joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e59d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
sub r8, rdx
cmp r8, 0x20
jae 0x4e59f1
cmp rcx, rdx
je 0x4e59fc
cmp r8, 4
jae 0x4e59ff
xor eax, eax
mov rcx, rdx
jmp 0x4e5a8c
mov rcx, rdx
mov rdx, r8
jmp fcn.00423d80
xor eax, eax
ret
mov rcx, r8
and rcx, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x005b83e0]
movdqa xmm3, xmmword [0x005b83f0]
pxor xmm1, xmm1
movzx r9d, word [rdx + rax]
movd xmm4, r9d
movzx r9d, word [rdx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp rcx, rax
jne 0x4e5a20
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp rcx, r8
je 0x4e5aa9
add rcx, rdx
add rdx, r8
nop
xor r8d, r8d
cmp byte [rcx], 0xc0
lea r9, [rcx + 1]
setge r8b
add rax, r8
mov rcx, r9
cmp r9, rdx
jne 0x4e5a90
ret
Function at 0x4e5cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x4e5d2b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x4e5d2b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x4e5d46
cmp eax, 0x42
jne 0x4e5d2b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x4e5df6
cmp byte [r9 + r11], 0x5f
jne 0x4e5df6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x4e5e5e
mov rcx, rsi
xor edx, edx
call fcn.004e17f0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.004e17f0
test al, al
jne 0x4e5ef8
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4e5d82
lea rdx, [0x005e5a12]
mov r8d, 1
call fcn.0041d940
test al, al
jne 0x4e5ef8
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x4e5d3a
xor r14d, r14d
lea rbx, [0x005e5a0c]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x4e5db4
cmp byte [rax + rcx], 0x45
je 0x4e5f1a
sub r14, 1
jb 0x4e5dd9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4e5dd9
mov r8d, 2
mov rdx, rbx
call fcn.0041d940
test al, al
jne 0x4e5ef8
mov rcx, rsi
call fcn.004e5f30
test al, al
jne 0x4e5ef8
mov rax, qword [rsi]
test rax, rax
jne 0x4e5da0
jmp 0x4e5d3a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x4e5ebf
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x4e5e52
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x4e5e3c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x4e5e2b
add dl, 0xa9
jmp 0x4e5e3a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x4e5ebf
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x4e5ebf
movzx edx, bl
add rax, rdx
jae 0x4e5e00
jmp 0x4e5ebf
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x4e5ebf
cmp rax, rcx
jae 0x4e5ebc
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x4e5f12
cmp qword [rsi + 0x20], 0
je 0x4e5f0b
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.004e5cd0
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x4e5d3a
jmp 0x4e5ef8
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4e5f00
lea rax, [0x005e59d9]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.0041d940
test al, al
je 0x4e5f00
mov dil, 2
jmp 0x4e5d3a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x4e5d3a
mov dil, 1
xor r8d, r8d
jmp 0x4e5ec1
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x4e5d3a
Function at 0x4edd8a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x4eddc3
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov rcx, rax
xor rcx, 1
mov edx, eax
and edx, 1
lea rbx, [rcx + rdx*2]
lea rax, [rax + rax*4]
lea rcx, [rdi + rax*8]
call fcn.004ec87c
mov rax, rbx
cmp rbx, rsi
jne 0x4edd9e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x4ee8ae
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov rsi, qword [rcx + 0x40]
test rsi, rsi
je 0x4ee8fc
mov r9d, esi
and r9d, 8
mov rbx, r9
xor rbx, 8
mov r14, rsi
and r14, 0xfffffffffffffff7
mov r11, rbx
sub r11, r14
cmp r8, r11
mov r15, r11
cmovb r15, r8
cmp r15, 3
jbe 0x4ee904
mov edi, dword [rdx]
mov r10d, 4
jmp 0x4ee909
xor r11d, r11d
jmp 0x4ee9de
xor r10d, r10d
xor edi, edi
mov rcx, r10
or rcx, 1
cmp rcx, r15
jae 0x4ee92c
movzx r12d, word [rdx + r10]
lea ecx, [r10*8]
shl r12, cl
or rdi, r12
or r10, 2
cmp r10, r15
jae 0x4ee943
movzx r15d, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl r15, cl
or rdi, r15
imul ebx, r14d
mov ecx, esi
or ecx, 8
imul r9d, ecx
add r9d, ebx
mov ecx, r9d
or ecx, 1
not r9d
or r9d, 0x3f
add r9d, ecx
mov ecx, r9d
shl rdi, cl
or rdi, qword [rax + 0x38]
mov qword [rax + 0x38], rdi
cmp r11, r8
jbe 0x4ee97e
add rsi, r8
jmp 0x4eeaad
mov rcx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rsi, r9
and rsi, rdi
add r9, rdi
add rsi, rsi
mov r10, qword [rax]
add r10, rcx
rol rcx, 0xd
sub r9, rsi
xor rcx, r10
rol r10, 0x20
mov rsi, qword [rax + 8]
add rsi, r9
rol r9, 0x10
xor r9, rsi
add r10, r9
rol r9, 0x15
xor r9, r10
add rsi, rcx
rol rcx, 0x11
mov qword [rax + 0x18], r9
xor rcx, rsi
rol rsi, 0x20
mov qword [rax + 0x10], rcx
mov qword [rax + 8], rsi
xor r10, rdi
mov qword [rax], r10
sub r8, r11
mov esi, r8d
and esi, 7
and r8, 0xfffffffffffffff8
cmp r11, r8
jae 0x4eea51
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov r10, qword [rax + 0x10]
add rcx, r10
rol r10, 0xd
mov rbx, qword [rdx + r11]
xor r10, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, r10
rol r10, 0x11
xor r10, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r11, 8
cmp r11, r8
jb 0x4ee9ff
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], r10
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp esi, 3
jbe 0x4eea62
mov r9d, dword [rdx + r11]
mov r8d, 4
jmp 0x4eea68
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, rsi
jae 0x4eea8f
lea rcx, [r8 + r11]
movzx r10d, word [rdx + rcx]
lea ecx, [r8*8]
shl r10, cl
or r9, r10
or r8, 2
cmp r8, rsi
jae 0x4eeaa9
add r11, r8
movzx edx, byte [rdx + r11]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], rsi
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x51b830
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1088
call fcn.005ab800
sub rsp, rax
movaps xmmword [rsp + 0x1070], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x70]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x0054f500]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x51b9cb
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x51b8ce
cmp dword [rsp + 0x34], 0
jne 0x51b9d0
mov r15d, dword [rsp + 0x38]
test r15, r15
je 0x51b9d0
cmp r15d, 0x1000
ja 0x51ba10
xor r12d, r12d
nop dword [rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x70
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x51b9cb
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x51b960
cmp dword [rsp + 0x34], 0
jne 0x51b9d0
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
je 0x51b98d
jbe 0x51b910
jmp 0x51b9fc
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x51b8ce
call sub.KERNEL32.dll_GetLastError
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1070]
add rsp, 0x1088
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_sys_windows_pipe.rs
mov rcx, r12
mov rdx, r15
call fcn.00429a20
jmp 0x51ba24
lea r8, str.library_std_src_sys_windows_pipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.004292f0
ud2
Function at 0x51c450
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
movaps xmm0, xmmword [0x005b8440]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.00529690
mov rdi, rdx
test rax, rax
je 0x51c50d
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x51c501
mov rbx, rdi
dec rbx
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x51c4f0
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x51c4e2
mov r8, qword [r8 - 8]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rbx
call fcn.005ab9d4
mov qword [rsi], 0
jmp 0x51c678
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.005298a0
cmp dword [rsp + 0x40], 2
jne 0x51c596
mov r14, qword [rsp + 0x48]
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x51c577
lea rbx, [r14 - 1]
mov rcx, qword [r14 - 1]
mov rax, qword [r14 + 7]
call qword [rax]
mov rax, qword [r14 + 7]
cmp qword [rax + 8], 0
je 0x51c566
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x51c558
mov r8, qword [r8 - 8]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rbx
call fcn.005ab9d4
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x68]
test rdi, rdi
je 0x51c5e8
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x51c664
mov rbx, qword [rsp + 0x40]
jmp 0x51c5ea
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x51c653
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x51c653
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x51c670
mov qword [rsi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x51c670
call sub.KERNEL32.dll_GetLastError
mov qword [rsi], 0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x522250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x522280
test ecx, ecx
jne 0x5222d0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x52228c
test ecx, ecx
jne 0x5222d0
mov rcx, rdi
call fcn.00522130
movzx eax, al
test bpl, bpl
jne 0x5222d7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x5222c3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x00522448]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x5222c3.2
xor eax, eax
test bpl, bpl
je 0x52229c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x522429
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x52230a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x522389
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x522350
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x52236b
inc rax
dec rdi
cmp rax, 1
jne 0x522330
jmp 0x522389
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x52236b
cmp ebx, 0x5c
je 0x52236b
inc rax
dec rdi
cmp rax, 1
jne 0x522350
jmp 0x522389
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x522437
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x5223b3
mov al, 9
cmp rdx, 2
je 0x5223b7
cmp rdx, 1
jne 0x5223c7
cmp byte [r8], 0x2e
jne 0x5223c7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x5223c7
mov al, 0xa
jmp 0x5223c7
cmp byte [r8], 0x2e
jne 0x5223c7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x5222c3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x5222c3.2
mov ecx, 2
jmp case.0x5222c3.2
lea r8, str.library_std_src_path.rs
call fcn.00429500
ud2
lea r8, str.library_std_src_path.rs
call fcn.00429500
ud2
Function at 0x528ae0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x00677468]
cmp rax, 3
jne 0x528c07
cmp rbx, 0x17f
ja 0x528c19
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x528b59
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x528b6c
inc rdx
cmp rcx, rdx
jne 0x528b40
mov rdx, r8
test rax, rax
jne 0x528b76
jmp 0x528bd0
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00428e20
