cmp dword [rcx + 0x3c], edx
jl 0x140021970
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140021970
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140021978
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140021db8
Capabilities:
Print debug messages

Disassembly:
jmp 0x140021dc4
push rbx
sub rsp, 0x540
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140021e41
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140021e61
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140021520
add rsp, 0x540
pop rbx
ret

Function at 0x140021dc4
Capabilities:
Print debug messages

Disassembly:
jmp 0x140021dc4
push rbx
sub rsp, 0x540
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140021e41
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140021e61
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140021520
add rsp, 0x540
pop rbx
ret
Function at 0x140001b71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x140001bb7
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x140001c9b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 0
jmp 0x140001caa
cmp byte [rax + 0x3a], 0
jne 0x140001cdc
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov r8, qword [rax + 0x28]
mov r14b, byte [rax + 0x38]
mov r11d, r14d
xor r11b, 1
test r8, r8
je 0x140001bf3
cmp r9, r8
jbe 0x140001bed
cmp byte [r10 + r8], 0xbf
jg 0x140001bf3
jmp 0x140001cee
jne 0x140001cee
cmp r8, r9
je 0x140001cb1
mov bl, byte [r10 + r8]
movzx esi, bl
test sil, sil
jns 0x140001c57
mov edi, esi
and edi, 0x1f
movzx ebp, byte [r10 + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x140001c49
movzx esi, byte [r10 + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x140001c52
movzx ebx, byte [r10 + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
jmp 0x140001c57
shl edi, 6
or edi, ebp
mov esi, edi
jmp 0x140001c57
shl edi, 0xc
or esi, edi
test r14b, r14b
jne 0x140001cbc
cmp esi, 0x110000
je 0x140001cd4
mov edi, 1
cmp esi, 0x80
jb 0x140001c8d
mov edi, 2
cmp esi, 0x800
jb 0x140001c8d
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov r14d, r11d
jmp 0x140001bd3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 1
call fcn.1400013bb
jmp 0x140001ce3
mov byte [rax + 0x38], r11b
test r14b, r14b
jne 0x140001cc3
jmp 0x140001cd8
mov byte [rax + 0x38], r11b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov qword [rcx], 1
jmp 0x140001ce3
mov byte [rax + 0x38], r11b
mov byte [rdx + 0x12], 1
mov qword [rcx], 0
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rax + 0x38], r11b
mov rcx, r10
mov rdx, r9
call fcn.140042550
ud2
Function at 0x1400082b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140008330
cmp r10, rax
jb 0x1400083a4
cmp r10, rdx
ja 0x1400083b1
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140008332
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140008310
jmp 0x140008393
ja 0x14000833a
mov rax, r10
cmp r11, r8
jne 0x1400082e2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop dword [rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140008370
mov r15, rbx
sub ecx, edx
jns 0x14000838a
jmp 0x140008395
cmp rbx, r14
je 0x1400083bb
and edx, 0x7f
shl edx, 8
movzx ebp, byte [r15 + 1]
add r15, 2
or edx, ebp
sub ecx, edx
js 0x140008395
xor al, 1
cmp r15, r14
jne 0x140008350
jmp 0x140008395
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rax
mov rdx, r10
call fcn.1400423f0
ud2
mov rcx, r10
call fcn.140042330
ud2
lea rcx, [0x14004f97b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140042340
ud2
Function at 0x14000e554
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x98]
mov rdx, qword [rdx + 0x90]
cmp rdx, rcx
jb 0x14000e704
mov rax, qword [rdi + 0x80]
xorps xmm0, xmm0
lea rbx, [rsp + 0x20]
movups xmmword [rbx + 0x30], xmm0
mov dword [rbx], ecx
mov dword [rbx + 4], 1
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x14000e66d
cmp eax, 0x80090318
je 0x14000e6cb
test eax, eax
jne 0x14000e6bb
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x80]
mov r9, qword [rdi + 0x90]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov rax, rcx
mov qword [rdi + 0x70], 0
add rax, r8
jb 0x14000e6f4
cmp r9, rax
jb 0x14000e6fe
lea rax, [rdi + 0x60]
add rdx, rcx
add r8, rdx
mov rcx, rax
call fcn.140022425
mov qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14000e4c2
xor eax, eax
cmp qword [rdi + 0x98], 0
sete al
mov qword [rdi + 0x58], rax
mov byte [rsi + 1], 0
jmp 0x14000e6ea
cmp eax, 0x90317
je 0x14000e6e4
cmp eax, 0x90321
jne 0x14000e6bb
mov dword [rdi + 0xe0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xe4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14000e4c2
mov qword [rdi + 0x58], 0
mov byte [rsi + 1], bl
jmp 0x14000e6ea
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x14000e6ea
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x58], rax
mov byte [rsi + 1], 0
jmp 0x14000e6e8
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rdx, rax
call fcn.1400423f0
ud2
mov rcx, rax
mov rdx, r9
call fcn.140042330
ud2
Function at 0x140017bde
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140017c19
mov r15d, 8
sub r15, r11
cmp r15, r8
mov rax, r8
cmovb rax, r15
cmp rax, 3
jbe 0x140017c21
mov r14d, dword [rdx]
mov r10d, 4
jmp 0x140017c27
xor r15d, r15d
jmp 0x140017cd7
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140017c4a
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x140017c61
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x140017c81
add r11, r8
jmp 0x140017da8
mov rdi, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x30], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rcx
