joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6baffb4f0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
lea rbx, [rcx + 0x28]
test rcx, rcx
mov ecx, dword [0x7ff6bb1557f0]
cmove rbx, rax
call qword [sym.imp.kernel32.dll_TlsGetValue]
test rax, rax
je 0x7ff6baffb61f
cmp qword [rax], rbx
je 0x7ff6baffb52c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x7ff6baffb518
add rsp, 0x70
pop rbx
ret
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x7ff6baffb61f
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x7ff6baffb5e0
cmp ecx, 1
jne 0x7ff6baffb61f
lea rdx, [rbx + 0x58]
mov dword [rbx + 0x50], 2
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
xorps xmm0, xmm0
lea rax, [0x7ff6bb0a49e0]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
lea r8, [0x7ff6bb0b6f90]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCopyException_void____ptr64__void_const____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x58]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
lea rax, [0x7ff6bb035e98]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call qword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
jmp 0x7ff6baffb605
xorps xmm0, xmm0
mov dword [rbx + 0x50], 1
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrCurrentException_void____ptr64_]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrAssign_void____ptr64__void_const____ptr64_]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcp140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
add rsp, 0x70
pop rbx
ret
Function at 0x7ff6baffbfe0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x7ff6baffc1c5
movzx eax, byte [rdx]
mov qword [rsp + 0xc0], rbx
test al, 8
je 0x7ff6baffc058
or al, 8
mov dword [rbp - 0x20], r12d
mov byte [rdx], al
lea r9, [rbp - 0x20]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.ws2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x38]
setne dl
call fcn.7ff6baffbf20
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.7ff6baffbf20
test ebx, ebx
je 0x7ff6baffc1c1
mov qword [rsp + 0x78], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x70], r14
lea r13, [0x7ff6bb0bb080]
mov r14, qword [0x7ff6bb0bb088]
add rcx, r14
mov dword [rbp - 0x4c], r12d
cmp rcx, 1
jbe 0x7ff6baffc0c2
mov rax, qword [0x7ff6bb0bb080]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x7ff6bb0bb088]
jmp 0x7ff6baffc0c4
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.7ff6baff9740
test al, al
jne 0x7ff6baffc161
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, r14
cmp rax, 1
jbe 0x7ff6baffc127
mov rax, qword [0x7ff6bb0bb080]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x7ff6baffc129
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.7ff6baff9740
test al, al
je 0x7ff6baffc192
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.7ff6baffbf20
mov r13, qword [rsp + 0x78]
mov eax, ebx
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x7ff6baffc19e
mov eax, r12d
jmp 0x7ff6baffc1a6
Function at 0x7ff6baffcae0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rdx, qword [0x7ff6bb0bb088]
lea r14, [0x7ff6bb0bb080]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x7ff6baffcb68
mov rcx, qword [0x7ff6bb0bb080]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x7ff6baffcb6d
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x7ff6baffcbab
mov eax, dword [rbx]
mov r8d, eax
jmp 0x7ff6baffcbdb
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x7ff6baffcc1a
mov rcx, qword [0x7ff6bb0bb088]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x7ff6baffcc0f
mov rax, qword [0x7ff6bb0bb080]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x7ff6baffcc87
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x7ff6baffcc87
cmp r9, 1
jne 0x7ff6baffcc4d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x7ff6baffcca7
mov rcx, qword [0x7ff6bb0bb088]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x7ff6baffcc7e
mov rax, qword [0x7ff6bb0bb080]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x7ff6baffcc80
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x7ff6baffccb2
mov eax, 0xffffffff
jmp 0x7ff6baffccc9
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x7ff6baffffd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x1400
call fcn.7ff6bb0318b0
sub rsp, rax
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea r8d, [rbx + 0x24]
lea rdx, [0x7ff6bb0a2740]
lea rcx, [rsp + 0x38]
call fcn.7ff6bb01c440
nop
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov r14d, 0xf
mov qword [rdi + 0x18], r14
mov byte [rdi], bl
mov ebx, 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
nop dword [rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x64], ecx
inc rbx
cmp rbx, 0x270
jb 0x7ff6bb000070
mov dword [rsp + 0x60], 0x270
mov ebp, dword [rsp + 0x48]
dec ebp
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x38]
nop word [rax + rax]
lea rcx, [rsp + 0x60]
cmp ebp, 0xffffffff
jne 0x7ff6bb0000c3
call fcn.7ff6bb01efc0
mov ecx, eax
jmp 0x7ff6bb0000fd
lea ebx, [rbp + 1]
call fcn.7ff6bb01efc0
mov esi, ebx
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jae 0x7ff6bb0000f9
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x7ff6bb0000f9
lea rcx, [rsp + 0x60]
call fcn.7ff6bb01efc0
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jb 0x7ff6bb0000e5
shr rcx, 0x20
lea rdx, [rsp + 0x38]
cmp r13, 0x10
cmovae rdx, r15
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x7ff6bb00013e
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x7ff6bb000133
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff6bb000146
mov rcx, rdi
call fcn.7ff6bb01c2e0
sub r14, 1
jne 0x7ff6bb0000b0
cmp r13, 0x10
jb 0x7ff6bb00018a
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x7ff6bb000182
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6bb000182
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.7ff6bb030750
mov rax, rdi
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.7ff6bb030660
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x7ff6bb0001c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x1400
call fcn.7ff6bb0318b0
sub rsp, rax
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea r8d, [rbx + 0x24]
lea rdx, [0x7ff6bb0a2740]
lea rcx, [rsp + 0x38]
call fcn.7ff6bb01c440
nop
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bl
mov ebx, 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x64], ecx
inc rbx
cmp rbx, 0x270
jb 0x7ff6bb000260
mov dword [rsp + 0x60], 0x270
mov r14d, dword [rsp + 0x48]
dec r14d
mov ebp, 0x19
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x38]
nop
lea rcx, [rsp + 0x60]
cmp r14d, 0xffffffff
jne 0x7ff6bb0002b4
call fcn.7ff6bb01efc0
mov ecx, eax
jmp 0x7ff6bb0002f8
lea ebx, [r14 + 1]
call fcn.7ff6bb01efc0
mov esi, ebx
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jae 0x7ff6bb0002f4
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x7ff6bb0002f4
nop word [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.7ff6bb01efc0
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jb 0x7ff6bb0002e0
shr rcx, 0x20
lea rdx, [rsp + 0x38]
cmp r13, 0x10
cmovae rdx, r15
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x7ff6bb000339
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x7ff6bb00032e
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff6bb000341
mov rcx, rdi
call fcn.7ff6bb01c2e0
sub rbp, 1
jne 0x7ff6bb0002a0
cmp r13, 0x10
jb 0x7ff6bb000385
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x7ff6bb00037d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6bb00037d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.7ff6bb030750
mov rax, rdi
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.7ff6bb030660
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x7ff6bb0003c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x1400
call fcn.7ff6bb0318b0
sub rsp, rax
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea r8d, [rbx + 0x24]
lea rdx, [0x7ff6bb0a2740]
lea rcx, [rsp + 0x38]
call fcn.7ff6bb01c440
nop
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bl
mov ebx, 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x64], ecx
inc rbx
cmp rbx, 0x270
jb 0x7ff6bb000460
mov dword [rsp + 0x60], 0x270
mov r14d, dword [rsp + 0x48]
dec r14d
mov ebp, 8
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x38]
nop
lea rcx, [rsp + 0x60]
cmp r14d, 0xffffffff
jne 0x7ff6bb0004b4
call fcn.7ff6bb01efc0
mov ecx, eax
jmp 0x7ff6bb0004f8
lea ebx, [r14 + 1]
call fcn.7ff6bb01efc0
mov esi, ebx
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jae 0x7ff6bb0004f4
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x7ff6bb0004f4
nop word [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.7ff6bb01efc0
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jb 0x7ff6bb0004e0
shr rcx, 0x20
lea rdx, [rsp + 0x38]
cmp r13, 0x10
cmovae rdx, r15
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x7ff6bb000539
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x7ff6bb00052e
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff6bb000541
mov rcx, rdi
call fcn.7ff6bb01c2e0
sub rbp, 1
jne 0x7ff6bb0004a0
cmp r13, 0x10
jb 0x7ff6bb000585
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x7ff6bb00057d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6bb00057d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.7ff6bb030750
mov rax, rdi
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.7ff6bb030660
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x7ff6bb000af0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
jne 0x7ff6bb000b51
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
lea rcx, [0x7ff6bb0a2780]
call fcn.7ff6bafc15c0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x68
ret
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x7ff6bb0a27a8]
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x7ff6bb000b9c
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, [0x7ff6bb0a27d0]
mov edx, eax
call fcn.7ff6bafc15c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x68
ret
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x7ff6bb000bf3
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, [0x7ff6bb0a2800]
jmp 0x7ff6bb000b76
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x68
ret
Function at 0x7ff6bb0180b0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x7ff6bb155790], eax
inc eax
cmp eax, 1
jne 0x7ff6bb0180fd
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ws2_32.dll_WSAStartup]
xchg dword [0x7ff6bb155794], eax
test bl, bl
je 0x7ff6bb0181a1
xor ebx, ebx
lock xadd dword [0x7ff6bb155794], ebx
test ebx, ebx
je 0x7ff6bb0181a1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x7ff6bb0bb088]
lea rsi, [0x7ff6bb0bb080]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x7ff6bb018156
mov rax, qword [0x7ff6bb0bb080]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x7ff6bb018158
mov al, 1
lea rcx, [0x7ff6bb0a25a0]
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, [0x7ff6bb0a2590]
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x7ff6bb0181c5
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.7ff6bb030660
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x7ff6bb0a25f8]
lea rcx, [rsp + 0x38]
call fcn.7ff6baffa1e0
int3

Function at 0x7ff6bb019e20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff6bb019ef3
cmp byte [rcx + 0x71], 0
je 0x7ff6bb019ef3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff6bb019eef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff6bb019eb4
sub eax, 1
je 0x7ff6bb019eb8
cmp eax, 2
jne 0x7ff6bb019eef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff6bb019ee6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff6bb019eef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff6bb019e9c
xor al, al
jmp 0x7ff6bb019e9c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff6bb030660
add rsp, 0x60
pop rbx
ret
Function at 0x7ff6bb01bee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.7ff6bb030a60
lea rcx, [0x7ff6bb001300]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff6bb01f1d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x7ff6bb01bf5d
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff6bb030660
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x7ff6bb01bf70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.7ff6bb030a60
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x7ff6bb01f210]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x7ff6bb01bfec
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff6bb030660
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3