joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
lea rcx, [0x1400025e0]
call fcn.140001f80
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001613
lea rcx, [0x1400025f0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
lea r8, [0x140002620]
lea rdx, [0x140002630]
mov rcx, qword [rsp + 0x30]
call fcn.140001e70
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000164e
lea rcx, [0x140002640]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140002670]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 3]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 7]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001695
lea rcx, [0x140002690]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
lea r8, [0x1400026b0]
lea rdx, [0x1400026d0]
mov rcx, qword [rsp + 0x30]
call fcn.140001e70
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400016d0
lea rcx, [0x1400026f0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 2]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 6]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140001700
lea rcx, [0x140002710]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
mov eax, dword [rsp + 0x20]
xor r8d, r8d
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001737
lea rcx, [0x140002730]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001758
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.140001830
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
xor eax, eax
add rsp, 0x58
ret

Function at 0x140001760
Capabilities:
Print debug messages

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x140001788
lea rcx, [0x140002370]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x140001821
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 1]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x1400017b6
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
jne 0x1400017ba
xor eax, eax
jmp 0x140001821
movzx eax, byte [rsp + 0x58]
dec al
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x14000181c
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp byte [rax + rcx], 0
jne 0x1400017e1
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
jne 0x14000181a
xor eax, eax
jmp 0x140001821
jmp 0x1400017ba
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140001830
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
xor eax, eax
cmp eax, 1
je 0x140001921
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx]
mov r8d, eax
mov edx, ecx
lea rcx, [0x140002440]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
cmp eax, 0x7f
jne 0x1400018b1
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
cmp eax, 4
jne 0x1400018b1
lea rcx, [0x140002570]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001921
mov rcx, qword [rsp + 0x28]
call fcn.140001930
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400018df
lfence
mov edx, dword [rsp + 0x20]
lea rcx, [0x140002590]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x20]
jmp 0x140001923
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jb 0x140001912
lea rcx, [0x1400025c0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001921
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
jmp 0x140001851
xor eax, eax
add rsp, 0x48
ret
Function at 0x140001c70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
jne 0x140001c94
lea rcx, [0x140002390]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001d36
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x140001ca7
mov rax, qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov r8d, 0x6f616d4c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001d2a
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.1400020c0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
movsxd rax, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov edx, 0x6f616d4c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140001d36
lea rcx, [0x1400023c0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140001e70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x140001ed3
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140001f74
movzx eax, word [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x45474150
je 0x140001f30
lfence
mov rax, qword [rsp + 0x28]
mov r8d, 5
lea rdx, [0x140002760]
mov rcx, rax
call fcn.140002240
test eax, eax
jne 0x140001f6f
lfence
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 8]
mov rcx, rax
call fcn.140001db0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140001f6f
jmp 0x140001f74
jmp 0x140001ec6
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x140001f80
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140004050]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xc0000004
je 0x140001fdd
xor eax, eax
jmp 0x1400020a6
mov eax, dword [rsp + 0x20]
mov r8d, 0x6f616d4c
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002005
xor eax, eax
jmp 0x1400020a6
xor r9d, r9d
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x140002029
jmp 0x140002094
mov dword [rsp + 0x24], 0
jmp 0x14000203d
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
cmp rax, qword [rcx]
jae 0x140002094
mov eax, dword [rsp + 0x24]
imul rax, rax, 0x128
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rdi, rcx
lea rsi, [rdx + rax + 8]
mov ecx, 0x128
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x68]
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x140002092
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
jmp 0x140002094
jmp 0x140002033
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140002160
add rsp, 0x188
pop rdi
pop rsi
ret
Function at 0x140001000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rcx, str.Hello__world_
call fcn.140001170
movsxd rcx, dword [0x140004044]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movsxd r8, dword [0x140004044]
lea rdx, [0x140004058]
mov rcx, rax
mov rbp, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd rbx, dword [0x140004044]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
mov rcx, rax
mov rsi, rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rbx
mov r10, rax
test ebx, ebx
jle 0x14000108d
mov r9, rbx
mov r8, rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r10, rax
xor r11d, r11d
mov r8d, r11d
test ebx, ebx
jle 0x1400010df
mov r9, rbp
lea rbx, [0x140004048]
sub r9, r10
mov rdx, r10
nop word [rax + rax]
mov eax, r8d
and eax, 0x80000007
jge 0x1400010c1
dec eax
or eax, 0xfffffff8
inc eax
movsxd rcx, eax
inc r8d
movzx eax, byte [rcx + rbx]
xor al, byte [r9 + rdx]
mov byte [rdx], al
inc rdx
mov rax, rdx
sub rax, r10
cmp rax, rdi
jl 0x1400010b0
movsxd rax, dword [0x140004050]
test eax, eax
jle 0x140001113
cmp dword [0x140004054], r11d
jle 0x140001113
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rcx + r10], rax
movsxd rcx, dword [0x140004054]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rcx + r10], rax
mov qword [rsp + 0x28], r11
lea r8, [0x1400011d0]
mov r9, r10
mov dword [rsp + 0x20], r11d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140001140

Function at 0x140001ac4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b10
xor al, al
add rsp, 0x28
ret
Function at 0x4020a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm2, xmmword [rdx]
pxor xmm2, xmm0
movdqa xmm5, xmmword [rdx + 0x10]
pxor xmm5, xmm0
movdqa xmm6, xmmword [rdx + 0x20]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x30]
pxor xmm7, xmm0
movdqa xmm1, xmmword [rdx + 0x40]
pxor xmm1, xmm0
movdqa xmm3, xmmword [rdx + 0x50]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x60]
pxor xmm4, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm2, xmm10
aesenc xmm5, xmm10
aesenc xmm6, xmm10
aesenc xmm7, xmm10
aesenc xmm1, xmm10
aesenc xmm3, xmm10
aesenc xmm4, xmm10
aesenc xmm0, xmm10
aesenc xmm2, xmm9
aesenc xmm5, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm1, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm0, xmm9
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x40]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x50]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x60]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x70]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x80]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x90]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0xa0]
aesenclast xmm2, xmm8
aesenclast xmm5, xmm8
movdqa xmmword [rdx], xmm2
movdqa xmmword [rdx + 0x10], xmm5
aesenclast xmm6, xmm8
movdqa xmmword [rdx + 0x20], xmm6
aesenclast xmm7, xmm8
movdqa xmmword [rdx + 0x30], xmm7
aesenclast xmm1, xmm8
aesenclast xmm3, xmm8
movdqa xmmword [rdx + 0x40], xmm1
movdqa xmmword [rdx + 0x50], xmm3
aesenclast xmm4, xmm8
movdqa xmmword [rdx + 0x60], xmm4
aesenclast xmm0, xmm8
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x4024f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x42ce90
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor esi, esi
mov edi, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x42cf20
jmp 0x42ceff
jae 0x42cfce
cmp r8, 0x201
jae 0x42cf20
mov r14d, 0x200
lea r15, [rsp + 0x98]
mov r12, r8
jmp 0x42cf66
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x42cf47
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.00418fc0
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp rsi, rdi
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rsp + 0x38], rbx
mov r13, rsi
mov r14, rbx
mov r15, qword [rsp + 0x48]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x42cf8b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x42d03b
mov r8d, ebp
cmp r12, r8
jne 0x42cef0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42d06a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x42ceff
jmp 0x42cf20
cmp r14, r8
jb 0x42d084
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00439fd0
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x42d024
mov rcx, qword [rsp + 0x30]
add rdx, rdx
mov r8d, 2
call fcn.00404360
mov rax, rsi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x42d011
jmp 0x42d024
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0048ba90
jmp 0x42d099
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.00492090
ud2
Function at 0x42d6c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rdi, rcx
movabs rsi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.00454f20
mov rax, qword [rsp + 0xa8]
cmp rax, rsi
jne 0x42d70f
lea rcx, [rsp + 0xb0]
call fcn.0040e290
mov qword [rdi], rsi
jmp 0x42d943
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov r14d, 0xffffffff
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x42d7a0
jmp 0x42d77f
jae 0x42d855
cmp r8, 0x201
jae 0x42d7a0
mov esi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x42d7e7
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x42d7c7
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.00418fc0
mov r15, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
cmp r15, r14
mov r13d, 0xffffffff
cmovb r13, r15
mov qword [rsp + 0x40], r13
mov rdi, r15
mov rsi, r13
mov rbp, qword [rsp + 0x58]
mov r12, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x48]
mov rdx, rbp
mov r8d, r12d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
test eax, eax
jne 0x42d811
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x42d8d3
mov r8d, ebx
cmp r12, r8
jne 0x42d770
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42d95a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov r14d, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x42d77f
jmp 0x42d7a0
cmp rsi, r8
jb 0x42d974
lea rcx, [rsp + 0x88]
mov rdx, rbp
mov rsi, qword [rsp + 0x28]
call fcn.00439fd0
mov rdi, qword [rsp + 0x50]
movabs rbx, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x42d8b9
mov rcx, qword [rsp + 0x38]
add rdx, rdx
mov r8d, 2
call fcn.00404360
cmp qword [rsp + 0x60], rbx
je 0x42d91b
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
jmp 0x42d928
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rbx, 0x8000000000000000
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x42d911
mov rcx, qword [rsp + 0x38]
add rdx, rdx
mov r8d, 2
call fcn.00404360
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov qword [rdi], rbx
lea rcx, [rsp + 0x68]
call fcn.0040e290
test rsi, rsi
je 0x42d943
add rsi, rsi
mov r8d, 2
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.00404360
mov rax, rdi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0048ba90
jmp 0x42d989
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.00492090
ud2
Function at 0x4415c0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0047d100
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x441649
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x44167c
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x441691
lea rax, [0x004aa048]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x4416b1
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.00404360
mov rcx, qword [r14]
mov rax, qword [rsp + 0x28]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x4416b1
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.00404360
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x441f50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.0049f9b0
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call sub.ntdll.dll_memset
xorps xmm6, xmm6
lea r15, [rsp + 0x34]
lea rbx, [0x0044dfd0]
lea r12, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov rdx, r14
call case.0x44dbaf.103
mov r13, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
test rax, rax
jne 0x4420e9
test r13, r13
je 0x4420bd
cmp r13, 0x1000
ja 0x4420f5
xor ebp, ebp
nop word cs:[rax + rax]
mov r8d, r13d
sub r8d, ebp
lea rdx, [rsp + rbp]
add rdx, 0x80
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov r9, r12
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x442098
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x442030
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
jne 0x4420b3
add rbp, rax
cmp rbp, r13
je 0x441fa3
jbe 0x441ff0
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, rbp
mov rdx, r13
call fcn.00492120
jmp 0x442109
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.0040e290
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1080]
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x58]
call fcn.0040e290
jmp 0x4420bd
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r13
call fcn.00492090
ud2