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140017d4d
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140017cfa
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 3
jbe 0x140017d5f
mov esi, dword [rdx + r15]
mov r8d, 4
jmp 0x140017d64
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x140017d8a
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x140017da4
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001b70c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbx, qword [rcx + 0x1008]
mov rdi, qword [rcx + 0x1018]
inc rdi
mov qword [rcx + 0x1018], rdi
add rdi, qword [rcx + 0x1010]
lea r8, [rcx + 0x820]
lea r10, [0x14004e8b0]
mov r11d, 0x7f8
lea r9, str.No_entropy_available:
mov rax, qword [r10]
mov rdx, qword [r10 + 8]
lea r14, [r8 + rdx*8]
lea r15, [r8 + rax*8]
xor r12d, r12d
mov rax, rbx
shl rax, 0x15
xor rax, rbx
not rax
add rax, qword [r14 + r12 - 0x18]
mov rsi, qword [r15 + r12 - 0x18]
mov rbx, qword [r15 + r12 - 0x10]
mov rdx, rsi
and rdx, r11
add rdi, qword [rcx + rdx + 0x808]
add rdi, rax
mov qword [r15 + r12 - 0x18], rdi
shr rdi, 8
and rdi, r11
add rsi, qword [rcx + rdi + 0x808]
mov qword [r15 + r12 - 0x818], rsi
mov rdx, rax
shr rdx, 5
xor rdx, rax
add rdx, qword [r14 + r12 - 0x10]
mov rax, rbx
and rax, r11
add rsi, qword [rcx + rax + 0x808]
add rsi, rdx
mov qword [r15 + r12 - 0x10], rsi
shr rsi, 8
and rsi, r11
add rbx, qword [rcx + rsi + 0x808]
mov qword [r15 + r12 - 0x810], rbx
mov rax, rdx
shl rax, 0xc
xor rax, rdx
mov rdx, qword [r15 + r12 - 8]
add rax, qword [r14 + r12 - 8]
mov rsi, rdx
and rsi, r11
add rbx, qword [rcx + rsi + 0x808]
add rbx, rax
mov qword [r15 + r12 - 8], rbx
shr rbx, 8
and rbx, r11
add rdx, qword [rcx + rbx + 0x808]
mov qword [r15 + r12 - 0x808], rdx
mov rbx, rax
shr rbx, 0x21
xor rbx, rax
mov rdi, qword [r15 + r12]
add rbx, qword [r14 + r12]
mov rax, rdi
and rax, r11
add rdx, qword [rcx + rax + 0x808]
add rdx, rbx
mov qword [r15 + r12], rdx
shr rdx, 8
and rdx, r11
add rdi, qword [rcx + rdx + 0x808]
mov qword [r15 + r12 - 0x800], rdi
add r12, 0x20
cmp r12, 0x400
jne 0x14001b761
add r10, 0x10
cmp r10, r9
jne 0x14001b74f
mov qword [rcx + 0x1008], rbx
mov qword [rcx + 0x1010], rdi
mov qword [rcx], 0x100
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001fc30
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
cmp rdx, 0x20
jae 0x14001fc3e
jmp fcn.1400095d0
jmp fcn.140004dc0
Function at 0x140027f20
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x488
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x400], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x60]
mov r8d, 0xe
mov rcx, rdi
call fcn.1400282d0
cmp qword [rbp - 0x60], 0
je 0x140027f94
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3b8], rax
lea rcx, [rbp + 0x3b8]
call fcn.140024520
mov qword [rsi], 0
add rsp, 0x488
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3f0], rax
test rax, rax
je 0x140027f79
mov qword [rbp + 0x3e8], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x3f8], rax
xor ebx, ebx
mov r8d, 0x400
mov rcx, rdi
xor edx, edx
call fcn.140035e60
mov qword [rbp + 0x3d0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140028012
jmp 0x140028060
mov rsi, r8
jae 0x1400280c5
cmp rsi, 0x201
jb 0x140028060
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3d8]
sub rax, rbx
cmp rax, r8
jae 0x14002803d
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call fcn.140043780
mov r13, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x14002806d
lea r12, [rbp - 0x60]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x3f0]
mov rdx, r12
mov r8d, esi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140028098
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400280f7
mov r8d, edi
cmp rsi, r8
jne 0x140028000
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002819a
add rsi, rsi
cmp rsi, 0x201
jae 0x140028012
jmp 0x140028060
cmp r14, r8
jb 0x1400281b4
lea rcx, [rbp + 0x3b8]
mov rdx, r15
call fcn.140026d00
mov rsi, qword [rbp + 0x3b8]
movups xmm0, xmmword [rbp + 0x3c0]
movaps xmmword [rbp + 0x3a0], xmm0
mov dil, 1
jmp 0x140028109
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
xor edi, edi
mov rax, qword [rbp + 0x3d8]
test rax, rax
je 0x140028130
test r13, r13
je 0x140028130
add rax, rax
je 0x140028130
mov rcx, qword [0x14005fc80]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
test dil, dil
je 0x14002814c
mov rax, qword [rbp + 0x3e8]
mov qword [rax], rsi
movaps xmm0, xmmword [rbp + 0x3a0]
movups xmmword [rax + 8], xmm0
jmp 0x140028167
mov qword [rbp - 0x60], rsi
mov rax, qword [rbp + 0x3e8]
mov qword [rax], 0
lea rcx, [rbp - 0x60]
call fcn.140024520
mov rax, qword [rbp + 0x3f8]
test rax, rax
je 0x140027f80
add rax, rax
je 0x140027f80
mov rcx, qword [0x14005fc80]
xor edx, edx
mov r8, qword [rbp + 0x3f0]
call sub.kernel32.dll_HeapFree
jmp 0x140027f80
lea rcx, str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len_x
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140042340
jmp 0x1400281bf
mov rcx, r8
mov rdx, r14
call fcn.140042330
ud2
Function at 0x14002f820
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test edx, edx
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14002f86e
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14002f8e2
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x14002f882
cmp eax, 0x2739
jne 0x14002f8cf
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14002f8c9
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x14002f8e9
mov qword [rsi + 8], rdi
jmp 0x14002f865
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x38
pop rdi
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]

