joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401fabb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140340060]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1401fac21
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1401fac57
test eax, eax
js 0x1401fac32
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401fac4a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1403400c8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401f9970
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1401f8c50
mov ecx, 7
int 0x29
ud2

Function at 0x1401fb5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14026d160]
test ecx, ecx
je 0x1401fb5cd
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1401fb5e6
cmp qword [rax + 8], 0
je 0x1401fb5e6
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14026d148]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x1401fb5bc
mov ecx, dword [0x14026d160]
test ecx, ecx
je 0x1401fb691
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1401fb6ae
mov rsi, rax
test rax, rax
jne 0x1401fb673
movzx eax, byte [0x14037f348]
mov rcx, qword [0x14037f2d0]
test rcx, rcx
jne 0x1401fb638
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401fb6c6
mov rcx, rax
mov qword [0x14037f2d0], rax
mov r8d, 0x20
xor edx, edx
call fcn.1402699c4
test rax, rax
je 0x1401fb6c6
mov rsi, rax
lea rax, [0x14026d148]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14026d160]
test ecx, ecx
je 0x1401fb6b6
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14026d148]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x1401fb605
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14026d148]
call fcn.1401f9570
mov ecx, eax
jmp 0x1401fb66b
mov ecx, 8
mov edx, 0x20
call fcn.140054b50
int3
Function at 0x1401fd250
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x1401fd2d0
jmp 0x1401fd2bf
jae 0x1401fd375
cmp r8, 0x201
jae 0x1401fd2d0
mov r15d, 0x200
lea r12, [rsp + 0x68]
mov r13, r8
jmp 0x1401fd317
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x1401fd2f7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.1401454a0
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, r14
mov r12, qword [rsp + 0x20]
mov r13, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r13d
mov rdx, r12
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x1401fd33c
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1401fd3ce
mov r8d, ebp
cmp r13, r8
jne 0x1401fd2b0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401fd3f8
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x1401fd2bf
jmp 0x1401fd2d0
cmp r15, r8
jb 0x1401fd412
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1401fdc40
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x1401fd3b9
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, qword [rsp + 0x20]
call fcn.1402699cc
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
test rdi, rdi
jne 0x1401fd3a6
jmp 0x1401fd3b9
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400a7990
jmp 0x1401fd427
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400a75f0
ud2
Function at 0x1402011b0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.14021a160
mov rdi, rdx
test rax, rax
je 0x140201240
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.140013140
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14021a3b0
cmp dword [rsp + 0x38], 2
jne 0x14020126f
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1402012bb
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x1402012e7
lea rcx, [rsp + 0x88]
call fcn.140013140
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x140201345
mov qword [rsp + 0x80], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1402013c1
mov rbx, qword [rsp + 0x80]
jmp 0x140201347
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1402013b0
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x1402013b0
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x1402013ed
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x1402013ed
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140013140
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
jmp 0x14020122f
Function at 0x14021b440
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.1401fb970
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
jne 0x14021b48f
lea rcx, [rsp + 0xb0]
call fcn.140013140
mov qword [rsi], rdi
jmp 0x14021b654
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x14021b520
jmp 0x14021b4ff
jae 0x14021b5cb
cmp r8, 0x201
jae 0x14021b520
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x14021b567
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x14021b547
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1401454a0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x14021b592
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x14021b684
mov r8d, r15d
cmp r12, r8
jne 0x14021b4f0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x14021b6b8
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x14021b4ff
jmp 0x14021b520
cmp rdi, r8
jb 0x14021b6d2
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.1401fdc40
movabs rdi, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x14021b625
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, qword [rsp + 0x28]
call fcn.1402699cc
cmp qword [rsp + 0x60], rdi
jne 0x14021b669
mov qword [rsi], rdi
lea rcx, [rsp + 0x68]
call fcn.140013140
cmp qword [rsp + 0x40], 0
je 0x14021b654
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.1402699cc
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x14021b641
jmp 0x14021b654
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x60], rdi
mov rsi, qword [rsp + 0x38]
test rbx, rbx
jne 0x14021b612
jmp 0x14021b625
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400a7990
jmp 0x14021b6e7
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.1400a75f0
ud2
Function at 0x14021d0b0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x20]
call fcn.1401fb970
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
cmp rax, rdi
je 0x14021d166
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
call fcn.14021a4c0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rbx, rdi
je 0x14021d166
mov rcx, rsi
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x14021d13e
test rbx, rbx
je 0x14021d13a
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, rsi
call fcn.1402699cc
xor esi, esi
jmp 0x14021d166
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
je 0x14021d163
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, rsi
call fcn.1402699cc
mov rsi, rdi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14021f580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14026d1c0]
test ecx, ecx
je 0x14021f5b0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14021f5c9
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14021f5c9
add rdi, 0x10
jmp 0x14021f6aa
lea rcx, [0x14026d1a8]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14021f59d
mov ecx, dword [0x14026d1c0]
test ecx, ecx
je 0x14021f68b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14021f6a8
mov rsi, rax
test rax, rax
jne 0x14021f65a
movzx eax, byte [0x14037f348]
mov rcx, qword [0x14037f2d0]
test rcx, rcx
jne 0x14021f61b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14021f6c4
mov rcx, rax
mov qword [0x14037f2d0], rax
mov r8d, 0x18
xor edx, edx
call fcn.1402699c4
test rax, rax
je 0x14021f6c4
mov rsi, rax
lea rax, [0x14026d1a8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14026d1c0]
test ecx, ecx
je 0x14021f6b4
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14021f6aa
test rcx, rcx
je 0x14021f6aa
lock dec qword [rcx]
jne 0x14021f6aa
call fcn.14024b410
jmp 0x14021f6aa
lea rcx, [0x14026d1a8]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14021f5e8
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14026d1a8]
call fcn.1401f9570
mov ecx, eax
jmp 0x14021f652
mov ecx, 8
mov edx, 0x18
call fcn.140054b50
int3
Function at 0x14021ff50
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x14037f2d8]
cmp rax, 3
jne 0x14022010b
cmp rbx, 0x17f
ja 0x14022011d
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x60], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x14021ffc8
xor edx, edx
nop
cmp byte [rsp + rdx + 0x60], 0
je 0x140220074
inc rdx
cmp rax, rdx
jne 0x14021ffb0
jmp 0x1402200d2
lea rcx, [rsp + 0x67]
and rcx, 0xfffffffffffffff8
sub rcx, r15
je 0x14021fffe
je 0x14021fffe
xor edx, edx
nop word [rax + rax]
cmp byte [rsp + rdx + 0x60], 0
je 0x140220074
inc rdx
cmp rcx, rdx
jne 0x14021ffe0
lea rdx, [rbx - 0xf]
cmp rcx, rdx
jbe 0x140220004
jmp 0x14022004e
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x1402764c0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rsp + rcx + 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x14022004e
add rcx, 0x10
cmp rcx, rdx
jbe 0x140220020
sub rax, rcx
je 0x1402200d2
lea r8, [rsp + rcx]
add r8, 0x60
xor edx, edx
nop dword [rax]
cmp byte [r8 + rdx], 0
je 0x140220071
inc rdx
cmp rax, rdx
jne 0x140220060
jmp 0x1402200d2
add rdx, rcx
cmp rdx, rbx
jne 0x1402200d2
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1402200e6
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1402200f9
lea rax, [0x14033f458]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1402200fc
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140220640
cmp rbx, 0x17f
jbe 0x14021ff8a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1402206b0
Function at 0x1402206b0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r15, r8
inc r15
sete bpl
je 0x140220929
js 0x140220941
mov ebx, r9d
mov rdi, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x14037f348]
mov rcx, qword [0x14037f2d0]
test rcx, rcx
jne 0x14022070b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14022091c
mov rcx, rax
mov qword [0x14037f2d0], rax
xor edx, edx
mov r8, r15
call fcn.1402699c4
test rax, rax
je 0x14022091c
mov r14, rax
mov rcx, rax
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
cmp rdi, 0x10
jae 0x140220758
test rdi, rdi
je 0x14022080f
xor eax, eax
cmp byte [r12 + rax], 0
je 0x140220830
inc rax
cmp rdi, rax
jne 0x140220740
jmp 0x14022080f
lea rax, [r12 + 7]
and rax, 0xfffffffffffffff8
sub rax, r12
je 0x14022079e
cmp rax, rdi
cmovae rax, rdi
test rax, rax
je 0x14022079e
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r12 + rcx], 0
je 0x140220830
inc rcx
cmp rax, rcx
jne 0x140220780
lea rcx, [rdi - 0x10]
cmp rax, rcx
jbe 0x1402207a4
jmp 0x1402207ee
lea rcx, [rdi - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x1402764d0]
movabs rdx, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r12 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x1402207ee
add rax, 0x10
cmp rax, rcx
jbe 0x1402207c0
cmp rax, rdi
je 0x14022080f
nop word cs:[rax + rax]
cmp byte [r12 + rax], 0
je 0x140220830
inc rax
cmp rdi, rax
jne 0x140220800
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
call fcn.140054d10
mov r14, rax
mov rdi, rdx
jmp 0x140220843
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x1402208e6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov rcx, r14
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1402208a6
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [r14], 0
test rdi, rdi
jne 0x1402208c5
jmp 0x1402208d6
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [r14], 0
test rdi, rdi
je 0x1402208d6
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, r14
call fcn.1402699cc
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [0x14033f458]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test bpl, bpl
jne 0x1402208d6
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, r14
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1402699cc
mov ecx, 1
mov rdx, r15
call fcn.140054b50
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.library_alloc_src_ffic_str.rs
mov edx, 0x2b
call fcn.1400a7990
call fcn.140054b10
int3
Function at 0x140221500
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x140221536
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.14021c1e0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
ud2

Function at 0x1402246f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x14022471b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x14037f2d8]
cmp rax, 3
jne 0x140224897
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140224790
cmp word [rbx], 0
je 0x140224806
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x14022481b
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x1402247aa
mov r14d, eax
cmp eax, 0x2726
jne 0x140224886
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14022487e
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x140224768
call sub.kernel32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x140224886
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x34], r9w
mov word [rsp + 0x36], cx
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], edx
lea rdx, [rsp + 0x34]
mov rcx, rdi
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
je 0x140224859
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x140224710
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x140224710
call sub.ws2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x140224709
call fcn.140220640
jmp 0x14022472c
Function at 0x1402248f0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14026d1e0]
test ecx, ecx
je 0x14022491d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140224936
cmp qword [rax + 8], 0
je 0x140224936
add rax, 0x10
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14026d1c8]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14022490c
mov ecx, dword [0x14026d1e0]
test ecx, ecx
je 0x140224a1d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140224a3a
mov rsi, rax
test rax, rax
jne 0x1402249cb
movzx eax, byte [0x14037f348]
mov rcx, qword [0x14037f2d0]
test rcx, rcx
jne 0x140224988
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140224a55
mov rcx, rax
mov qword [0x14037f2d0], rax
mov r8d, 0x20
xor edx, edx
call fcn.1402699c4
test rax, rax
je 0x140224a55
mov rsi, rax
lea rax, [0x14026d1c8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14026d1e0]
test ecx, ecx
je 0x140224a42
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1402249fb
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140224a03
call fcn.140221500
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14026d1c8]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140224955
xor eax, eax
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14026d1c8]
call fcn.1401f9570
mov ecx, eax
jmp 0x1402249c3
mov ecx, 8
mov edx, 0x20
call fcn.140054b50
int3