joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075680
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
movapd xmmword [rsp + 0x460], xmm7
movapd xmmword [rsp + 0x450], xmm6
mov qword [r9], 0
cmp qword [rcx], 0xffffffffffffffff
je 0x1400757c9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], r9
mov r15, qword [rsp + 0x4e0]
mov rsi, qword [sym.imp.WS2_32.dll_send]
mov r12, qword [sym.imp.WS2_32.dll_WSAGetLastError]
xorpd xmm6, xmm6
lea r13, [rsp + 0x40]
movsd xmm7, qword [0x1400db930]
jmp 0x1400756fd
call r12
mov ebp, eax
test ebp, ebp
jne 0x1400757e0
mov rcx, qword [r14]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call rsi
test eax, eax
jg 0x1400757d0
call r12
cmp eax, 0x2733
jne 0x1400757de
movsd xmm0, qword [r15]
ucomisd xmm0, xmm6
jne 0x140075732
jnp 0x1400757c2
mov rax, qword [r14]
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x248], 1
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 1
mov rcx, r15
call fcn.140076a70
ucomisd xmm0, xmm6
jae 0x140075770
xor eax, eax
jmp 0x140075795
cvttsd2si eax, xmm0
mov dword [rsp + 0x30], eax
cvttpd2dq xmm1, xmm0
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
mulsd xmm0, xmm7
cvttsd2si eax, xmm0
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor ebp, ebp
xor ecx, ecx
xor edx, edx
lea r8, [rsp + 0x248]
mov r9, r13
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x1400756f0
test eax, eax
jne 0x1400756f5
mov ebp, 0xffffffff
jmp 0x1400757e0
mov ebp, 0xfffffffe
jmp 0x1400757e0
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
xor ebp, ebp
jmp 0x1400757e0
mov ebp, eax
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x450]
movaps xmm7, xmmword [rsp + 0x460]
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140075810
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
movapd xmmword [rsp + 0x460], xmm7
movapd xmmword [rsp + 0x450], xmm6
mov qword [r9], 0
cmp qword [rcx], 0xffffffffffffffff
je 0x14007596b
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], r9
mov r15, qword [rsp + 0x4f0]
mov r12, qword [rsp + 0x4e0]
mov r13, qword [sym.imp.WS2_32.dll_sendto]
mov rsi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
xorpd xmm6, xmm6
movsd xmm7, qword [0x1400db938]
jmp 0x14007588c
call rsi
mov ebp, eax
test ebp, ebp
jne 0x140075982
mov rcx, qword [r14]
mov eax, dword [rsp + 0x4e8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call r13
test eax, eax
jg 0x140075972
call rsi
cmp eax, 0x2733
jne 0x140075980
movsd xmm0, qword [r15]
ucomisd xmm0, xmm6
jne 0x1400758d1
jnp 0x140075964
mov rax, qword [r14]
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x248], 1
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 1
mov rcx, r15
call fcn.140076a70
ucomisd xmm0, xmm6
jae 0x140075910
xor eax, eax
jmp 0x140075935
cvttsd2si eax, xmm0
mov dword [rsp + 0x30], eax
cvttpd2dq xmm1, xmm0
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
mulsd xmm0, xmm7
cvttsd2si eax, xmm0
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor ebp, ebp
xor ecx, ecx
xor edx, edx
lea r8, [rsp + 0x248]
lea r9, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x140075880
test eax, eax
jne 0x140075884
mov ebp, 0xffffffff
jmp 0x140075982
mov ebp, 0xfffffffe
jmp 0x140075982
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
xor ebp, ebp
jmp 0x140075982
mov ebp, eax
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x450]
movaps xmm7, xmmword [rsp + 0x460]
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400759b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
movapd xmmword [rsp + 0x250], xmm7
movapd xmmword [rsp + 0x240], xmm6
mov qword [r9], 0
cmp qword [rcx], 0xffffffffffffffff
je 0x140075b09
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x30], r9
mov r15, qword [rsp + 0x2d0]
xor ebp, ebp
mov rsi, qword [sym.imp.WS2_32.dll_recv]
mov r12, qword [sym.imp.WS2_32.dll_WSAGetLastError]
xorpd xmm6, xmm6
movsd xmm7, qword [0x1400db940]
jmp 0x140075a2f
call r12
mov r13d, eax
test r13d, r13d
jne 0x140075b1e
mov rcx, qword [r14]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call rsi
test eax, eax
jg 0x140075b11
je 0x140075b09
call r12
cmp eax, 0x2733
je 0x140075a74
mov r13d, eax
cmp eax, 0x2746
jne 0x140075b1e
cmp ebp, 0x2746
mov ebp, 0x2746
je 0x140075b1e
movsd xmm0, qword [r15]
ucomisd xmm0, xmm6
jne 0x140075a85
jnp 0x140075b01
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov rcx, r15
call fcn.140076a70
ucomisd xmm0, xmm6
jae 0x140075ab0
xor eax, eax
jmp 0x140075ad5
cvttsd2si eax, xmm0
mov dword [rsp + 0x28], eax
cvttpd2dq xmm1, xmm0
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
mulsd xmm0, xmm7
cvttsd2si eax, xmm0
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
xor r13d, r13d
xor ecx, ecx
lea rdx, [rsp + 0x38]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x140075a20
test eax, eax
jne 0x140075a26
mov r13d, 0xffffffff
jmp 0x140075b1e
mov r13d, 0xfffffffe
jmp 0x140075b1e
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
xor r13d, r13d
mov eax, r13d
movaps xmm6, xmmword [rsp + 0x240]
movaps xmm7, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140075b50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
movapd xmmword [rsp + 0x260], xmm7
movapd xmmword [rsp + 0x250], xmm6
mov qword [r9], 0
cmp qword [rcx], 0xffffffffffffffff
je 0x140075cb9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], r9
mov r15, qword [rsp + 0x2f0]
xor r12d, r12d
mov rbp, qword [sym.imp.WS2_32.dll_recvfrom]
mov rsi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
xorpd xmm6, xmm6
movsd xmm7, qword [0x1400db948]
jmp 0x140075bce
call rsi
mov r13d, eax
test r13d, r13d
jne 0x140075cce
mov rcx, qword [r14]
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call rbp
test eax, eax
jg 0x140075cc1
je 0x140075cb9
call rsi
cmp eax, 0x2733
je 0x140075c2e
mov r13d, eax
cmp eax, 0x2746
jne 0x140075cce
cmp r12d, 0x2746
mov r12d, 0x2746
je 0x140075cce
movsd xmm0, qword [r15]
ucomisd xmm0, xmm6
jne 0x140075c3b
jnp 0x140075cb1
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 1
mov rcx, r15
call fcn.140076a70
ucomisd xmm0, xmm6
jae 0x140075c60
xor eax, eax
jmp 0x140075c85
cvttsd2si eax, xmm0
mov dword [rsp + 0x38], eax
cvttpd2dq xmm1, xmm0
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
mulsd xmm0, xmm7
cvttsd2si eax, xmm0
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r13d, r13d
xor ecx, ecx
lea rdx, [rsp + 0x48]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x140075bc0
test eax, eax
jne 0x140075bc5
mov r13d, 0xffffffff
jmp 0x140075cce
mov r13d, 0xfffffffe
jmp 0x140075cce
mov eax, eax
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
xor r13d, r13d
mov eax, r13d
movaps xmm6, xmmword [rsp + 0x250]
movaps xmm7, xmmword [rsp + 0x260]
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140075d30
Capabilities:
Resolve dns

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsi], rax
test rax, rax
je 0x140075d4e
xor eax, eax
add rsp, 0x20
pop rsi
ret
add rsp, 0x20
pop rsi
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]

Function at 0x140077a70
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call fcn.140075320
mov ecx, eax
call fcn.1400760b0
mov rsi, rax
cmp ebx, 0x17
jne 0x140077abe
test rsi, rsi
jne 0x140077abe
mov dword [rsp + 0x2c], 1
mov rcx, qword [rdi]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x2c]
