joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400017c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1400980e6], 0
movzx esi, dl
mov rdi, r8
setne al
add dl, 2
add al, dl
movzx ebp, al
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp byte [0x1400980e6], 0
mov rbx, rax
je 0x140001853
movzx r8d, sil
movzx r9d, sil
or r8b, 0x80
mov byte [rax], 0x51
mov byte [rax + 1], r8b
xor r8b, 0x3f
lea ecx, [r9 + 2]
mov r10d, ecx
mov byte [rcx + rax], r8b
test sil, sil
je 0x140001845
lea rcx, [rax + 2]
sub rdi, rax
nop
movzx eax, byte [rdi + rcx - 2]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r10 + rbx], al
sub r9, 1
jne 0x140001830
mov r9, rbx
movzx r8d, bpl
call fcn.140001fe0
jmp 0x1400018a1
movzx edx, sil
movzx r8d, sil
or dl, 0x80
mov byte [rax], dl
xor dl, 0x3f
lea eax, [r8 + 1]
mov r9d, eax
mov byte [rax + rbx], dl
test sil, sil
je 0x140001895
lea rcx, [rbx + 1]
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rcx - 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r9 + rbx], al
sub r8, 1
jne 0x140001880
mov r9, rbx
movzx r8d, bpl
call fcn.140001b10
mov rcx, rbx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140004500
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rdi, [r11 + 0x10]
call fcn.1400010b0
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
or rcx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
movzx eax, byte [0x140098cf7]
test al, al
je 0x140004579
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x140098cf6], 0
je 0x14000458c
lea rcx, [rsp + 0x30]
call fcn.1400010c0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x448
pop rdi
pop rbx
ret
Function at 0x140007d90
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [0x140098cf6], 1
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x14007e22c]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x14007e22c]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea rcx, str.RLA_Utility_Console
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x38
ret

Function at 0x140008400
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, 1
mov r14, rdx
mov esi, ecx
cmp ecx, ebx
jle 0x1400084ae
lea rdi, [rdx + 8]
nop dword [rax + rax]
mov rdx, qword [rdi]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140008440
cmp rax, 2
jb 0x1400084fe
cmp word [rdx], 0x2d
jne 0x1400084fe
movzx eax, word [rdx + 2]
cmp eax, 0x63
je 0x14000849f
cmp eax, 0x65
je 0x140008496
cmp eax, 0x6d
je 0x14000848d
cmp eax, 0x72
je 0x140008484
cmp eax, 0x74
jne 0x1400084f7
mov byte [0x140098d1d], 1
jmp 0x1400084a4
mov byte [0x140098d1b], 1
jmp 0x1400084a4
mov byte [0x140098d19], 1
jmp 0x1400084a4
mov byte [0x140098d18], 1
jmp 0x1400084a4
call fcn.140007d90
inc ebx
add rdi, 8
cmp ebx, esi
jl 0x140008430
xor r8d, r8d
lea r9, str.NvidiaRlaUtilityEventExit
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140098d08], rax
test rax, rax
jne 0x14000850c
lea rcx, str.ERROR:_Cannot_create_exit_event__n
call fcn.140004500
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
movsxd rdx, ebx
mov rdx, qword [r14 + rdx*8]
lea rcx, str.ERROR:_Invalid_argument__ls__n
call fcn.1400010c0
jmp 0x1400084dc
cmp byte [0x140098d18], 0
jne 0x14000853f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000852b
lea rcx, str.This_program_can_only_be_started_once._Close_the_other_instance_and_try_again._n
jmp 0x1400084d7
cmp byte [0x140098d18], 0
jne 0x140008538
xor eax, eax
jmp 0x1400084e1
mov rax, qword [0x140098d08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140008555
lea rcx, str.ERROR:_Failed_to_set_exit_event._n
jmp 0x1400084d7
mov rcx, qword [0x140098d08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140008570
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
lea rdx, str.RLA_Utility
lea rcx, str.NVIDIA__ls_n
call fcn.140004500
lea rdx, str.0.24
lea rcx, str.Version:__s_n
call fcn.140004500
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x1400085fb
lea rcx, str.CommandLineToArgvW_failed_n
call fcn.140002320
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x70
pop rbx
ret
mov ecx, dword [rsp + 0x40]
mov rdx, rax
call fcn.140008400
test eax, eax
jne 0x1400085e3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140098d00], rax
test rax, rax
je 0x1400085e3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140098d10], rax
test rax, rax
je 0x1400085e3
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x40]
lea rdx, [0x140007e30]
lea rcx, [rsp + 0x30]
call fcn.140014ea0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140014f10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000867f
mov edx, Ordinal_27
call fcn.140069ad0
mov rcx, rbx
call fcn.140008270
mov qword [0x140098cf8], rax
call fcn.140008380
mov rcx, qword [0x140098cf8]
test rcx, rcx
je 0x1400086a5
call qword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14000872b
mov rcx, qword [0x140098d08]
test rcx, rcx
je 0x1400086c3
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x1400086e2
lea ecx, [rax + 1]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
cmp dword [rsp + 0x58], 0
jne 0x1400086e2
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x58], eax
jne 0x1400086f9
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
xor edx, edx
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x140008720
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140098d00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140098d10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14001ae80
cmp dword [rsp + 0x58], 0
je 0x140008758
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x70
pop rbx
ret
Function at 0x14000bce0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14000be9e
cmp byte [rcx + 0x71], 0
je 0x14000be9e
mov rax, qword [rcx]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140002540]
or edx, 0xffffffff
mov rcx, rdi
call rbx
cmp eax, 0xffffffff
jne 0x14000bd49
xor al, al
jmp 0x14000bea0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.14000b590
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000bdbd
sub eax, 1
jne 0x14000be32
jmp 0x14000bdc1
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000be0f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000be3f
cmp byte [rdi + 0x71], 0
je 0x14000be43
test rbx, rbx
jne 0x14000bd80
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.14000b8c0
jmp 0x14000bd6e
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x14000be43
xor bl, bl
jmp 0x14000be45
mov bl, 1
cmp r9, 0x10
jb 0x14000be99
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x14000be94
test byte [rbp - 0x30], 0x1f
je 0x14000be64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000be74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000be84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000be91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140069ac8
movzx eax, bl
jmp 0x14000bea0
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140069a60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140019c80
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rcx, str.NVRLA_MOUSE_LUT_OTA_BETA_CHANNEL
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140019cc9
movzx edx, byte [rax]
cmp dl, byte [0x14007fc6c]
jne 0x140019cc9
movzx eax, byte [rax + 1]
cmp al, byte [0x14007fc6d]
jne 0x140019cc9
mov r8d, 4
lea rdx, str.BETA
jmp 0x140019cd6
mov r8d, 8
lea rdx, str.OFFICIAL
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rcx, rbx
mov qword [rbx + 0x10], 0
mov byte [rbx], 0
call fcn.14000b670
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140019d00
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rcx, str.NVRLA_MOUSE_LUT_OTA_STAGE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140019d49
movzx edx, byte [rax]
cmp dl, byte [0x14007fc6c]
jne 0x140019d49
movzx eax, byte [rax + 1]
cmp al, byte [0x14007fc6d]
jne 0x140019d49
mov r8d, 0x42
lea rdx, str.https:__ota_internal.nvidia.com_release_available_productMouse_DB
jmp 0x140019d56
mov r8d, reloc.WS2_32.dll_gethostname
lea rdx, str.https:__ota.nvidia.com_release_available_productMouse_DB
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rcx, rbx
mov qword [rbx + 0x10], 0
mov byte [rbx], 0
call fcn.14000b670
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001a3b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
lea r9d, [rbx + 1]
lea r8d, [rbx + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x30], bx
je 0x14001a41a
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001a410
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001b400
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140069a60
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14001dcc0
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
xor r9d, r9d
mov rcx, qword [rcx + 8]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x14001dd2e
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.14001dbb0
lea rdx, [0x14008e270]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.14001ddb0
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, dword [rdi]
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
jns 0x14001dd92
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.14001dbb0
lea rdx, [0x14008e270]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140024290
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x14002436f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x1400242c7
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140024372
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x140024316