test rax, rax
jne 0x528b76
jmp 0x528bd0
mov eax, 1
test rax, rax
je 0x528bd0
cmp rdx, rbx
jne 0x528bd0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x528be4
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x528bf7
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x528bfa
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.005518b0
cmp rbx, 0x17f
jbe 0x528b18
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x54e420
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.00417660
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x54e47e
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x54e50a
mov rcx, qword [0x00677420]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.005ab9d4
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x54e4db
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x54e4ee
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x54e50a
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
call fcn.005ab9d4
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x528d20
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x005b71b0]
test ecx, ecx
je 0x528e35
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x528d56
mov rcx, rax
cmp qword [rax], 0
je 0x528d56
add rcx, 8
jmp 0x528e2b
mov ecx, dword [0x005b71b0]
test ecx, ecx
je 0x528e48
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x528e0f
mov rdi, rax
test rax, rax
jne 0x528dc2
mov ecx, 0x20
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x528e6e
mov rdi, rax
mov qword [rax], 0
lea rax, [0x005b7198]
mov qword [rdi + 0x18], rax
mov ecx, dword [0x005b71b0]
test ecx, ecx
je 0x528e5b
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x528ddf
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x528e18
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x528e13
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x528e18
xor ecx, ecx
jmp 0x528e2b
call fcn.0053fa10
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005b7198]
call fcn.0053fad0
mov ecx, eax
jmp 0x528d39
lea rcx, [0x005b7198]
call fcn.0053fad0
mov ecx, eax
jmp 0x528d66
lea rcx, [0x005b7198]
call fcn.0053fad0
mov ecx, eax
jmp 0x528dba
mov ecx, 0x20
mov edx, 8
call fcn.00417bf0
ud2

Function at 0x528e80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x005b71d0]
test ecx, ecx
je 0x528f3e
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x528eb0
mov rdi, rax
cmp qword [rax], 0
je 0x528eb0
add rdi, 8
jmp 0x528ecd
mov ecx, dword [0x005b71d0]
test ecx, ecx
je 0x528f51
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x528ed7
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, rax
test rax, rax
jne 0x528f6e
mov qword [rsp + 0x20], 0
lea rax, [0x005b71b8]
mov qword [rsp + 0x30], rax
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x528fad
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x005b71d0]
test ecx, ecx
jne 0x528f64
lea rcx, [0x005b71b8]
call fcn.0053fad0
mov ecx, eax
jmp 0x528f66
lea rcx, [0x005b71b8]
call fcn.0053fad0
mov ecx, eax
jmp 0x528e96
lea rcx, [0x005b71b8]
call fcn.0053fad0
mov ecx, eax
jmp 0x528ec0
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
call fcn.00528c40
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 1
mov qword [rsi + 8], rax
je 0x528ecd
test rcx, rcx
je 0x528ecd
lock dec qword [rcx]
jne 0x528ecd
call fcn.00545ba0
jmp 0x528ecd
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x5290f0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x529108
mov qword [rsi + 8], rbx
jmp 0x52913d
mov rax, qword [0x00677468]
cmp rax, 3
jne 0x5291e2
movzx edx, word [rbx]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.00552110
cmp qword [rsp + 0x20], 0
mov rdi, qword [rsp + 0x28]
je 0x52914c
mov qword [rsi + 8], rdi
mov qword [rsi], 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
cmp word [rbx], 0
je 0x52916d
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x529182
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r9w, 2
rol cx, 8
mov word [rsp + 0x20], r9w
mov word [rsp + 0x22], cx
mov dword [rsp + 0x24], eax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
je 0x5291bd
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x529144
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x529144
call fcn.005518b0
jmp 0x529119

Function at 0x5291f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rcx, rax
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x5292b0
mov eax, dword [rsp + 0x28]
movzx ecx, word [rsp + 0x40]
cmp ecx, 2
je 0x5292bf
cmp ecx, 0x17
jne 0x5292df
cmp eax, 0x1c
jb 0x5292f8
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x30], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rsp + 0x2e]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rsp + 0x3e]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x5292ef
call fcn.005abbd4
shl rax, 0x20
or rax, 2
jmp 0x5292e6
cmp eax, 0x10
jb 0x529312
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x5292ef
lea rax, str.invalid_argumentlibrary_std_src_sys_common_net.rsinvalid_port_value
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xc0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x005f0040]
mov edx, 0x43
call fcn.00426370
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
lea r8, [0x005f00a0]
mov edx, 0x42
call fcn.00426370
ud2