joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180124500
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x180246fa0]
cmp rax, 3
jne 0x18012469e
cmp rbx, 0x17f
ja 0x1801246b0
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call fcn.180199330
mov byte [rsp + rbx + 0x68], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x180124578
xor edx, edx
nop dword [rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x180124604
inc rdx
cmp rax, rdx
jne 0x180124560
jmp 0x180124667
xor ecx, ecx
mov dl, 1
test dl, dl
jne 0x1801245a8
jne 0x1801245a8
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x180124604
inc rdx
jne 0x180124590
xor edx, edx
test dl, dl
jne 0x1801245fa
lea rdx, [rbx - 0xf]
jmp 0x1801245ae
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x1801a8850]
movabs r8, 0x8080808080808080
movdqu xmm1, xmmword [rsp + rcx + 0x68]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1801245fa
add rcx, 0x10
cmp rcx, rdx
jbe 0x1801245c0
jmp 0x1801245fa
cmp byte [rsp + rcx + 0x68], 0
je 0x180124601
inc rcx
cmp rax, rcx
jne 0x1801245f0
jmp 0x180124667
mov rdx, rcx
cmp rdx, rbx
jne 0x180124667
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x180124686
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x180124679
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x180124679
call fcn.1801a1ed0
cmp rbx, 0x17f
jbe 0x180124538
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1801a1f40
Function at 0x180124e90
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x180124edc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180124fa9
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180124fa9
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x180125040]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x180124f9b
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x180124f75
cmp qword [rax + 0x10], 0x11
jae 0x180124f5e
mov r8, qword [rbp - 0x20]
jmp 0x180124f66
mov r8, qword [rbp - 0x20]
mov r8, qword [r8 - 8]
mov rcx, qword [0x180246f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.18019a870
ud2

Function at 0x180125170
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1801251b3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.180120940]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.18019abc0
ud2
Function at 0x1801293f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x18012941b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x180246fa0]
cmp rax, 3
jne 0x18012959d
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180129490
cmp word [rbx], 0
je 0x180129508
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x18012951d
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1801294ab
mov r14d, eax
cmp eax, 0x2726
jne 0x18012958c
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x180129583
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x180129468
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x18012958c
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x30], r9w
mov word [rsp + 0x32], cx
mov dword [rsp + 0x34], eax
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18012955c
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x180129410
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x180129410
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x180129409
call fcn.1801a1ed0
jmp 0x18012942c
Function at 0x180129740
Capabilities:
Reference wmi statements

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x180129817
lea rcx, [0x18020c0ba]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x180129817
mov rbx, qword [rsp + 0x30]
cmp qword [rsi + 0x20], 0
je 0x1801297e3
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1801297e3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x180129880
mov qword [rdi], 2
mov rcx, qword [rsi + 0x28]
cmp qword [rsi + 0x20], 0
mov qword [rsi + 0x20], 0
je 0x18012983c
test rcx, rcx
je 0x18012983c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 0x10], 0
test r15, r15
je 0x180129858
test rcx, rcx
je 0x180129858
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x180129874
test rcx, rcx
je 0x180129874
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rsi + 0x30], 0
je 0x180129880
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180135390
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x18013549d
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
mov qword [rsp + 0x28], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
test rbp, rbp
je 0x18013547c
shl rbp, 3
mov r15d, 8
xor esi, esi
lea rbx, [rsp + 0x60]
lea r14, [rsp + 0x48]
xor r12d, r12d
jmp 0x180135429
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [r15 + rax*8 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [r15 + rax*8], xmm0
inc r12
mov qword [rsp + 0x38], r12
add rsi, 8
cmp rbp, rsi
je 0x18013547c
mov r13, qword [rdi + rsi]
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rax
mov word [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.1801310a0
cmp r12, qword [rsp + 0x30]
jne 0x180135400
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.180079250
mov r15, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
jmp 0x180135400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
jmp 0x1801354ab
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180142250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rcx, r9
call fcn.180137d30
lea rcx, [rdx + 0x148]
lea r8, [rdx + 0xd0]
test rax, rax
cmove rcx, r8
cmp dword [rcx + 0x138], 0x3b9aca00
je 0x180142353
mov ecx, 1
mov r8d, 1
lock xadd qword [rdx], r8
test rax, rax
je 0x1801422b1
test r8, r8
jns 0x1801422bc
jmp 0x180142369
test r8, r8
js 0x180142369
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov r8d, dword [rsp + 0x44]
mov dword [rsi + 0x3c], r8d
movups xmm0, xmmword [rsp + 0x34]
movups xmmword [rsi + 0x2c], xmm0
movups xmm0, xmmword [rsp + 0x24]
movups xmmword [rsi + 0x1c], xmm0
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edi
mov qword [rsi + 0x40], 0xffffffffffffffff
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x58], 0
mov byte [rsi + 0x60], 0
mov byte [rsi + 0x68], 0
lock dec qword [rdx]
sete cl
test rax, rax
je 0x180142333
test cl, cl
je 0x180142348
mov rcx, rdx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180136c90
test cl, cl
je 0x180142348
mov rcx, rdx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180136bf0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x18020d740]
mov edx, 0x73
mov r8, r14
call fcn.18019b120
ud2
ud2
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, r9
mov ebx, r8d
mov r14, rdx
mov rdi, rcx
call fcn.180125710
add rax, r14
jb 0x1801423a3
mov r8d, edx
add r8d, ebx
cmp r8d, 0x3b9aca00
jb 0x1801423fd
inc rax
jne 0x1801423f6
call fcn.180125710
add rax, 0x38640900
jb 0x18014242e
mov r8d, edx
cmp edx, 0x3b9ac9ff
jbe 0x1801423c7
inc rax
je 0x18014242e
add r8d, 0xc4653600
mov ecx, r8d
shr ecx, 9
imul rdx, rcx, 0x44b83
shr rdx, 0x27
add rdx, rax
jb 0x180142448
imul rax, rcx, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov rcx, rdi
jmp 0x18014241d
add r8d, 0xc4653600
mov ecx, r8d
shr ecx, 9
imul rcx, rcx, 0x44b83
shr rcx, 0x27
imul ecx, ecx, 0x3b9aca00
sub r8d, ecx
mov rcx, rdi
mov rdx, rax
mov r9, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x180142250
lea rcx, str.overflow_when_adding_duration_to_instantlibrary_std_src_time.rs
lea r8, [0x180209e20]
mov edx, 0x28
call fcn.18019b120
ud2
lea rax, str.overflow_in_Duration::new
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x180234e18]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._rustc_8c74a5d27c644a0f7a22bb2fa8dd3ff8257bc220librarycore_src_time.rsX
lea rcx, [rsp + 0x28]
call fcn.18019abc0
ud2
Function at 0x180142370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rcx, r9
call fcn.180137d30
lea rcx, [rdx + 0x148]
lea r8, [rdx + 0xd0]
test rax, rax
cmove rcx, r8
cmp dword [rcx + 0x138], 0x3b9aca00
je 0x180142353
mov ecx, 1
mov r8d, 1
lock xadd qword [rdx], r8
test rax, rax
je 0x1801422b1
test r8, r8
jns 0x1801422bc
jmp 0x180142369
test r8, r8
js 0x180142369
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov r8d, dword [rsp + 0x44]
mov dword [rsi + 0x3c], r8d
movups xmm0, xmmword [rsp + 0x34]
movups xmmword [rsi + 0x2c], xmm0
movups xmm0, xmmword [rsp + 0x24]
movups xmmword [rsi + 0x1c], xmm0
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edi
mov qword [rsi + 0x40], 0xffffffffffffffff
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x58], 0
mov byte [rsi + 0x60], 0
mov byte [rsi + 0x68], 0
lock dec qword [rdx]
sete cl
test rax, rax
je 0x180142333
test cl, cl
je 0x180142348
mov rcx, rdx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180136c90
test cl, cl
je 0x180142348
mov rcx, rdx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180136bf0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x18020d740]
mov edx, 0x73
mov r8, r14
call fcn.18019b120
ud2
ud2
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, r9
mov ebx, r8d
mov r14, rdx
mov rdi, rcx
call fcn.180125710
add rax, r14
jb 0x1801423a3
mov r8d, edx
add r8d, ebx
cmp r8d, 0x3b9aca00
jb 0x1801423fd
inc rax
jne 0x1801423f6
call fcn.180125710
add rax, 0x38640900
jb 0x18014242e
mov r8d, edx
cmp edx, 0x3b9ac9ff
jbe 0x1801423c7
inc rax
je 0x18014242e
add r8d, 0xc4653600
mov ecx, r8d
shr ecx, 9
imul rdx, rcx, 0x44b83
shr rdx, 0x27
add rdx, rax
jb 0x180142448
imul rax, rcx, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov rcx, rdi
jmp 0x18014241d
add r8d, 0xc4653600
mov ecx, r8d
shr ecx, 9
imul rcx, rcx, 0x44b83
shr rcx, 0x27
imul ecx, ecx, 0x3b9aca00
sub r8d, ecx
mov rcx, rdi
mov rdx, rax
mov r9, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x180142250
lea rcx, str.overflow_when_adding_duration_to_instantlibrary_std_src_time.rs
lea r8, [0x180209e20]
mov edx, 0x28
call fcn.18019b120
ud2
lea rax, str.overflow_in_Duration::new
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x180234e18]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._rustc_8c74a5d27c644a0f7a22bb2fa8dd3ff8257bc220librarycore_src_time.rsX
lea rcx, [rsp + 0x28]
call fcn.18019abc0
ud2
Function at 0x18014e9e0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x18014ea36
mov edi, eax
lea rcx, [rsp + 0x40]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x18014ea36
xor edi, 0x80000000
jne 0x18014eacc
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x28]
and cl, 0x3f
or cl, 0x80
movzx edx, byte [rsp + 0x2a]
shl edx, 8
movzx r8d, byte [rsp + 0x29]
or r8d, edx
movzx ecx, cl
shl ecx, 8
movzx edx, byte [rsp + 0x27]
or edx, ecx
movd xmm1, edx
pinsrw xmm1, r8d, 1
mov ecx, dword [rsp + 0x2c]
shl ecx, 8
movzx edx, byte [rsp + 0x2b]
or edx, ecx
pinsrw xmm1, edx, 2
movzx ecx, byte [rsp + 0x2e]
shl ecx, 8
movzx edx, byte [rsp + 0x2d]
or edx, ecx
pinsrw xmm1, edx, 3
movzx ecx, byte [rsp + 0x2f]
and al, 0xf
or al, 0x40
movd dword [rsi], xmm0
pextrw edx, xmm0, 2
mov word [rsi + 4], dx
mov byte [rsi + 6], al
mov byte [rsi + 0xf], cl
movq qword [rsi + 7], xmm1
add rsp, 0x98
pop rdi
pop rsi
ret
mov dword [rsp + 0x3c], edi
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x58], rax
lea rax, [0x18003e6c0]
mov qword [rsp + 0x60], rax
lea rax, [0x1802335e8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.C:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001fuuid_1.6.1_src_rng.rs
lea rcx, [rsp + 0x68]
call fcn.18019abc0
ud2
Function at 0x18014fea0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov qword [rsp + 0x48], 0
lea r14, [rsp + 0x48]
mov qword [rsp + 0x20], r14
lea rcx, [0x180233bc4]
lea r9, [0x180233ba8]
xor ebx, ebx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18014ffa5
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x18014ffbc
lea rcx, [0x180233bb8]
mov edx, 0xa
call fcn.18014f960
mov rbx, rax
mov qword [rsp + 0x48], 0
mov rax, qword [rdi]
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
xor r15d, r15d
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x18014ffc4
mov r14, qword [rsp + 0x48]
test r14, r14
je 0x18014ffdc
test rbx, rbx
je 0x18014ff64
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x180150006
mov qword [rsi + 8], r14
mov byte [rsi], 0x11
jmp 0x18014fff0
mov ecx, eax
call fcn.18014edd0
mov ebx, edx
test rax, rax
je 0x18014ffbc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov byte [rsi], 0
mov dword [rsi + 4], ebx
jmp 0x18014fff9
mov ecx, eax
call fcn.18014edd0
mov r15d, edx
test rax, rax
je 0x18014ffdc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
test rbx, rbx
je 0x18014ffe9
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov byte [rsi], 0
mov dword [rsi + 4], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call fcn.18014edd0
mov ebx, edx
test rax, rax
je 0x18015001d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov byte [rsi], 0
mov dword [rsi + 4], ebx
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
jmp 0x18014fff0
Function at 0x18016dd50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x18016de2d
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x18016de3e
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.18016dc50
Function at 0x1801a1f40
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rbx, r8
inc rbx
sete bpl
je 0x1801a21bd
js 0x1801a21d7
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x1801a1f9c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801a21ae
mov rcx, rax
mov qword [0x180246f98], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801a21ae
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.180199330
cmp r14, 0x10
jae 0x1801a1ff8
test r14, r14
je 0x1801a20b3
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1801a2136
inc rax
cmp r14, rax
jne 0x1801a1fe0
jmp 0x1801a20b3
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
je 0x1801a203e
cmp rax, r14
cmovae rax, r14
test rax, rax
je 0x1801a203e
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r15 + rcx], 0
je 0x1801a2136
inc rcx
cmp rax, rcx
jne 0x1801a2020
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x1801a2044
jmp 0x1801a208e
lea rcx, [r14 - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x1801a8850]
movabs rdx, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x1801a208e
add rax, 0x10
cmp rax, rcx
jbe 0x1801a2060
cmp rax, r14
je 0x1801a20b3
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1801a2136
inc rax
cmp r14, rax
jne 0x1801a20a0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x30]
call fcn.18001eaf0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1801a216e
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
jne 0x1801a218c
jmp 0x1801a219e
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test bpl, bpl
jne 0x1801a219e
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
je 0x1801a219e
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rbx
call fcn.18019a870
ud2
lea rcx, [0x1802343c7]
lea r8, str.library_alloc_src_ffic_str.rs
mov edx, 0x2b
call fcn.18019ad80
ud2
call fcn.18001e850
ud2