joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba880
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x251]
test eax, eax
je 0x1400ba8c0
cmp eax, 3
jne 0x1400bb031
mov rdx, qword [rsi + 0x240]
mov r9, qword [rsi + 0x248]
jmp 0x1400baaec
movups xmm0, xmmword [rsi + 0x70]
movups xmmword [rsi + 0x148], xmm0
movups xmm0, xmmword [rsi + 0x60]
movups xmmword [rsi + 0x138], xmm0
movups xmm0, xmmword [rsi + 0x50]
movups xmmword [rsi + 0x128], xmm0
movups xmm0, xmmword [rsi + 0x40]
movups xmmword [rsi + 0x118], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
movups xmmword [rsi + 0x108], xmm3
movups xmmword [rsi + 0xf8], xmm2
movups xmmword [rsi + 0xe8], xmm1
movups xmmword [rsi + 0xd8], xmm0
movups xmm0, xmmword [rsi + 0x80]
movups xmmword [rsi + 0x158], xmm0
movups xmm0, xmmword [rsi + 0x90]
movups xmmword [rsi + 0x168], xmm0
movups xmm0, xmmword [rsi + 0xa0]
movups xmmword [rsi + 0x178], xmm0
movups xmm0, xmmword [rsi + 0xb0]
movups xmmword [rsi + 0x188], xmm0
movups xmm0, xmmword [rsi + 0xc0]
movups xmmword [rsi + 0x198], xmm0
mov rax, qword [rsi + 0xd0]
mov qword [rsi + 0x1a8], rax
movzx eax, byte [rsi + 0x250]
mov byte [rsi + 0x252], al
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmmword [rsi + 0x1b0], xmm2
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x1c0], rax
movups xmmword [rsi + 0x1c8], xmm0
movups xmmword [rsi + 0x1d8], xmm1
mov rax, qword [rsi + 0x1b0]
lock inc qword [rax]
jle 0x1400bb02f
mov rcx, qword [rsi + 0x1b8]
mov rdx, qword [rsi + 0x1c0]
lock inc qword [rcx]
jle 0x1400bb02f
lea r15, [rsi + 0x158]
lea r14, [rsi + 0x1c8]
lea rbx, [rsi + 0x1e8]
mov qword [rsi + 0x1e8], rax
mov qword [rsi + 0x1f0], rcx
mov qword [rsi + 0x1f8], rdx
cmp byte [rsi + 0x151], 0
jne 0x1400baa0b
movzx eax, byte [r15]
test al, 1
jne 0x1400baf70
cmp byte [rsi + 0x159], 0
ud2
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.12.9_srcconnect.rs
call fcn.1400f8620

Function at 0x1400bdfa0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0x1cc]
mov qword [rsp + 0x130], rax
lea rbx, [rdx + 0x10]
lea rax, [rdx + 0x1e8]
mov qword [rsp + 0x108], rax
xorps xmm6, xmm6
xor r14d, r14d

Function at 0x1400bf950
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
mov rdi, rdx
mov qword [rsp + 0x68], rcx
lea rax, [rdx + 0xa4]
mov qword [rsp + 0x118], rax
lea rax, [rdx + 0xc0]
mov qword [rsp + 0x148], rax
lea rax, [rdx + 0xe8]
mov qword [rsp + 0xf8], rax
xorps xmm6, xmm6
xor r14d, r14d
movabs r13, 0xd00000003
Function at 0x1400c2d60
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400c2d70
test al, 1
je 0x1400c2e3b
test al, 2
jne 0x1400c2e53
test al, 8
jne 0x1400c2daa
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 2
lea rdx, [rsp + 0x28]
call fcn.1400c2bb0
jmp 0x1400c2dc2
test al, 0x10
je 0x1400c2dc2
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x1400c2ed7
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400c2df3
mov r8, qword [rsi + 0x78]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e2520
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400c2e6b
jne 0x1400c2e31
mov rcx, rsi
call fcn.14008b330
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140142e70]
mov edx, 0x23
call fcn.1400f8090
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140142eb0]
mov edx, 0x25
call fcn.1400f8090
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140009b10]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x140142ef8]
lea rcx, [rsp + 0x28]
call fcn.1400f8050
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x28]
call fcn.1400f8050
int3
Function at 0x1400cd850
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400cd875
cmp rax, rcx
je 0x1400cd87b
cmp rdx, 4
jae 0x1400cd87f
xor eax, eax
xor r8d, r8d
jmp 0x1400cd910
pop rbp
jmp fcn.140009ed0
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400ff670]
movdqa xmm3, xmmword [0x1400ff680]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400cd8a0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400cd927
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400cd910
pop rbp
ret
Function at 0x1400cdb70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov eax, dword [rdx + 0x24]
test al, 0x10
jne 0x1400cdbcd
test al, 0x20
jne 0x1400cdc18
movzx eax, byte [rcx]
cmp rax, 0x64
jb 0x1400cdc98
movzx ecx, al
lea r8d, [rcx + rcx*4]
lea r8d, [rcx + r8*8]
shr r8d, 0xc
imul ecx, r8d, 0x64
sub al, cl
movzx eax, al
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899_bw
movzx eax, word [rcx + rax*2]
mov word [rbp - 0x4f], ax
xor ecx, ecx
mov eax, r8d
jmp 0x1400cdca1
movzx eax, byte [rcx]
mov r9d, 0x81
mov r8d, eax
nop dword [rax]
mov rcx, r9
shr r8b, 4
mov r9d, eax
and r9b, 0xf
lea r10d, [r9 + 0x30]
lea r11d, [r9 + 0x57]
cmp r9b, 0xa
movzx r9d, r10b
movzx r10d, r11b
cmovb r10d, r9d
mov byte [rbp + rcx - 0x52], r10b
lea r9, [rcx - 1]
cmp al, 0xf
mov eax, r8d
ja 0x1400cdbe0
jmp 0x1400cdc66
movzx eax, byte [rcx]
mov r9d, 0x81
mov r8d, eax
nop word cs:[rax + rax]
mov rcx, r9
shr r8b, 4
mov r9d, eax
and r9b, 0xf
lea r10d, [r9 + 0x30]
lea r11d, [r9 + 0x37]
cmp r9b, 0xa
movzx r9d, r10b
movzx r10d, r11b
cmovb r10d, r9d
mov byte [rbp + rcx - 0x52], r10b
lea r9, [rcx - 1]
cmp al, 0xf
mov eax, r8d
ja 0x1400cdc30
add rcx, 0xfffffffffffffffe
lea rax, [rcx + rbp]
add rax, 0xffffffffffffffb0
mov ecx, 0x81
sub rcx, r9
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [0x140146070]
mov r9d, 2
mov rcx, rdx
mov dl, 1
jmp 0x1400cdce1
mov ecx, 2
cmp al, 0xa
jae 0x1400cdca9
or al, 0x30
mov byte [rbp + rcx - 0x50], al
jmp 0x1400cdcbd
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899_bw
movzx eax, word [rcx + rax*2]
mov word [rbp - 0x4f], ax
mov ecx, 1
lea rax, [rcx + rbp]
add rax, 0xffffffffffffffb0
xor rcx, 3
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, rdx
mov dl, 1
xor r9d, r9d
call fcn.140009c30
nop
add rsp, 0xb0
pop rbp
ret
Function at 0x1400d0f70
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov rdi, rcx
xor r15d, r15d
cmp r15, qword [rcx + 0x30]
jo 0x1400d0fd1
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400d0fd1
mov rcx, qword [rdi + 0x38]
xor r15d, r15d
lea rdx, [0x14014a0f8]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx + r8]
or r15d, dword [rdx + r9*4]
inc r8
cmp rax, r8
jne 0x1400d0fc0
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xa0], 4
mov dword [rsp + 0xe8], 0x400010
mov dword [rsp + 0xd8], r15d
mov r12, qword [rdi + 0x10]
lea rbx, [r12*8]
xor ecx, ecx
mov rax, r12
shr rax, 0x3d
jne 0x1400d135b
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
ja 0x1400d135b
mov r13, qword [rdi + 8]
xor ebp, ebp
test rbx, rbx
je 0x1400d1075
movzx eax, byte [0x1401542b0]
xor ecx, ecx
mov esi, 8
xor r14d, r14d
test r12, r12
je 0x1400d1143
Function at 0x1400d1e50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
lea rdi, str.127.0.0.1:34254could_not_resolve_to_any_addresses
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x30]
call fcn.14000bcf0
test al, 1
je 0x1400d201e
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x1400d2019
mov rcx, qword [rsp + 0x30]
lea rdx, [rsi - 1]
movzx r8d, byte [rcx]
inc rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
cmp r8b, 0x3a
jne 0x1400d2019
mov rbx, rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0xa
mov byte [rsp + 0x6c], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
call fcn.14000c480
cmp ax, 1
jne 0x1400d2019
movabs rcx, 0xffffffff00
mov rax, rbx
and rax, rcx
shr rax, 8
movzx ecx, dx
shl rcx, 0x30
shl rax, 0x10
or rax, rcx
mov ecx, 1
or rcx, rax
cmp cx, 1
jne 0x1400d202f
cmp qword [rsp + 0x38], 0
jne 0x1400d2044
mov rdi, rax
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0xd4]
mov qword [rsp + 0x98], rax
movzx eax, byte [0x1401542b0]
mov edx, 0x20
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je case.0x1400b3498.228
mov rsi, rax
mov word [rax], 0
mov rax, rdi
shr rax, 0x10
and rax, 0xffffffffffffff00
mov ecx, edi
shr ecx, 0x10
movzx ecx, cl
or rcx, rax
shr rdi, 0x30
mov word [rsi + 6], di
mov dword [rsi + 2], ecx
mov rax, qword [rsp + 0x98]
mov qword [rsi + 8], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsi + 0x10], eax
mov dword [rsi + 0x14], 0
mov rax, rsi
add rax, 0x20
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 1
mov qword [rsp + 0xc0], rax
mov rax, rsi
xor edi, edi
jmp 0x1400d2158
mov qword [rsp + 0x38], rsi
xor eax, eax
xor ecx, ecx
or rcx, rax
cmp cx, 1
je 0x1400d1f22
movzx eax, cx
test eax, eax
jne 0x1400d2044
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x80], 1
movabs rax, 0x3a0000003a
mov qword [rsp + 0x78], rax
mov bl, 0x3a
mov r8d, 0xf
jmp 0x1400d2086
cmp r8, 0xf
ja 0x1400d20de
mov cl, 0x3a
mov rdx, rdi
call fcn.14000dd80
cmp rax, 1
jne 0x1400d20de
mov r8, rdx
cmp rdx, 0xf
jae 0x1400d2080
cmp byte [r8 + rdi], bl
jne 0x1400d2080
mov r9, r8
lea rsi, str.invalid_port_value
sub r9, 0xe
je 0x1400d20e5
lea rcx, [r8 + rdi]
inc rcx
cmp r8, 0xd
jne 0x1400d233a
movzx eax, byte [rcx]
cmp eax, 0x2b
je 0x1400d20e5
mov r9d, 1
cmp eax, 0x2d
je 0x1400d20e5
jmp 0x1400d23fd
lea rsi, str.invalid_socket_address
cmp byte [rcx], 0x2b
xor r12d, r12d
mov ecx, 4
mov edx, 0x20
call fcn.1400f7b90
int3
Function at 0x1400d78b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
xor r8d, r8d
xor eax, eax
jmp case.0x1400d7a9f.6
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x1400d791e
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]
cmp r10b, 1
ja 0x1400d791e
cmp al, 6
sete r11b
mov r10, qword [rdx]
mov rax, qword [rdx + 8]
test r9b, r9b
setne bl
xchg ebp, eax
ret
or bl, r11b
je 0x1400d7905
xor r11d, r11d
jmp 0x1400d7915
invalid
mov r11d, 2
xor eax, eax
test r9b, r9b
je 0x1400d7a8c
Function at 0x1400ddcb0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov eax, dword [0x140154230]
cmp eax, 3
jne 0x1400ddea8
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1400ddece
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x1400ddd48
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400dde04
inc rdx
cmp rax, rdx
jne 0x1400ddd30
jmp 0x1400dde69
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x1400ddd7e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400dde04
inc rdx
cmp rcx, rdx
jne 0x1400ddd60
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x1400ddd82
jmp 0x1400dddd0
lea rdx, [rdi - 0xf]
movabs r8, 0x101010101010100
movabs r9, 0x8080808080808080
nop word cs:[rax + rax]
mov r10, qword [rbp + rcx - 0x60]
mov r11, qword [rbp + rcx - 0x58]
mov rbx, r8
sub rbx, r11
or rbx, r11
mov r11, r8
sub r11, r10
or r11, r10
and r11, rbx
not r11
test r11, r9
jne 0x1400dddd0
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400ddda0
sub rax, rcx
je 0x1400dde69
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x1400dde01
inc rdx
cmp rax, rdx
jne 0x1400dddf0
jmp 0x1400dde69
add rdx, rcx
cmp rdx, rdi
jne 0x1400dde69
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400dde7d
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400dde95
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400dde9c
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1400fd5c8
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x1400ddd05
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1400fd630
jmp 0x1400dde9c
Function at 0x1400de340
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401542b0]
mov edx, 0x10
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je 0x1400de440
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400de4e0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400de432
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1400de3d7
mov rcx, qword [rbp - 0x18]
call rax
mov rdi, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400de409
cmp qword [rax + 0x10], 0x11
jb 0x1400de3f5
mov rdi, qword [rdi - 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400f7b90
ud2

Function at 0x1400e8d10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
Function at 0x1400e8ff0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x1400e919c
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
cmp r9, 0x7fffffff
mov r15d, 0x7fffffff
cmovb r15, r9
jmp 0x1400e906b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
dec r13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, rbx
mov r9b, 1
call fcn.1400e0700
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x1400e91b9
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x1400e91d3
movzx edi, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400e91dd
test r12, r12
sete sil
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r13d, eax
shl r13, 0x20
or r13, 2
mov rcx, r13
call fcn.140048800
cmp al, 0xd
setne al
or al, sil
jne 0x1400e9119
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
lock inc qword [rax]
jle 0x1400e91f6
add rcx, 0x10
mov rdx, qword [r12 + 8]
mov r8, qword [r12 + 0x10]
movzx r9d, byte [r12 + 0x18]
call case.0x140048851.301
test rax, rax
cmovne r13, rax
mov rcx, r13
call fcn.14008e3f0
cmp al, 0xd
jne 0x1400e91cc
and ebp, 0x23
mov rax, qword [r14 + 0x90]
xor rbp, 0xff002f
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x10
cmp dil, cl
jne 0x1400e9159
mov ecx, eax
and ecx, ebp
lock cmpxchg qword [r14 + 0x90], rcx
jne 0x1400e9140
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x1400e906b
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400e917d
mov rcx, rbp
call rax
cmp qword [rdi + 8], 0
je 0x1400e9054
cmp qword [rdi + 0x10], 0x11
jb 0x1400e9040
mov rbp, qword [rbp - 8]
jmp 0x1400e9040
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x28]
mov r8, rbx
mov r9b, 1
call fcn.1400e0700
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400e91c3
mov eax, 2
mov r13, rbp
jmp 0x1400e91e2
cmp al, 2
jne 0x1400e91f8
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x1400e91e2
mov eax, 1
mov r13, rbp
jmp 0x1400e91e2
movsxd r13, eax
xor eax, eax
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_srciopoll_evented.rs
call fcn.1400f83b0
int3
Function at 0x1400ee9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov ebx, r9d
mov rdi, rcx
mov rsi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x178]
mov r9d, dword [rsp + 0x170]
movzx eax, word [rsp + 0x168]
mov word [rsp + 0x56], ax
movzx r15d, word [rsp + 0x160]
mov r11, qword [rsp + 0x158]
mov ebp, dword [rsp + 0x150]
mov ecx, dword [rsp + 0x148]
mov r10d, dword [rsp + 0x140]
mov r14d, ebx
lea rax, [r14 + 1]
cmp rax, r9
mov dword [rsp + 0x9c], ecx
mov word [rsp + 0x54], r15w
mov dword [rsp + 0x98], r10d
mov qword [rsp + 0xc8], r11
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x40], rdx
jne 0x1400eeaba
mov qword [rsp + 0x48], r13
mov esi, ebp
mov r13, qword [rdx + 8]
mov r12, qword [rdx + 0x10]
mov rbp, r12
sub rbp, r9
jbe 0x1400eeb01
cmp byte [r13 + r9], 0xbf
mov rax, r14
jg 0x1400eeb06
lea rax, [0x140145c30]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov rax, r14
jne 0x1400eea9d
cmp rbp, 2
jb 0x1400eeb16
cmp word [r13 + r9], 0x2f2f
je 0x1400eeb8f
test ebx, ebx
mov ebp, esi
je 0x1400eeb3c
Function at 0x1400f75d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f761e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f761e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f761e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f761e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f761e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f7620
xor al, al
add rsp, 0x28
ret
Function at 0x1400fd630
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
cmp r8, 0xffffffffffffffff
je 0x1400fd850
mov rbx, r8
mov r15, r8
inc r15
js 0x1400fd85c
mov rdi, r9
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401542b0]
xor ecx, ecx
mov rdx, r15
call fcn.1400de8b0
test rax, rax
je 0x1400fd868
mov r12, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0x10
jae 0x1400fd6c8
test rbx, rbx
je 0x1400fd76f
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x1400fd7d4
inc rax
cmp rbx, rax
jne 0x1400fd6b0
jmp 0x1400fd76f
lea rax, [r14 + 7]
and rax, 0xfffffffffffffff8
sub rax, r14
jne 0x1400fd721
lea rcx, [rbx - 0x10]
xor eax, eax
movabs rdx, 0x101010101010100
movabs r8, 0x8080808080808080
nop
mov r9, qword [r14 + rax]
mov r10, qword [r14 + rax + 8]
mov r11, rdx
sub r11, r10
or r11, r10
mov r10, rdx
sub r10, r9
or r10, r9
and r10, r11
not r10
test r10, r8
jne 0x1400fd74c
add rax, 0x10
cmp rax, rcx
jbe 0x1400fd6f0
jmp 0x1400fd74c
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r14 + rcx], 0
je 0x1400fd7d4
inc rcx
cmp rax, rcx
jne 0x1400fd730
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x1400fd6db
cmp rax, rbx
je 0x1400fd76f
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x1400fd7d4
inc rax
cmp rbx, rax
jne 0x1400fd760
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x40]
call fcn.140007150
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x38], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x40]
lea r9, [rbp - 8]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400fd809
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400fd81d
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x1400fd840
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.1400f83b0
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.1400070c0
mov ecx, 1
mov rdx, r15
call fcn.1400f7b90
int3