joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4681e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00663618]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46827b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x4684a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00663618]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x468537
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x468900
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x468934
mov rcx, 0x28
jmp 0x46893f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00663618], rcx
pop rbp
ret
Function at 0x482b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482c0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00663618]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x482bef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004dea60]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x482bde
mov edi, 1
lea rsi, [0x004dea60]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0052f158]
lea rsi, [0x0052e490]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4b11e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4b12b5
movdqa xmm0, xmmword [0x0052e610]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4b1221
movdqa xmm0, xmmword [0x0052e620]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4b1337
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4b130b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0052e488]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0052e630]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4bb740
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bbe7f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4bb76d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4bb9f1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4bba1d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00530f20]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004de960]
lea rbx, [0x0052edd0]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4bba42
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4bba77
lea rdi, [0x004de9e0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4bb763
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4bba5b
jmp 0x4bba30
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4bc020
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4bc037
inc rax
cmp rax, 4
jge 0x4bc04f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4bc034
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4bc060
inc rax
cmp rax, 4
jge 0x4bc06e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4bc097
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4bc07b
jmp 0x4bc05d
Function at 0x1400033fc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140098980]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140003848
lea rcx, [rsp + 0x30]
call fcn.140003910
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400017a0
mov r9, rax
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
lea r8, [0x14000395c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000348e
lea rcx, [rsp + 0x30]
call fcn.140003884
nop
lea rcx, [rsp + 0x30]
call fcn.1400038a0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140074e90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400035d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140098980]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140003848
lea rcx, [rsp + 0x30]
call fcn.140003b24
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400017a0
mov r9, rax
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
lea r8, [0x140003b54]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140003662
lea rcx, [rsp + 0x30]
call fcn.140003850
nop
lea rcx, [rsp + 0x30]
call fcn.14000386c
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140074e90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14000ad54
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140098980]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140003848
lea rcx, [rsp + 0x30]
call fcn.14000ae5c
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400017a0
mov r9, rax
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
lea r8, [0x14000aea8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000ade6
lea rcx, [rsp + 0x30]
call fcn.140003850
nop
lea rcx, [rsp + 0x30]
call fcn.14000adf8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140074e90
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
and dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14001bd70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001be52
call fcn.140034d50
test al, al
jne 0x14001be52
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x14001bda2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.14003e6f0
test rax, rax
je 0x14001bde7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.14003e6f0
mov rsi, rax
test rax, rax
je 0x14001bde7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14001be1b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140031b60
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x14001be00
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140029e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xaaf], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x140029ec9
cmp qword [rcx + 0x278], 0
je 0x140029e7e
mov qword [rsp + 0x40], rbx
call fcn.140016430
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.140016a50
mov rcx, qword [rdi + 0x1f0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x278]
movzx edx, bl
mov rcx, rdi
call fcn.140016a50
mov rbx, qword [rsp + 0x40]
jmp 0x140029ec9
mov ecx, esi
test edx, edx
je 0x140029e8e
sub ecx, 1
je 0x140029e8e
cmp ecx, 1
jne 0x140029ec9
mov r9, qword [rdi + 0x1e8]
lea rax, [0x14007b960]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1e8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002ddb0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x14002e090
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14002e0ba
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExW
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14007c1a8]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
test rax, rax
je 0x14002e119
mov rcx, rbx
test r14, r14
je 0x14002e106
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x14002e150
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002e150
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x14002e21a
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x14002e180
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x14002e20c
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14002e20c
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x14002e1b3
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x14002e1c5
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14002e1e0
mov rcx, rsi
test r14, r14
je 0x14002e203
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14002e209
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [case.0x14001d47b.0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140035b60
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x140035b75
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1400355a0

Function at 0x140035ea0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140098980]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
mov r14, rdx
mov rbp, rcx
cmp byte [rcx + 0xaaf], dil
je 0x1400360bf
cmp byte [rdx + 0x18], dil
mov qword [rsp + 0xc8], rsi
lea rsi, [rdx + 0x18]
je 0x1400360b7
lea r8, [rsp + 0x20]
mov rdx, rsi
lea ecx, [rdi + 2]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1400360b7
lea r8, [rsp + 0x70]
mov rdx, rsi
lea ecx, [rdi + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1400360b7
cmp byte [rsi], dil
lea rdx, str.Host__s:_d_was_resolved.