Function at 0x14002f9a0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp qword [rdx], 0
je 0x14002fa22
mov r8, rdx
mov eax, 0x3e8
mul qword [rdx + 8]
mov r10d, 0xffffffff
jo 0x14002fa25
mov r8d, dword [r8 + 0x10]
mov r9d, r8d
imul rdx, r9, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14002fa25
imul rdx, r9, 0x431bde83
shr rdx, 0x32
imul edx, edx, 0xf4240
mov r9, rax
inc r9
sete r11b
cmp r8d, edx
setne dl
cmove r9, rax
mov eax, 0xffffffff
cmp r9, rax
mov r10d, 0xffffffff
cmovae r9d, r10d
test dl, r11b
jne 0x14002fa25
mov r10d, r9d
test r9d, r9d
jne 0x14002fa25
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x14002fa5f
xor r10d, r10d
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14002fa51
xor eax, eax
jmp 0x14002fa5f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14002fa70
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp qword [rdx], 0
je 0x14002faf2
mov r8, rdx
mov eax, 0x3e8
mul qword [rdx + 8]
mov r10d, 0xffffffff
jo 0x14002faf5
mov r8d, dword [r8 + 0x10]
mov r9d, r8d
imul rdx, r9, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14002faf5
imul rdx, r9, 0x431bde83
shr rdx, 0x32
imul edx, edx, 0xf4240
mov r9, rax
inc r9
sete r11b
cmp r8d, edx
setne dl
cmove r9, rax
mov eax, 0xffffffff
cmp r9, rax
mov r10d, 0xffffffff
cmovae r9d, r10d
test dl, r11b
jne 0x14002faf5
mov r10d, r9d
test r9d, r9d
jne 0x14002faf5
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x14002fb2f
xor r10d, r10d
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14002fb21
xor eax, eax
jmp 0x14002fb2f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x14002feb0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14002feea
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14002ff01
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x14002ff10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14002ff4f
cdqe
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14002ff77
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x14002ff64
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14002ff77
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x20
pop rsi
ret

Function at 0x140033dc0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140033df1
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140033e18
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x140033e46
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x14005fd28]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x18], 1
movups xmmword [rax + 0x20], xmm0
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140028f60]
mov qword [rbp - 0x28], rax
lea rax, [0x1400514f0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400422e0
ud2