mov edx, 0x29
mov r8d, 0x1b
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140077b30
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm6
mov r10, r9
mov rax, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rsp + 0xc8]
mov qword [rsp + 0x30], 0
mov r13d, dword [rdx]
lea r9, [rsp + 0x30]
mov rcx, rax
mov rdx, r10
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
call fcn.1400761e0
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x140077b9c
mov r12, rax
test rbx, rbx
je 0x140077c94
mov rcx, rbx
jmp 0x140077c8e
test rbx, rbx
je 0x140077c86
mov r14, qword [rsp + 0xc0]
lea r15, [rsp + 0x3c]
xorpd xmm6, xmm6
jmp 0x140077bd2
test r12, r12
je 0x140077c3e
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140077c89
mov rcx, r14
call fcn.140076d20
cmp r13d, dword [rbx + 4]
jne 0x140077be6
cmp qword [rdi], 0xffffffffffffffff
jne 0x140077c4a
mov rcx, rdi
call fcn.140075220
mov ebp, dword [rbx + 4]
mov r8d, dword [rbx + 8]
mov r9d, dword [rbx + 0xc]
mov rcx, rdi
mov edx, ebp
call fcn.140075320
mov ecx, eax
call fcn.1400760b0
mov r12, rax
cmp ebp, 0x17
jne 0x140077bc0
test r12, r12
jne 0x140077bc0
mov dword [rsp + 0x3c], 1
mov rcx, qword [rdi]
mov dword [rsp + 0x20], 4
mov edx, 0x29
mov r8d, 0x1b
mov r9, r15
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r13d, dword [rbx + 4]
mov rcx, rdi
call fcn.1400752f0
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
mov r9, r14
call fcn.140075360
mov ecx, eax
call fcn.1400760b0
mov r12, rax
test rax, rax
je 0x140077c81
movsd xmm0, qword [r14]
ucomisd xmm0, xmm6
jne 0x140077bc5
jp 0x140077bc5
mov dword [rsi], r13d
jmp 0x140077c89
xor r12d, r12d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, r12
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140077d10
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r12d, dword [rdx]
lea rdx, [0x1400dc094]
mov rcx, r8
call sub.msvcrt.dll_strcmp
xor ecx, ecx
test eax, eax
cmovne rcx, r14
test rbx, rbx
lea rdx, [0x1400dc096]
cmovne rdx, rbx
lea r9, [rsp + 0x28]
mov r8, r15
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
call fcn.1400761e0
mov rbx, qword [rsp + 0x28]
test rax, rax
je 0x140077d98
mov r15, rax
test rbx, rbx
je 0x140077e64
mov rcx, rbx
jmp 0x140077e5e
test rbx, rbx
je 0x140077e56
lea r14, [rsp + 0x34]
mov r13, qword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x140077dc2
test r15, r15
je 0x140077e23
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140077e59
cmp r12d, dword [rbx + 4]
jne 0x140077dce
cmp qword [rsi], 0xffffffffffffffff
jne 0x140077e27
mov rcx, rsi
call fcn.140075220
mov ebp, dword [rbx + 4]
mov r8d, dword [rbx + 8]
mov r9d, dword [rbx + 0xc]
mov rcx, rsi
mov edx, ebp
call fcn.140075320
mov ecx, eax
call fcn.1400760b0
mov r15, rax
cmp ebp, 0x17
jne 0x140077db0
test r15, r15
jne 0x140077db0
mov dword [rsp + 0x34], 1
mov rcx, qword [rsi]
mov dword [rsp + 0x20], 4
mov edx, 0x29
mov r8d, 0x1b
mov r9, r14
call r13
mov r12d, dword [rbx + 4]
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
call fcn.140075420
mov ecx, eax
call fcn.1400760b0
test rax, rax
je 0x140077e4b
mov r15, rax
jmp 0x140077db5
mov dword [rdi], r12d
mov rcx, rsi
call fcn.1400752f0
xor r15d, r15d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, r15
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140080580
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x1400f9a14]
test eax, eax
jle 0x1400805e9
mov rcx, qword [0x1400fa340]
lea rdx, [rax*8]
lea rdx, [rdx + rdx*4]
xor r8d, r8d
jmp 0x1400805c9
add r8, 0x28
cmp rdx, r8
je 0x1400805eb
mov r9, qword [rcx + r8 + 0x18]
cmp r9, rsi
ja 0x1400805c0
mov r10, qword [rcx + r8 + 0x20]
mov r10d, dword [r10 + 8]
add r9, r10
cmp r9, rsi
jbe 0x1400805c0
jmp 0x140080712
xor eax, eax
mov rcx, qword [0x1400970a8]
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x14008072d
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14008072d
add rcx, rdx
movzx edx, word [rcx + 0x18]
cmp edx, 0x20b
jne 0x14008072d
movzx edx, word [rcx + 6]
test edx, edx
je 0x14008072d
mov r8, rsi
sub r8, qword [0x1400970a8]
movzx r9d, word [rcx + 0x14]
lea r15, [rcx + r9]
add r15, 0x18
jmp 0x14008065d
add r15, 0x28
add edx, 0xffffffff
je 0x14008072d
mov ecx, dword [r15 + 0xc]
cmp r8, rcx
jb 0x140080650
mov r9d, dword [r15 + 8]
add r9d, ecx
cmp r8, r9
jae 0x140080650
mov rdx, qword [0x1400fa340]
lea r14, [rax + rax*4]
mov qword [rdx + r14*8 + 0x20], r15
mov dword [rdx + r14*8], 0
add rcx, qword [0x1400970a8]
mov qword [rdx + r14*8 + 0x18], rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14008073c
mov eax, dword [rsp + 0x44]
cmp eax, 7
jle 0x1400806cc
cmp eax, 8
je 0x14008070b
cmp eax, 0x40
je 0x14008070b
cmp eax, 0x80
je 0x14008070b
jmp 0x1400806dc
mov r8d, 4
cmp eax, 2
je 0x1400806e2
cmp eax, 4
je 0x14008070b
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rax, qword [0x1400fa340]
lea r9, [rax + r14*8]
mov qword [rax + r14*8 + 8], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rax + r14*8 + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140080758
add dword [0x1400f9a14], 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.1400176a0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.140080770
mov edx, dword [r15 + 8]
mov rax, qword [0x1400fa340]
mov r8, qword [rax + r14*8 + 0x18]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.140080770
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140080770
int3
Function at 0x140081200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
call sub.msvcrt.dll__errno
mov dword [rax], 0
test rsi, rsi
je 0x140081243
cmp byte [rsi], 0
je 0x140081233
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140081253
test al, 0x10
jne 0x140081263
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
jmp 0x140081329
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x140081329
call sub.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x140081329
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rdi
mov rdx, rsi
call sub.msvcrt.dll__fullpath
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14008131e
mov rsi, rax
lea rdi, [rax + 0x244]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.msvcrt.dll_strcpy
cmp byte [rsi + 0x244], 0
je 0x1400812de
mov rcx, rdi
call sub.msvcrt.dll_strlen
movzx eax, byte [rax + rsi + 0x243]
cmp eax, 0x2f
je 0x1400812de
cmp eax, 0x5c
je 0x1400812de
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov word [rdi + rax], 0x5c
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov word [rsi + rax + 0x244], 0x2a
mov qword [rsi + 0x238], 0xffffffffffffffff
mov dword [rsi + 0x240], 0
mov rcx, rsi
add rcx, 0x128
mov r8d, 0x10c
xor edx, edx
call fcn.1400175c0
jmp 0x14008132b
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
xor esi, esi
mov rax, rsi
add rsp, 0x128
pop rdi
pop rsi
ret
Function at 0x14000bf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000bf90
cmp r11, r10
ja 0x14000c006
cmp r10, rdx
ja 0x14000c018
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000bf92
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000bf70
jmp 0x14000bff4
ja 0x14000bf9a
mov r11, r10
cmp rax, r8
jne 0x14000bf34
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000bfd0
mov rdi, r8
sub ecx, edx
jns 0x14000bfeb
jmp 0x14000bff6
cmp r8, rsi
je 0x14000c027
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000bff6