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140024320
test rax, rax
je 0x14002436f
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140024360
cmp rdx, rax
jb 0x140024340
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140025e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14002606e
xor edx, edx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], dx
jne 0x140025e70
test rax, rax
je 0x140025ea4
xor ecx, ecx
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x14002606e
cmp r8w, 0x2f
je 0x14002606e
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x140025e80
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.140026090
mov rsi, rax
test rax, rax
je 0x140025f9e
mov qword [rsp + 0x50], r14
call fcn.140026a20
mov r14, rax
test rax, rax
je 0x140025f8b
mov rcx, rsi
call fcn.140024240
test eax, eax
je 0x140025f74
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x140025f20
mov r8, rbx
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp
test eax, eax
je 0x140025f48
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x140025f10
jmp 0x140025f57
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.1400258b0
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x140025f82
mov rcx, rsi
call fcn.1400241f0
test eax, eax
je 0x140025f82
mov rbp, rsi
xor esi, esi
jmp 0x140025f82
mov rdx, rsi
mov rcx, r14
call fcn.1400258b0
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x14002603a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x140026043
mov rcx, rbx
call fcn.140024100
mov rdi, rax
test rax, rax
je 0x140026043
mov ecx, 0x37e4
call fcn.140025440
test eax, eax
je 0x140025fd8
xor ecx, ecx
call fcn.140026760
jmp 0x140025fdd
call fcn.140026a20
mov rbx, rax
test rax, rax
je 0x140026031
mov rdx, rdi
mov rcx, rax
call fcn.1400258b0
mov rbp, rax
test rax, rax
je 0x140026028
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002600a
test al, 0x50
je 0x140026028
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14002601d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x140026043
xor ecx, ecx
jmp 0x140026050
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140026056
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x140026a20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140026a82
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140026a77
cmp edi, eax
jb 0x140026a77
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400273c0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140027421
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14002741b
shr ax, 8
cmp al, 2
jne 0x14002741b
call fcn.140033260
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x1d8
ret
Function at 0x14002f090
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
lea rax, [rcx + rdx]
mov rbp, rax
mov rbx, rcx
sub rbp, rcx
mov esi, 0x1505
cmp rcx, rax
cmova rbp, rdi
test rbp, rbp
je 0x14002ed73
movzx ecx, byte [rbx]
call fcn.14003f320
imul rsi, rsi, 0x21
movsx rcx, al
lea rbx, [rbx + 1]
xor rsi, rcx
inc rdi
cmp rdi, rbp
jb 0x14002ed54
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14002f0c6
call fcn.14002f490
test al, al
jne 0x14002f0c6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f3e0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14002ed20
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14002f990
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140092110]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov r13d, 2
xor ebx, ebx
mov ecx, r13d
mov r14, r9
mov r12, qword [r15 + 0x4e00]
mov rdi, rdx
mov dword [r9], ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x14002f9fe
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, r13d
call fcn.14004a7f0
jmp 0x14002fadc
lea r8, [rsp + 0x58]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x14002fa2f
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, reloc.WS2_32.dll_socket
call fcn.14004a7f0
jmp 0x14002fadc
mov ecx, dword [rsi + 0x400]
sub ecx, 1
je 0x14002fa4f
cmp ecx, 1
jne 0x14002fa42
lea ebx, [rcx + 0x16]
call fcn.140030f70
test al, al
cmove ebx, r13d
jmp 0x14002fa52
mov ebx, r13d
xor eax, eax
lea r8, [0x1400724d8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov r9d, ebp
mov qword [rsp + 0x38], rax
mov edx, recv
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsi + 0xbc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x2c], ebx
call fcn.14003dff0
lea rcx, [rsp + 0x58]
call fcn.14002f880
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.14002ffc0
test al, al
je 0x14002facb
mov dword [r14], 1
jmp 0x14002fada
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r15
call fcn.14003b450
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140069a60
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x14002f990