joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb940
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rax, r8
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x160
and eax, 0xf
mov qword [rbp + 0x28], r9
mov qword [rsp + 0x48], rax
jne 0x1400cba74
mov r12, r8
cmp r8, qword [rbp + 0x30]
ja 0x1400cba50
mov rdi, rdx
mov rdx, qword [rcx + 8]
lea r13, [rsp + 0x50]
mov rax, qword [rcx + 0x98]
lea r15, [rsp + 0x70]
mov rcx, r13
movdqu xmm0, xmmword [rdx]
mov rsi, qword [rax]
mov r14, qword [rax + 8]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm1, xmmword [rdx + 0x10]
mov edx, 8
movaps xmmword [rsp + 0x60], xmm1
call fcn.140208600
mov rcx, r13
mov rdx, r15
mov r13, r12
call fcn.14004e310
shr r13, 4
je 0x1400cba1a
mov rbx, qword [rbp + 0x28]
shl r13, 4
add r13, rbx
nop word [rax + rax]
mov rdx, rbx
mov rcx, rdi
mov r8, r15
add rdi, 0x10
call fcn.140044b40
mov rax, r14
xor dword [rbx], esi
shr rsi, 0x20
xor dword [rbx + 8], r14d
shr rax, 0x20
xor dword [rbx + 4], esi
xor dword [rbx + 0xc], eax
add rbx, 0x10
mov rsi, qword [rdi - 0x10]
mov r14, qword [rdi - 8]
cmp r13, rbx
jne 0x1400cb9e0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax + r12 - 1]
cmp r12, rax
jb 0x1400cbaa1
sub r12, rax
mov qword [rsp + 0x48], r12
mov rax, qword [rsp + 0x48]
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, str.buf_out_size___a_in_size
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_enc_aes
call fcn.14005a150
jmp 0x1400cba31
lea rax, str.Bad_in_size
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_enc_aes
call fcn.14005a150
mov qword [rsp + 0x48], 0
jmp 0x1400cba31
mov qword [rsp + 0x28], rax
lea rax, str.Padding_size_is__zu_while_whole_message_is_just__zu
mov r9d, 8
lea r8, str.dap_enc_aes
mov qword [rsp + 0x30], r12
mov edx, 0x85
lea rcx, str.dap_enc_iaes256_cbc_decrypt_fast
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400cba31
Function at 0x1400d1080
Capabilities:
Get system information on windows
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
mov ecx, 0x202
and rsp, 0xfffffffffffffff0
sub rsp, 0x200
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400d11c0
mov rax, qword [0x1403e40d0]
mov rcx, qword [rax]
xor eax, eax
test rcx, rcx
je 0x1400d10d7
xor r9d, r9d
lea r8, str.debug_reactor
lea rdx, [0x1402bdeeb]
call fcn.1400c01f0
lea rsi, [rsp + 0x30]
mov byte [0x1403ef5c0], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x50]
cmp ebx, edx
cmova rbx, rdx
test ebx, ebx
je 0x1400d1190
mov dword [0x14024e5b0], ebx
lea rdx, [rbx*8]
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [0x1403ef5c8], rax
test rax, rax
je 0x1400d12f3
call fcn.1400c1960
test eax, eax
jne 0x1400d1201
mov rcx, r12
call fcn.140107170
call fcn.1400d1950
mov r12d, eax
test eax, eax
jne 0x1400d12c4
mov eax, dword [0x14024e5b0]
mov r9d, 2
xor edx, edx
xor ecx, ecx
lea r8, str.dap_events
mov dword [rsp + 0x28], eax
lea rax, str.Initialized_event_socket_reactor_for__u_threads
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov eax, r12d
mov dword [0x1403ef5d0], 1
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [0x14024e5b0], edx
shl rdx, 3
jne 0x1400d110b
mov qword [0x1403ef5c8], 0
mov r12d, 0xffffffff
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
mov dword [rsp + 0x28], eax
mov r9d, 8
mov edx, 0xe4
lea rax, str.Couldnt_init_Winsock_DLL__error:__d
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
lea rcx, str.dap_events_init
mov r12d, 2
call fcn.14005a150
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
lea rax, str.Cant_init_client_submodule_dap_context___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xf5
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a150
lea rax, str.Deinit_events_subsystem
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.dap_events
call fcn.14005a150
call fcn.1400fb010
call fcn.1400d1510
call fcn.140106fa0
mov eax, dword [0x14024e5b0]
test eax, eax
je 0x1400d1298
xor ebx, ebx
nop dword [rax + rax]
mov rax, qword [0x1403ef5c8]
mov edx, ebx
add ebx, 1
mov rax, qword [rax + rdx*8]
mov rdx, rsi
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x38]
call fcn.1400337d0
cmp ebx, dword [0x14024e5b0]
jb 0x1400d1270
mov rcx, qword [0x1403ef5c8]
test rcx, rcx
je 0x1400d12a9
call sub.msvcrt.dll_free
mov dword [0x1403ef5d0], 0
mov r12d, 0xffffffff
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400d11b1
lea rax, str.Cant_init_client_submodule_dap_events_socket_init___
mov r9d, 8
lea r8, str.dap_events
mov edx, 0xfb
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_init
call fcn.14005a150
jmp 0x1400d122b
or r12d, 0xffffffff
jmp 0x1400d11b1
Function at 0x1400d1340
Capabilities:
Set socket configuration

Disassembly:
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
sub rsp, 0x50
cmp ecx, 1
je 0x1400d13a0
test ecx, 0xfffffff7
je 0x1400d1440
lea rax, str.Cant_create_socket_type__d
mov dword [rsp + 0x28], ecx
xor r12d, r12d
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, str.dap_events_socket
mov edx, 0x1d3
lea rcx, str.dap_events_socket_create
call fcn.14005a150
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 2
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
lea r8, [rsp + 0x4c]
mov edx, 0x8004667e
mov dword [rsp + 0x4c], 1
mov rsi, rax
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1400d1450
mov rdx, r12
mov rcx, rsi
call fcn.1400d25e0
mov r12, rax
test rax, rax
je 0x1400d1488
mov dword [rax + 0x34], ebx
mov rax, qword [0x1403e4100]
lea r8, str.dap_events_socket
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x30], ebx
cmove r8, rax
lea rax, str.Created_socket__llu_type__d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14005a150
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 1
jmp 0x1400d13a5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Error_ioctl__d
lea r8, str.dap_events_socket
mov qword [rsp + 0x20], rax
call fcn.14005a150
jmp 0x1400d13d5
lea rax, str.Cant_allocate_memory_for_the_new_esocket
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x1e9
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_create
call fcn.14005a150
jmp 0x1400d138f

Function at 0x1400d18c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov edx, 2
mov rbp, rsp
push r12
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
movzx eax, word [rcx + 0x1c]
mov r12, qword [rcx]
mov ecx, 0x7f000001
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], dx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov r8d, 1
lea rdx, [0x1402be578]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1400d1940
mov r12, qword [rbp - 8]
xor eax, eax
leave
ret
mov r12, qword [rbp - 8]
leave
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
Function at 0x1400d1d90
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov rax, qword [0x1403e4100]
mov qword [rbp + 0x18], rdx
cmp byte [rax], 0
je 0x1400d1def
mov eax, 0xffffffff
test rcx, rcx
je 0x1400d1dbe
mov eax, dword [rcx]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x18]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d1e30
xor eax, eax
lea rsp, [rbp - 0x10]
pop rbx
pop r12
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r12, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], dx
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rbp + 0x18]
mov rcx, r12
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400d1e1c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400d1e1e
Function at 0x1400d2040
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
push rsi
mov rsi, rdx
mov edx, 8
push rbx
mov rbx, rcx
mov ecx, 1
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400d21a9
mov qword [rax], rsi
mov r12, rax
mov rbx, qword [rbx + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1403e4100]
cmp byte [rax], 0
je 0x1400d20c4
mov eax, 0xffffffff
test rbx, rbx
je 0x1400d2097
mov eax, dword [rbx]
mov dword [rsp + 0x38], eax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
test rax, rax
je 0x1400d2100
lea rsp, [rbp - 0x20]
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov r13, qword [rbx]
mov ecx, 0x7f000001
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov word [rsp + 0x50], dx
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov rcx, r13
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1400d20f2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1400d20f2
lea rax, str.Cant_send__llu_uuid_in_queue
mov qword [rsp + 0x28], rsi
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.dap_events_socket
call fcn.14005a150
lea rsp, [rbp - 0x20]
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
pop rbp
jmp sub.msvcrt.dll_free
lea rax, [0x1402be52e]
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x6b3
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_remove_and_delete_mt
call fcn.14005a150
jmp 0x1400d20f2

Function at 0x1400d3540
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x1400d35a0
push r12
mov r12, rdx
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d3590
mov qword [rdx], 0
mov rbx, r8
test r8, r8
je 0x1400d356a
mov qword [r8], 0
lea rdx, [0x1403e1535]
call sub.msvcrt.dll_fopen
mov rcx, rax
test rax, rax
je 0x1400d3590
add rsp, 0x28
mov r8, rbx
mov rdx, r12
pop rbx
pop r12
jmp fcn.140123570
add rsp, 0x28
xor eax, eax
pop rbx
pop r12
ret
xor eax, eax
ret

Function at 0x1400d35b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d35d0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
xor eax, eax
ret

Function at 0x1400d35e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d3610
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d3600
shr al, 7
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
ret
Function at 0x1400d39a0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
xor r14d, r14d
push r13
push r12
mov r12, rcx
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x160
call sub.msvcrt.dll_strlen
lea rdi, [rsp + 0x4c]
lea rcx, [rax + 2]
mov rbx, rax
call sub.msvcrt.dll_malloc
mov r8, rbx
mov rdx, r12
mov r13, rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [r13 + rbx], 0x2a
mov rcx, r13
mov byte [r13 + rbx + 1], 0
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov r12, rax
nop
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
je 0x1400d3a64
cmp dword [rsp + 0x20], 0x10
jne 0x1400d3a10
cmp word [rdi], 0x2e2e
je 0x1400d3a90
cmp word [rdi], 0x2e
je 0x1400d3a10
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov rcx, rdi
mov r15, rax
call fcn.1400fe770
mov qword [r15 + 8], 0
mov qword [r15], rax
test r14, r14
jne 0x1400d3aa0
mov r14, r15
mov rdx, rbx
mov rcx, r12
call rsi
test eax, eax
jne 0x1400d3a1c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r13
call sub.msvcrt.dll_free
lea rsp, [rbp - 0x38]
mov rax, r14
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp byte [rdi + 2], 0
je 0x1400d3a10
jmp 0x1400d3a2a
mov rax, r14
nop dword [rax + rax]
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400d3aa8
mov qword [rdx + 8], r15
jmp 0x1400d3a10
Function at 0x1400da970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x58
test r8, r8
je 0x1400dab39
lea rax, str.Checking_url_path__s
mov r12, r8
xor r9d, r9d
mov r15, rcx
mov qword [rsp + 0x28], r8
xor ecx, ecx
mov r14, rdx
lea r8, str.dap_http_folder
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14005a150
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400daac0
test al, 0x10
je 0x1400daac0
lea rax, str.File_service_for__s____s
mov qword [rsp + 0x30], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.dap_http_folder
mov qword [rsp + 0x28], r14
call fcn.14005a150
mov edx, 0x1008
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400dab7f
mov r8d, 0xfff
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov ecx, 0x492
call fcn.1400019f8
mov qword [r13 + 0x1000], rax
mov rcx, rax
test rax, rax
je 0x1400dab42
lea rdx, str.data.mag
call fcn.140001b7e
mov r12d, eax
test eax, eax
jne 0x1400daaf0
lea rax, [0x1400dabd0]
xor r9d, r9d
mov r8, r13
mov rdx, r14
mov qword [rsp + 0x40], rax
lea rax, [0x1400dabc0]
mov rcx, r15
mov qword [rsp + 0x38], rax
lea rax, [0x1400dad20]
mov qword [rsp + 0x30], rax
lea rax, [0x1400dacc0]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.1400d8290
add rsp, 0x58
mov eax, r12d
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.Directory_Not_Found_
mov qword [rsp + 0x20], rax
mov r9d, 7
xor edx, edx
xor ecx, ecx
lea r8, str.dap_http_folder
mov r12d, 0xfffffff5
call fcn.14005a150
jmp 0x1400daaab
lea rax, str.Cant_load_MIME_magic_detection_database
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x8c
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xfffffffe
call fcn.14005a150
mov rcx, qword [r13 + 0x1000]
call fcn.140001b59
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400daaab
lea rax, str.Directory_Path_parameter_is_empty_
jmp 0x1400daac7
lea rax, str.Cant_init_MIME_detection_library
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x81
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xffffffff
call fcn.14005a150
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400daaab
lea rax, [0x1402baf58]
mov r9d, 8
or r12d, 0xffffffff
mov edx, 0x79
mov qword [rsp + 0x20], rax
lea r8, str.dap_http_folder
lea rcx, str.dap_http_folder_add
call fcn.14005a150
jmp 0x1400daaab
Function at 0x1400f6690
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400f67f5
cmp byte [rcx], 0
mov r12, rcx
je 0x1400f67f5
call sub.msvcrt.dll_strlen
mov rbx, rax
lea r8, [rax + 1]
lea rax, [rax + 0x10]
shr rax, 4
shl rax, 4
call fcn.140035990
xor edx, edx
sub rsp, rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rdx, r12
mov rcx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
movzx eax, byte [rsp + 0x20]
mov rdx, rsi
mov ecx, eax
and ecx, 0xffffffdf
sub ecx, 0x41
cmp cl, 0x19
jbe 0x1400f67b1
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
xor ebx, ebx
test al, al
je 0x1400f6730
cmp al, 0x5c
je 0x1400f6790
cmp al, 0x2f
je 0x1400f6790
movzx eax, byte [rdx + 1]
xor ebx, ebx
add rdx, 1
test al, al
jne 0x1400f6716
nop dword [rax]
mov rcx, rsi
call rdi
cmp eax, 0xffffffff
je 0x1400f673e
test al, 0x10
jne 0x1400f6752
mov rcx, rsi
call sub.msvcrt.dll__mkdir
mov r12d, eax
cmp eax, 0xffffffff
je 0x1400f67db
test rbx, rbx
je 0x1400f67a0
movzx eax, byte [rbx + 1]
mov byte [rbx], 0x5c
lea rdx, [rbx + 1]
xor ebx, ebx
test al, al
jne 0x1400f677c
jmp 0x1400f6730
movzx eax, byte [rdx + 1]
add rdx, 1
test al, al
je 0x1400f6710
cmp al, 0x5c
je 0x1400f6770
cmp al, 0x2f
je 0x1400f6770
jmp 0x1400f6710
mov byte [rdx], 0
mov rbx, rdx
jmp 0x1400f6730
xor r12d, r12d
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
cmp byte [rsp + 0x21], 0x3a
jne 0x1400f6708
movzx ecx, byte [rsi + 2]
cmp cl, 0x5c
je 0x1400f67ce
cmp cl, 0x2f
jne 0x1400f6708
movzx eax, byte [rsi + 3]
lea rdx, [rsi + 3]
jmp 0x1400f6708
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400f67a3
Function at 0x1400f71b0
Capabilities:
Resolve dns

Disassembly:
push rbp
mov eax, 2
mov rbp, rsp
push r12
push rsi
mov rsi, r8
push rbx
mov ebx, edx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
cmp edx, 2
mov edx, 0x17
cmovne eax, edx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 2
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1400f7276
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jne 0x1400f724e
jmp 0x1400f7298
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x1400f7298
cmp dword [rcx + 4], ebx
jne 0x1400f7240
cmp ebx, 2
je 0x1400f7288
cmp ebx, 0x17
jne 0x1400f7240
mov rax, qword [rcx + 0x20]
mov rdx, qword [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsi + 8], rdx
mov qword [rsi], rax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rsp, [rbp - 0x18]
mov eax, r12d
pop rbx
pop rsi
pop r12
pop rbp
ret
mov rax, qword [rcx + 0x20]
mov eax, dword [rax + 4]
mov dword [rsi], eax
jmp 0x1400f7270
lea rsp, [rbp - 0x18]
mov r12d, 0xffffffff
pop rbx
mov eax, r12d
pop rsi
pop r12
pop rbp
ret

Function at 0x1400f7490
Capabilities:
Send data
Send data on socket

Disassembly:
cmp qword [0x1403eb810], 0
je 0x1400f74c0
sub rsp, 0x28
call fcn.1400fe770
mov rcx, qword [0x1403eb810]
add rsp, 0x28
mov rdx, rax
jmp fcn.1400d1d90
xor eax, eax
ret
Function at 0x1400fad20
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
mov rbp, rcx
push rdi
mov rdi, r8
push rsi
mov rsi, rdx
push rbx
mov ebx, r9d
sub rsp, 0x50
cmp r9d, 3
jg 0x1400fadc8
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400fae09
mov qword [rax], rsi
lea r8, str.dap_proc_queue
mov qword [rax + 8], rdi
mov dword [rax + 0x14], ebx
mov rax, qword [0x1403e4100]
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x40], ebx
cmove r8, rax
lea rax, str.Requested_l_msg:_p__callback:__p__p__pri:__d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov rax, qword [rbp + 8]
mov rdx, r12
mov rcx, qword [rax + 8]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d1d90
lea rax, str.Priority_level__d_is_incorrect__should_be_is_in_range__d__d_
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 5
mov ebx, 2
lea r8, str.dap_proc_queue
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
call fcn.14005a150
jmp 0x1400fad40
add rsp, 0x50
mov eax, 0xfffffff4
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400fae20
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
mov r13, rcx
push r12
push rdi
mov rdi, r8
push rsi
mov rsi, rdx
push rbx
mov ebx, r9d
sub rsp, 0x50
cmp r9d, 3
jg 0x1400faec8
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400faf09
mov qword [rax], rsi
lea r8, str.dap_proc_queue
mov qword [rax + 8], rdi
mov dword [rax + 0x14], ebx
mov rax, qword [0x1403e4100]
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x40], ebx
cmove r8, rax
lea rax, str.Requested_inter_l_msg:_p__callback:__p__p__pri:__d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005a150
add rsp, 0x50
mov rdx, r12
mov rcx, r13
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400d1ea0
lea rax, str.Priority_level__d_is_incorrect__should_be_is_in_range__d__d_
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 5
mov ebx, 2
lea r8, str.dap_proc_queue
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
call fcn.14005a150
jmp 0x1400fae41
add rsp, 0x50
mov eax, 0xfffffff4
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x1400fb1b0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
mov rbp, r8
push rdi
mov rdi, rcx
mov ecx, 1
push rsi
mov rsi, r9
push rbx
mov rbx, rdx
mov edx, 0x10
sub rsp, 0x40
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400fb23d
mov qword [rax], rbp
mov r12, rax
lea r8, str.dap_proc_thread
mov r9d, 1
mov qword [rax + 8], rsi
mov rax, qword [0x1403e4100]
cmp byte [rax], 0
mov eax, 0
mov qword [rsp + 0x30], rbx
cmove r8, rax
lea rax, str.Msg_with_arg__p____worker__zu
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.14005a150
mov rax, qword [rdi + 0x28]
mov rdx, r12
mov rcx, qword [rax + rbx*8]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d1ea0
lea rax, [0x1402bef88]
mov r9d, 8
lea r8, str.dap_proc_thread
mov edx, 0x1a5
mov qword [rsp + 0x20], rax
lea rcx, str.dap_proc_thread_worker_exec_callback_inter
call fcn.14005a150
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400fc500
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub rsp, 0x48
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400fc530
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x36]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400fc526
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret

Function at 0x1400fc560
Capabilities:
Delete directory
Delete file

Disassembly:
jmp qword [sym.imp.msvcrt.dll__rmdir]
push r14
mov r14, rcx
push r13
push r12
sub rsp, 0x20
call fcn.140035ff0
mov r12, rax
test rax, rax
je 0x1400fc5fe
nop
mov rcx, r12
call fcn.140036200
test rax, rax
je 0x1400fc5cd
cmp byte [rax + 8], 0x2e
lea rdx, [rax + 8]
jne 0x1400fc59d
cmp byte [rdx + 1], 0
je 0x1400fc580
cmp byte [rdx], 0x2e
je 0x1400fc5f0
xor r8d, r8d
mov rcx, r14
call fcn.140075250
mov r13, rax
mov rcx, rax
call fcn.1400fc560
mov rcx, r13
call sub.msvcrt.dll_free
mov rcx, r12
call fcn.140036200
test rax, rax
jne 0x1400fc58d
mov rcx, r12
call fcn.140036450
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp 0x140044948
cmp byte [rdx + 1], 0x2e
jne 0x1400fc5a2
cmp byte [rdx + 2], 0
je 0x1400fc580
jmp 0x1400fc5a2
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp fcn.140044838