xor al, 1
cmp rdi, rsi
jne 0x14000bfb0
jmp 0x14000bff6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400a3d40
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400a3ab0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400a3f20
int3

Function at 0x140013916
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14001393c
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140013926
mov qword [rcx], rax
ret
Function at 0x140027112
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf0
in al, dx
lock add byte [rax], al
add byte [rcx - 0x77], cl
invalid
mov rsi, rcx
mov ecx, 0x18

Function at 0x140028ca8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsp
Function at 0x14005f365
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6b8
mov r15, r8
mov rbp, rdx
mov qword [rsp + 0x80], rcx
mov rdx, qword [rdx + 0x400]
add rdx, 0x10
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.140016dfa
cmp qword [rsi], 0
jne 0x140060e9f
mov rcx, qword [rsp + 0x168]
mov dl, byte [rsp + 0x170]
mov rax, qword [rcx + 0x28]
or rax, qword [rcx + 0x38]
je 0x14005f3cb
call fcn.140099af8
jmp 0x14005f3f4
mov rsi, qword [rcx + 0x230]
call fcn.140099af8
cmp rsi, 1
ja 0x14005f3f4
mov rdx, qword [rbp + 0x400]
add rdx, 0x10
lea rcx, [rbp + 0x3a0]
call fcn.14006f45e
mov rax, qword [rbp + 0x378]
cmp rax, 2
mov qword [rsp + 0x68], r15
jne 0x14005f414
mov qword [rsp + 0x160], 2
jmp 0x14005f479
lea rsi, [rbp + 0x378]
lea rdx, [rbp + 0x390]
test rax, rax
je 0x14005f449
mov rcx, qword [rbp + 0x380]
mov rax, qword [rbp + 0x388]
mov r8, qword [rax + 0x10]
dec r8
and r8, 0xfffffffffffffff0
add rcx, r8
add rcx, 0x10
jmp 0x14005f457
mov rcx, qword [rbp + 0x380]
mov rax, qword [rbp + 0x388]
call qword [rax + 0x70]
mov r14, rax
lea r15, [rsp + 0x160]
mov rcx, r15
mov rdx, rsi
call fcn.14009b52d
mov qword [r15 + 0x18], r14
mov r15, qword [rsp + 0x68]
mov rax, qword [rbp + 0x398]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x168]
movups xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x450], xmm0
mov qword [rsp + 0x440], rcx
mov qword [rsp + 0x448], rdx
mov qword [rsp + 0x460], rax
cmp dword [rsp + 0x440], 2
je 0x14005f4d7
lea rdx, [rsp + 0x458]
lea rcx, [rsp + 0x440]
call fcn.14009b55e
mov qword [rsp + 0x5c8], 2
and qword [rsp + 0x5e8], 0
lea rax, [rbp + 0x410]
mov qword [rsp + 0x2a8], rax
lea r13, [rbp + 0x48]
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x2b0], rax
lea r14, [rsp + 0x2b8]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x60], rbp
mov rax, qword [rsp + 0x168]
mov cl, byte [rsp + 0x170]
add dword [rax], eax
add byte [rbp + rcx*4 - 0x7c], cl
and al, 0xf0
add al, byte [rax]
add byte [rcx - 0x77], cl
add byte [rcx - 0x78], al
or byte [rax - 0x73], cl
add eax, 0x76bec
Function at 0x140068aff
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x70]
lea r9, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.140068a36
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140068bd7
test eax, eax
je 0x140068bf3
cmp eax, 0x90317
je 0x140068c5f
cmp eax, 0x90321
jne 0x140068c67
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140068aa9
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x140068c75
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x140068c63
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x40]
and qword [rdi + 0x50], 0
call fcn.140068c89
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14009b698
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140068aa9
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x140068c75
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140068c75
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret