joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ca14
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ca14
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f340
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a348
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d6f0
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a348
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b0dc
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ca14
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018804
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ca14
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400062f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140007088]
test rax, rax
je 0x14000633a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000633a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000633a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000633a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000633a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000633c
xor al, al
add rsp, 0x28
ret
Function at 0x140012f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001315d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1400365e0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140012fb0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1400365f0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400130da
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x1400130b0
movdqa xmm1, xmmword [0x1400365f0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140036600], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14001317b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140012a30
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140013620
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140013692
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x140013658
add rdi, rbx
sub rsi, rbx
je 0x140013692
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x140013650
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x140013650
add ebp, 0x80000000
jmp 0x140013694
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140015ac0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140015b50
jmp 0x140015b3f
jae 0x140015c10
cmp r8, 0x201
jae 0x140015b50
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140015ba8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140015b7f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140031280
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140015bd1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140015c78
mov r8d, r14d
cmp r15, r8
jne 0x140015b30
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140015c9b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140015b3f
jmp 0x140015b50
cmp rsi, r8
jb 0x140015cb5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140018740
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140015c61
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140005610
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140015c49
jmp 0x140015c61
lea rcx, str.internal_error:_entered_unreachable_code_rustc_1c05d50c8403c56d9a8b6fb871f15aaa26fb5d07library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140031fc0
jmp 0x140015cca
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140032410
ud2
Function at 0x140015d20
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140021c50
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x140015ea6
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x140015de0
jmp 0x140015dcf
jae 0x140015eb8
cmp r8, 0x201
jae 0x140015de0
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x140015e38
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x140015e0f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.140031280
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140015e67
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140015f8b
mov r8d, esi
cmp r12, r8
jne 0x140015dc0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140015fb5
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140015dcf
jmp 0x140015de0
lea rcx, [rbp - 0x58]
call fcn.1400010a0
mov byte [rsi + 0x18], 2
jmp 0x140015f4a
cmp r15, r8
jb 0x140015fcf
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.140018740
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x140015f09
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140005610
cmp byte [rbp + 0x3d8], 2
jne 0x140015f61
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400010a0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x140015f4a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140005610
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x140015f35
jmp 0x140015f4a
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x140015ef1
jmp 0x140015f09
lea rcx, str.internal_error:_entered_unreachable_code_rustc_1c05d50c8403c56d9a8b6fb871f15aaa26fb5d07library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140031fc0
jmp 0x140015fe4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.140032410
ud2
Function at 0x14001fbe0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14003c918]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14001fc24
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001fc83
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14001fc92
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14001fcca
cmp eax, 0x103
je 0x14001fcd4
test eax, eax
js 0x14001fcaf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14001fcca
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14003c978]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400184a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140013e00
mov ecx, 7
int 0x29
ud2

Function at 0x14001fd40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14003c918]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14001fd84
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001fdea
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14001fe21
test eax, eax
js 0x14001fdfb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14001fe14
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14003c978]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400184a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140013e00
mov ecx, 7
int 0x29
ud2
Function at 0x14002ed90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002ee0a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002ee00
cmp r11, r10
ja 0x14002eea3
cmp r10, rdx
ja 0x14002eeb7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002ee02
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002ede0
jmp 0x14002ee77
ja 0x14002ee0a
mov r11, r10
cmp rax, r8
jne 0x14002edb2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002ee7b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002ee50
mov r8, r10
sub ecx, r9d
jns 0x14002ee6e
jmp 0x14002ee7d
cmp r10, rdx
je 0x14002ee89
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002ee7d
xor al, 1
cmp r8, rdx
jne 0x14002ee30
jmp 0x14002ee7d
xor eax, eax
jmp 0x14002ee7d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140031fc0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140032490
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140032410
ud2
Function at 0x140005f54
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rbx, rcx
mov byte [rcx], 0
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140005fe4
movzx ecx, word [rsp + 0x50]
cmp cl, 2
jne 0x140005fbb
shr cx, 8
cmp cl, 2
jne 0x140005fbb
mov byte [rbx], 1
mov rax, rbx
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14000bab0
add rsp, 0x200
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Invalid_WinSock_version
lea rcx, [rsp + 0x20]
call fcn.140006610
lea rdx, [0x140010718]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea r9, str.WSAStartup_failed
mov edx, eax
lea r8, section..data
lea rcx, [rsp + 0x20]
call fcn.140006794
lea rdx, [0x140010620]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14000616c
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test dl, dl
jne 0x140006180
mov ecx, 2
jmp 0x14000618a
cmp dl, 1
jne 0x1400061cb
mov ecx, reloc.WS2_32.dll_socket
mov edx, 1
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400061ee
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x140006220
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rdx, str.Unsupported_protocol
lea rcx, [rsp + 0x20]
call fcn.14000604c
lea rdx, [0x140010750]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea r9, str.Failed_to_create_socket
lea r8, section..data
lea rcx, [rsp + 0x20]
call fcn.140006794
lea rdx, [0x140010620]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rcx, rbx
call fcn.140007c40
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea r9, str.Failed_to_get_socket_flags
lea r8, section..data
lea rcx, [rsp + 0x20]
call fcn.140006794
lea rdx, [0x140010620]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14000712c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x14000717f
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140007144
jmp 0x14000718c
cmp dword [rcx], 0x4e0
jb 0x14000718c
call fcn.1400078a0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x140007334
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13d0
call fcn.14000ba50
sub rsp, rax
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
or dword [rsp + 0x13b4], 0xffffffff
mov edx, eax
mov dword [rsp + 0x34], eax
mov ecx, 1
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x34], edx
inc rcx
cmp rcx, r8
jb 0x140007389
xorps xmm0, xmm0
mov dword [rsp + 0x30], r8d
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
mov r8d, 0x24
and qword [rbx + 0x18], 0
mov dl, 0x20
mov rcx, rbx
call fcn.140002794
xor esi, esi
mov rdi, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400073d8
mov rdi, qword [rbx]
mov rcx, rbx
jb 0x1400073e0
mov rcx, qword [rbx]
mov rbp, qword [rbx + 0x10]
add rbp, rcx
jmp 0x140007426
cmp esi, 0x17
ja 0x1400073fc
mov eax, 0x842100
bt eax, esi
jae 0x1400073fc
mov al, 0x2d
jmp 0x14000741f
mov r9d, send
lea rdx, [rsp + 0x30]
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.140002d58
cmp eax, 0xa
jge 0x14000741d
add al, 0x30
jmp 0x14000741f
add al, 0x57
inc esi
mov byte [rdi], al
inc rdi
cmp rdi, rbp
jne 0x1400073e9
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.14000bab0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000758c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400075fb
cmp byte [rcx + 0x71], 0
je 0x1400075fb
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007650
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007615
sub eax, 1
je 0x140007619
cmp eax, 2
jne 0x140007650
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000bab0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140007647
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140007650
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400075fd
xor al, al
jmp 0x1400075fd