mov r9d, dword [r14 + 0x14]
mov rcx, rbp
mov qword [rsp + 0x100], rbx
mov rbx, qword [r14]
mov qword [rsp + 0xc0], r15
lea r15, str._none_
mov r8, r15
cmovne r8, rsi
call fcn.140029fd0
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14001c3b0
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.14001c3b0
test rbx, rbx
je 0x140036024
lea r14d, [rdi + 0x20]
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0x17
je 0x140035f91
cmp ecx, 2
jne 0x140036017
xor eax, eax
mov byte [rsp + 0x80], 0
cmp ecx, 2
lea rsi, [rsp + 0x30]
cmovne rax, r14
add rsi, rax
cmp ecx, 2
je 0x140035fbe
cmp ecx, 0x17
jne 0x140035fd9
mov rdx, qword [rbx + 0x20]
add rdx, 8
jmp 0x140035fc6
mov rdx, qword [rbx + 0x20]
add rdx, 4
mov r9d, 0x2e
lea r8, [rsp + 0x80]
call sub.WS2_32.dll_inet_ntop
mov rcx, rsi
call fcn.140007500
test rax, rax
je 0x140035ffd
mov r8d, 2
lea rdx, [0x14007b98c]
mov rcx, rsi
call fcn.14001c370
mov edi, eax
test edi, edi
jne 0x14003603f
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14001c310
mov edi, eax
test eax, eax
jne 0x14003603f
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140035f80
lea rcx, [rsp + 0x50]
call fcn.140007500
test rax, rax
je 0x140036050
lea rcx, [rsp + 0x50]
call fcn.1400017a0
jmp 0x140036053
lea rdx, str.too_many_IP__cant_show
mov rcx, rbp
call fcn.140029fd0
jmp 0x140036093
mov rax, r15
mov r8, rax
lea rdx, str.IPv6:__s
mov rcx, rbp
call fcn.140029fd0
lea rcx, [rsp + 0x30]
call fcn.140007500
test rax, rax
je 0x140036081
lea rcx, [rsp + 0x30]
call fcn.1400017a0
mov r15, rax
mov r8, r15
lea rdx, str.IPv4:__s
mov rcx, rbp
call fcn.140029fd0
lea rcx, [rsp + 0x30]
call fcn.14001c380
lea rcx, [rsp + 0x50]
call fcn.14001c380
mov r15, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140074e90
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret
Function at 0x14003eea0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.14001c160
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.14003e160
mov rcx, rdi
mov rsi, rax
call fcn.14003e160
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14003ef50
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.14001c160
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.14001c1f0
cmp rax, 0x3e8
ja 0x14003ef81
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003ef00
test rsi, rsi
je 0x14003ef5d
mov rcx, rsi
call case.0x14001d47b.0
test rbx, rbx
je 0x14003ef6a
mov rcx, rbx
call case.0x14001d47b.0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14003ef8e
mov rcx, rsi
call case.0x14001d47b.0
test rbx, rbx
je 0x14003ef9b
mov rcx, rbx
call case.0x14001d47b.0
mov eax, 1
jmp 0x14003ef6c
Function at 0x14003f500
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x14003f69e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14003f67e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x14003f56e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003f560
inc rbx
jmp 0x14003f570
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x14003f57d
lea ebp, [rax + 0xe]
jmp 0x14003f589
cmp eax, 0x17
jne 0x14003f621
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], 0
je 0x14003f621
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14003f621
cmp rax, rbp
jb 0x14003f621
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [section..data]
mov r14, rax
test rax, rax
je 0x14003f630
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x14003f60e
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x14003f61e
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x14003f550
jmp 0x14003f636
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x14003f650
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x14003f679
test rdi, rdi
je 0x14003f675
nop word [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [case.0x14001d47b.0]
mov rdi, rbx
test rbx, rbx
jne 0x14003f660
xor edi, edi
jmp 0x14003f68d
test rdi, rdi
jne 0x14003f68d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret

Function at 0x14003fb00
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
test rax, rax
je 0x14003fb36
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret