joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140287e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x140287eac
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x140287f8e
test r15w, r15w
je 0x140287eac
cmp r15w, 0x2e
jne 0x140287f8e
test r12w, r12w
jne 0x140287f8e
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x140287f78
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
jmp 0x140287eff
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x140287f78
cmp word [rsp + 0xac], 0x2e
jne 0x140287f28
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x140287ef0
cmp ax, 0x2e
jne 0x140287f28
cmp word [rsp + 0xb0], 0
je 0x140287ef0
lock inc qword [r14]
jle 0x140288069
mov rdi, qword [rsp + 0x80]
vmovups ymm0, ymmword [rsp + 0x88]
vmovups ymmword [rsp + 0x20], ymm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x140287fb2
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
jne 0x140287ffc
mov qword [rsi], 0
jmp 0x140288057
lock inc qword [r14]
jle 0x140288069
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
vmovups ymm0, ymmword [rbx + 0x1c]
vmovups ymmword [rsp + 0x20], ymm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
vzeroupper
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
vmovups ymm0, ymmword [rsp + 0x20]
vmovups ymmword [rsp + 0x50], ymm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
vzeroupper
call sub.msvcrt.dll_memcpy
jmp 0x14028800e
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
vmovups ymm0, ymmword [rsp + 0x50]
vmovups ymmword [rsi + 0x18], ymm0
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
vzeroupper
call sub.msvcrt.dll_memcpy
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x14028ad20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1404a4608]
test ecx, ecx
je 0x14028ae00
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14028ad54
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14028ad54
add rdi, 0x10
jmp 0x14028adf6
mov ecx, dword [0x1404a4608]
test ecx, ecx
je 0x14028ae13
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14028adf4
mov rsi, rax
test rax, rax
jne 0x14028adc3
movzx eax, byte [0x1406ba220]
mov ecx, 0x18
mov edx, 8
call fcn.140087770
test rax, rax
je 0x14028ae36
mov rsi, rax
lea rax, [0x1404a45f0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1404a4608]
test ecx, ecx
je 0x14028ae26
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14028adf6
test rcx, rcx
je 0x14028adf6
lock dec qword [rcx]
jne 0x14028adf6
call fcn.14028ae50
jmp 0x14028adf6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1404a45f0]
call fcn.140264790
mov ecx, eax
jmp 0x14028ad36
lea rcx, [0x1404a45f0]
call fcn.140264790
mov ecx, eax
jmp 0x14028ad64
lea rcx, [0x1404a45f0]
call fcn.140264790
mov ecx, eax
jmp 0x14028adbb
mov ecx, 8
mov edx, 0x18
call fcn.1400a9a20
ud2

Function at 0x14028b830
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1400a9be0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14028b88a
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x14028b913
mov edx, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140087800
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x50], ymm0
vmovups ymmword [rsp + 0x60], ymm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
vzeroupper
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x14028b8e8
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14028b8fb
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x14028b913
mov edx, 1
mov rcx, rdi
call fcn.140087800
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14028c4a0
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14028c4f1
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14028c55e
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x14028c504
cmp eax, 0x2739
jne 0x14028c54b
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14028c546
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x14028c566
mov qword [rsi + 8], rdi
jmp 0x14028c4e8
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14030025c

Function at 0x14028c6a0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x14028c701
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x14028c701
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14028c701
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x14028c701
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x14028c73e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14028c72c
xor eax, eax
jmp 0x14028c739
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x14028c739

Function at 0x14028c750
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x14028c7b1
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x14028c7b1
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14028c7b1
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x14028c7b1
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x14028c7ee
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14028c7dc
xor eax, eax
jmp 0x14028c7e9
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x14028c7e9
Function at 0x14028c800
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14028c834
xor eax, eax
jmp 0x14028c841
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14028c850
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x14028c8ca
mov rcx, qword [rcx]
cmp rax, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x14028c8ab
cdqe
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x14028c8c3
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x14028c8bb
xor eax, eax
jmp 0x14028c8c3
shl rax, 0x20
or rax, 2
add rsp, 0x28
pop rdi
pop rsi
ret
lea r8, str.library_std_srcio_readbuf.rs
mov rcx, rsi
call fcn.1400b2eb0
ud2

Function at 0x14028c980
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x3c], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x14028c9d3
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14028c9e9
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x14028cb30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x90], ymm0
vmovups ymmword [rsp + 0x70], ymm0
vmovups ymmword [rsp + 0x50], ymm0
vmovups ymmword [rsp + 0x30], ymm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
vzeroupper
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x14028cbc4
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x14028cbd3
cmp ecx, 0x17
jne 0x14028cbf3
cmp eax, 0x1b
jbe 0x14028cc0c
movzx eax, word [rsp + 0x32]
rol ax, 8
vmovups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
vmovups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x14028cc03
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x14028cbfa
cmp eax, 0xf
jbe 0x14028cc26
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x14028cc03
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x1405bfb00]
mov edx, 0x43
call fcn.1400b45f0
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x1405bfaa0]
mov edx, 0x42
call fcn.1400b45f0
ud2

Function at 0x14028cc50
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x14028cc76
xor eax, eax
jmp 0x14028cc83
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x14028cc90
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x14028ccc9
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14028ccdf
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14028ccf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x14028cd23
cdqe
jmp 0x14028cd31
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x14028cd39
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14028cd4a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140293560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
vmovdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.1402664e0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x1402935d5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.140293480
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1402935e3
vmovdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x140293604
mov qword [rsi], rdi
vmovdqu xmmword [rsi + 8], xmm6
jmp 0x1402935f4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
call fcn.140263f60
mov qword [rsi], 0
vmovaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
vmovq rax, xmm6
test rax, rax
je 0x1402935f4
mov edx, 2
mov rcx, rdi
vmovaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140087800
Function at 0x140295280
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x1406ba220]
mov ecx, 0x10
mov edx, 8
call fcn.140087770
test rax, rax
je 0x140295338
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140295390]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x14029532b
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x14029530a
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.140087800
mov edx, 8
mov rcx, rsi
call fcn.140087800
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400a9a20
ud2

Function at 0x140295640
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.1402ffce0
sub rsp, rax
vmovaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
vxorps xmm6, xmm6, xmm6
lea r15, [rsp + 0x3c]
lea rbx, [0x14028d570]
lea r13, [rsp + 0x60]
lea r12, [0x1404b47a8]
mov qword [rsp + 0x48], rdi

Function at 0x140295b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x140295b78
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140285bb0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.1400b2c00
ud2
Function at 0x14029aa60
Capabilities:
Copy file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov rdi, rcx
lea rcx, [rsp + 0x30]
call fcn.1402664e0
mov rax, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
test rax, rax
je 0x14029ab70
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov r8b, 1
call fcn.140284150
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
test rsi, rsi
je 0x14029ab70
mov r8, qword [rsp + 0xb0]
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.1402664e0
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
test rax, rax
je 0x14029ab7d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov r8b, 1
call fcn.140284150
mov rbx, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
test rbx, rbx
je 0x14029ab7d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x14029ac00]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov rdx, rbx
call sub.KERNEL32.dll_CopyFileExW
test eax, eax
je 0x14029ab8a
mov rax, qword [rsp + 0x30]
mov qword [rdi + 8], rax
mov qword [rdi], 0
test r15, r15
jne 0x14029aba7
jmp 0x14029abb4
mov qword [rdi + 8], r14
mov qword [rdi], 1
jmp 0x14029abc6
mov qword [rdi + 8], r15
mov qword [rdi], 1
jmp 0x14029abb4
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rdi + 8], rax
mov qword [rdi], 1
test r15, r15
je 0x14029abb4
mov edx, 2
mov rcx, rbx
call fcn.140087800
test r14, r14
je 0x14029abc6
mov edx, 2
mov rcx, rsi
call fcn.140087800
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14029b0c0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x1404a4628]
test ecx, ecx
je 0x14029b1bb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14029b0f0
cmp qword [rax + 8], 0
je 0x14029b0f0
add rax, 0x10
jmp 0x14029b1b5
mov ecx, dword [0x1404a4628]
test ecx, ecx
je 0x14029b1ce
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14029b195
mov rsi, rax
test rax, rax
jne 0x14029b163
movzx eax, byte [0x1406ba220]
mov ecx, 0x20
mov edx, 8
call fcn.140087770
test rax, rax
je 0x14029b1f4
mov rsi, rax
lea rax, [0x1404a4610]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1404a4628]
test ecx, ecx
je 0x14029b1e1
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14029b199
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14029b1a1
xor eax, eax
jmp 0x14029b1b5
call fcn.140295b40
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x1404a4610]
call fcn.140264790
mov ecx, eax
jmp 0x14029b0d5
lea rcx, [0x1404a4610]
call fcn.140264790
mov ecx, eax
jmp 0x14029b100
lea rcx, [0x1404a4610]
call fcn.140264790
mov ecx, eax
jmp 0x14029b15b
mov ecx, 8
mov edx, 0x20
call fcn.1400a9a20
ud2
Function at 0x14029f094
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x14029f131
mov rdi, rax
movsxd r12, dword [rsp + 0x2c]
lea rbx, [rsp + 0x30]
mov qword [rbx], 8
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbx + 8], xmm0
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14029f114
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14029cbb2
mov rcx, rbx
mov rdx, r14
call fcn.14029f347
add r13, 8
jmp 0x14029f0e4
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
vmovups xmm0, xmmword [rsp + 0x30]
vmovups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14029f141
mov qword [rsi], 8
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi + 8], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402a2644
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rsi, rcx
vxorps xmm0, xmm0, xmm0
lea rdi, [rsp + 0x90]
vmovups ymmword [rdi], ymm0
vmovups ymmword [rdi + 0x20], ymm0
mov dword [rdi], 0x40
mov rcx, rdi
vzeroupper
call sub.KERNEL32.dll_GlobalMemoryStatusEx
mov rax, qword [rdi + 8]
mov qword [rsi + 0xa0], rax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0xa8], rax
lea rcx, [rsp + 0x20]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rcx + 0x40], ymm0
vmovups ymmword [rcx + 0x20], ymm0
vmovups ymmword [rcx], ymm0
and qword [rcx + 0x60], 0
mov edx, 0x68
vzeroupper
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x1402a270b
mov rdx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsi + 0xb0], r8
mov qword [rsi + 0xb8], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1402a352f
Capabilities:
Get disk size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
imul rbx, rdx, 0x90
xor r14d, r14d
lea rdi, [rsp + 0x28]
mov r15, rcx
cmp rbx, r14
je 0x1402a3594
cmp qword [r15 + 0x78], 0
je 0x1402a3584
and qword [rsp + 0x28], 0
mov rcx, qword [rsi + r14 + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1402a3584
mov rax, qword [rsp + 0x28]
mov qword [rsi + r14 + 0x80], rax
add r15, 0x90
add r14, 0x90
jmp 0x1402a354f
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret