joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180136d18
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1801705d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18012c790
xor ebx, ebx
cmp qword [0x180178c50], rbx
mov rdi, rax
jne 0x180136e2b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180136f02
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180136f02
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180178c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180178c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180178c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180178c70], rax
test rax, rax
je 0x180136e22
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180178c68], rax
jmp 0x180136e32
mov rax, qword [0x180178c68]
jmp 0x180136e39
mov rax, qword [0x180178c68]
mov r11, qword [0x180178c70]
cmp rax, rdi
je 0x180136ea0
cmp r11, rdi
je 0x180136ea0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180178c70]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180136ea0
test rax, rax
je 0x180136ea0
call rsi
test rax, rax
je 0x180136e9a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180136e9a
test byte [rsp + 0x40], 1
jne 0x180136ea0
bts ebp, 0x15
jmp 0x180136ee0
mov rcx, qword [0x180178c58]
cmp rcx, rdi
je 0x180136ee0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180136ee0
call rax
mov rbx, rax
test rax, rax
je 0x180136ee0
mov rcx, qword [0x180178c60]
cmp rcx, rdi
je 0x180136ee0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180136ee0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180178c50]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180136f02
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180136f04
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180127700
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4020a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm2, xmmword [rdx]
pxor xmm2, xmm0
movdqa xmm5, xmmword [rdx + 0x10]
pxor xmm5, xmm0
movdqa xmm6, xmmword [rdx + 0x20]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x30]
pxor xmm7, xmm0
movdqa xmm1, xmmword [rdx + 0x40]
pxor xmm1, xmm0
movdqa xmm3, xmmword [rdx + 0x50]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x60]
pxor xmm4, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm2, xmm10
aesenc xmm5, xmm10
aesenc xmm6, xmm10
aesenc xmm7, xmm10
aesenc xmm1, xmm10
aesenc xmm3, xmm10
aesenc xmm4, xmm10
aesenc xmm0, xmm10
aesenc xmm2, xmm9
aesenc xmm5, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm1, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm0, xmm9
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x40]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x50]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x60]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x70]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x80]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x90]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0xa0]
aesenclast xmm2, xmm8
aesenclast xmm5, xmm8
movdqa xmmword [rdx], xmm2
movdqa xmmword [rdx + 0x10], xmm5
aesenclast xmm6, xmm8
movdqa xmmword [rdx + 0x20], xmm6
aesenclast xmm7, xmm8
movdqa xmmword [rdx + 0x30], xmm7
aesenclast xmm1, xmm8
aesenclast xmm3, xmm8
movdqa xmmword [rdx + 0x40], xmm1
movdqa xmmword [rdx + 0x50], xmm3
aesenclast xmm4, xmm8
movdqa xmmword [rdx + 0x60], xmm4
aesenclast xmm0, xmm8
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x402540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x42ce70
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor esi, esi
mov edi, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x42cf00
jmp 0x42cedf
jae 0x42cfae
cmp r8, 0x201
jae 0x42cf00
mov r14d, 0x200
lea r15, [rsp + 0x98]
mov r12, r8
jmp 0x42cf46
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x42cf27
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.00418fa0
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp rsi, rdi
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rsp + 0x38], rbx
mov r13, rsi
mov r14, rbx
mov r15, qword [rsp + 0x48]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x42cf6b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x42d01b
mov r8d, ebp
cmp r12, r8
jne 0x42ced0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42d04a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x42cedf
jmp 0x42cf00
cmp r14, r8
jb 0x42d064
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00439fb0
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x42d004
mov rcx, qword [rsp + 0x30]
add rdx, rdx
mov r8d, 2
call fcn.00404340
mov rax, rsi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x42cff1
jmp 0x42d004
lea rcx, [0x004a7778]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0048ba70
jmp 0x42d079
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.00492070
ud2
Function at 0x42d6a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rdi, rcx
movabs rsi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.00454f00
mov rax, qword [rsp + 0xa8]
cmp rax, rsi
jne 0x42d6ef
lea rcx, [rsp + 0xb0]
call fcn.0040e270
mov qword [rdi], rsi
jmp 0x42d923
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov r14d, 0xffffffff
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x42d780
jmp 0x42d75f
jae 0x42d835
cmp r8, 0x201
jae 0x42d780
mov esi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x42d7c7
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x42d7a7
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.00418fa0
mov r15, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
cmp r15, r14
mov r13d, 0xffffffff
cmovb r13, r15
mov qword [rsp + 0x40], r13
mov rdi, r15
mov rsi, r13
mov rbp, qword [rsp + 0x58]
mov r12, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x48]
mov rdx, rbp
mov r8d, r12d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
test eax, eax
jne 0x42d7f1
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x42d8b3
mov r8d, ebx
cmp r12, r8
jne 0x42d750
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42d93a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov r14d, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x42d75f
jmp 0x42d780
cmp rsi, r8
jb 0x42d954
lea rcx, [rsp + 0x88]
mov rdx, rbp
mov rsi, qword [rsp + 0x28]
call fcn.00439fb0
mov rdi, qword [rsp + 0x50]
movabs rbx, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x42d899
mov rcx, qword [rsp + 0x38]
add rdx, rdx
mov r8d, 2
call fcn.00404340
cmp qword [rsp + 0x60], rbx
je 0x42d8fb
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
jmp 0x42d908
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rbx, 0x8000000000000000
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x42d8f1
mov rcx, qword [rsp + 0x38]
add rdx, rdx
mov r8d, 2
call fcn.00404340
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov qword [rdi], rbx
lea rcx, [rsp + 0x68]
call fcn.0040e270
test rsi, rsi
je 0x42d923
add rsi, rsi
mov r8d, 2
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.00404340
mov rax, rdi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x004a7778]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0048ba70
jmp 0x42d969
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.00492070
ud2
Function at 0x4415a0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0047d0e0
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x441629
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x44165c
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x441671
lea rax, [0x004aa038]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x441691
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.00404340
mov rcx, qword [r14]
mov rax, qword [rsp + 0x28]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x441691
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.00404340
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x441f30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.0049f990
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call sub.ntdll.dll_memset
xorps xmm6, xmm6
lea r15, [rsp + 0x34]
lea rbx, [0x0044dfb0]
lea r12, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov rdx, r14
call case.0x44db8f.103
mov r13, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
test rax, rax
jne 0x4420c9
test r13, r13
je 0x44209d
cmp r13, 0x1000
ja 0x4420d5
xor ebp, ebp
nop word cs:[rax + rax]
mov r8d, r13d
sub r8d, ebp
lea rdx, [rsp + rbp]
add rdx, 0x80
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov r9, r12
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x442078
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x442010
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
jne 0x442093
add rbp, rax
cmp rbp, r13
je 0x441f83
jbe 0x441fd0
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, rbp
mov rdx, r13
call fcn.00492100
jmp 0x4420e9
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.0040e270
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1080]
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x58]
call fcn.0040e270
jmp 0x44209d
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r13
call fcn.00492070
ud2
Function at 0x447bd0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.00454f00
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, rbx
je 0x447c35
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.00457260
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x447c40
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x447c6b
test rdi, rdi
je 0x447c96
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.00404340
xor eax, eax
jmp 0x447c38
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x447c38
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.00404340
jmp 0x447c35
xor eax, eax
jmp 0x447c38

Function at 0x44ab50
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x004ab338]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x44ab88
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x44abe8
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x44abf3
xor edx, edx
jmp 0x44ac03
cmp eax, 0x103
je 0x44ac2d
test eax, eax
js 0x44ac0e
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.00437ef0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.0040f070
mov ecx, 7
int 0x29
ud2
Function at 0x44aca0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x004ab338]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x44acd8
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x44ad3f
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x44ad72
test eax, eax
js 0x44ad53
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.00437ef0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.0040f070
mov ecx, 7
int 0x29
ud2

Function at 0x44b310
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
cmp word [rcx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, ebp
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x44b3df
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x44b36c
mov esi, eax
cmp eax, 0x2726
jne 0x44b3d2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x44b3cb
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x44b3df
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call sub.WS2_32.dll_closesocket
mov ebx, 1
mov rsi, rdi
jmp 0x44b3df
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x44b480
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x450
mov ebx, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov dword [rsp + 0x40], 1
mov rdi, qword [rcx]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x44b4e2
cmp word [r15], 0
je 0x44b4f7
movups xmm0, xmmword [r15 + 4]
mov eax, dword [r15 + 0x14]
mov edx, dword [r15 + 0x18]
movzx ecx, word [r15 + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
mov r9d, 0x2ceb0017
mov eax, dword [r15 + 2]
movzx ecx, word [r15 + 6]
mov r8d, 0x10
mov r9w, 2
mov ecx, 0x570f0002
invalid
rol cx, 8
mov word [rsp + 0x40], r9w
and al, 0x40
Function at 0x44e430
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x44e5a1
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x44e467
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x44e566
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x44e584
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x44e4c8
mov eax, dword [rsp + 0x2c]
mov ecx, 2
test rax, rax
je 0x44e50c
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x44e510
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x44e514
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x44e543
lea rax, [rsp + 0x30]
jmp 0x44e522
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x44e549
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.0040e270
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp rcx, 2
jne 0x44e553
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
test rcx, rcx
jne 0x44e4b1
mov ecx, 1
jmp 0x44e4bb
mov r8d, 0x10
mov rcx, rbx
call fcn.00419110
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x44e474
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.00419110
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x44e474
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.004110c0
int3
Function at 0x4527a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.00454f00
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, r14
jne 0x4527dd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
jmp 0x45280a
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.00446ee0
mov rdi, qword [rsp + 0x28]
cmp rdi, r14
jne 0x452823
lea rcx, [rsp + 0x30]
call fcn.0040e270
mov qword [rsi], r14
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x452847
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
jmp 0x452817
mov qword [rsi], r14
test rdi, rdi
je 0x452817
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.00404340