joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140097c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140097c63
test ecx, ecx
jne 0x140097cb2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x140097c70
test ecx, ecx
jne 0x140097cb2
mov rcx, rdi
call fcn.140097b10
movzx r10d, al
test bl, bl
jne 0x140097cb9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x140097ca6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x140097e2c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x140097ca6.2
xor r10d, r10d
test bl, bl
je 0x140097c80
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140097e0e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x140097ceb
xor edi, edi
jmp 0x140097d68
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x140097d30
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x140097d4b
inc rsi
dec rax
cmp rsi, 1
jne 0x140097d10
jmp 0x140097d68
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x140097d4b
cmp ebx, 0x5c
je 0x140097d4b
inc rsi
dec rax
cmp rsi, 1
jne 0x140097d30
jmp 0x140097d68
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x140097e1c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x140097d92
mov al, 9
cmp rdx, 2
je 0x140097d96
cmp rdx, 1
jne 0x140097da6
cmp byte [r9], 0x2e
jne 0x140097da6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140097da6
mov al, 0xa
jmp 0x140097da6
cmp byte [r9], 0x2e
jne 0x140097da6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x140097ca6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x140097ca6.2
mov esi, 2
jmp case.0x140097ca6.2
lea r8, [0x140121e88]
call fcn.14000dfd0
ud2
lea r8, [0x140121ea0]
call fcn.14000dfd0
ud2
Function at 0x1400b25c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x1400cc030]
test rcx, rcx
jne 0x1400b25e1
lea rcx, [0x1400cc030]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b25fe
mov rdi, rax
cmp qword [rax], 0
je 0x1400b25fe
add rdi, 8
jmp 0x1400b26ad
mov rcx, qword [0x1400cc030]
test rcx, rcx
jne 0x1400b2619
lea rcx, [0x1400cc030]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b26ab
mov rsi, rax
test rax, rax
jne 0x1400b267c
mov ecx, 0x18
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x1400b26b7
mov rsi, rax
mov qword [rax], 0
lea rax, [0x1400cc030]
mov qword [rsi + 0x10], rax
mov rcx, qword [0x1400cc030]
test rcx, rcx
jne 0x1400b2674
lea rcx, [0x1400cc030]
call fcn.140092980
mov rcx, rax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 1
mov qword [rsi + 8], 0
je 0x1400b26ad
test rcx, rcx
je 0x1400b26ad
lock dec qword [rcx]
jne 0x1400b26ad
call fcn.1400b26d0
jmp 0x1400b26ad
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.14000a410
ud2

Function at 0x1400b4c10
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rdi, qword [rdx]
mov rbx, qword [rdx + 8]
movzx ebp, word [rdx + 0x10]
mov rax, qword [0x14015b0e8]
cmp rax, 3
jne 0x1400b4d10
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8, rbx
call fcn.14000a830
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400b4c7e
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400b4c67
not rdx
shr rdx, 0x3f
call fcn.140009bb0
lea rax, str.data_provided_contains_a_nul_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400b4d06
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1400b4cdb
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400b4cee
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x1400b4d06
mov edx, 1
mov rcx, rdi
call fcn.140009bb0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400b51c0
jmp 0x1400b4c37
Function at 0x1400b56e0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x10
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x1400b579e
mov rsi, rax
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b57f0]
xor ebx, ebx
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rcx, rax
test rax, rax
jne 0x1400b578e
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x1400b576d
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsi]
call fcn.140009bb0
mov edx, 8
mov rcx, rsi
call fcn.140009bb0
call sub.kernel32.dll_GetLastError
mov ecx, eax
shl rcx, 0x20
or rcx, 2
mov ebx, 1
mov rax, rbx
mov rdx, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.14000a410
ud2

Function at 0x1400b58c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x90
mov dword [rsp + 0x24], ecx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1400b58fa
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x90
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1400af1d0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x24]
mov qword [rsp + 0x50], rax
lea rax, [0x140012400]
mov qword [rsp + 0x58], rax
lea rax, [0x140123018]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rax, [0x140123038]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
lea rdx, str.library_std_src_syswindows_rand.rsRNG_broken:___fallback_RNG_broken:
lea rcx, [rsp + 0x60]
call fcn.14000d3a0
ud2
Function at 0x1400b8a90
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov rcx, qword [0x1400cc020]
test rcx, rcx
jne 0x1400b8ab4
lea rcx, [0x1400cc020]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b8ad1
mov rcx, rax
cmp qword [rax], 0
je 0x1400b8ad1
add rcx, 8
jmp 0x1400b8c2e
mov rcx, qword [0x1400cc020]
test rcx, rcx
jne 0x1400b8aec
lea rcx, [0x1400cc020]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b8bbf
mov rsi, rax
test rax, rax
jne 0x1400b8b53
mov ecx, 0x20
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x1400b8c38
mov rsi, rax
mov qword [rax], 0
lea rax, [0x1400cc020]
mov qword [rsi + 0x18], rax
mov rcx, qword [0x1400cc020]
test rcx, rcx
jne 0x1400b8b4b
lea rcx, [0x1400cc020]
call fcn.140092980
mov rcx, rax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400b8b74
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
mov qword [rdi], 0
cmp rcx, 1
je 0x1400b8c1b
mov rdi, qword [0x14015b0f8]
mov qword [rsp + 0x20], rdi
cmp rdi, 0xffffffffffffffff
je 0x1400b8bc3
test rdi, rdi
jne 0x1400b8be6
lea rdx, [0x140122fc8]
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x1400b8bca
mov rcx, qword [rsp + 0x20]
xor eax, eax
lock cmpxchg qword [0x14015b0f8], rcx
jne 0x1400b8bd7
mov rdi, qword [rsp + 0x20]
jmp 0x1400b8be6
xor ecx, ecx
jmp 0x1400b8c2e
mov eax, 0xc00000bb
jmp 0x1400b8c14
mov qword [0x14015b0f8], 0xffffffffffffffff
jmp 0x1400b8c14
mov rdi, rax
mov rcx, qword [rsp + 0x20]
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x10
xor r9d, r9d
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400b8c14
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400b8c1b
mov ecx, eax
call fcn.1400b58c0
mov qword [rsi], 1
lea rcx, [rsi + 8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x20
mov edx, 8
call fcn.14000a410
ud2
Function at 0x1400b8dcd
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1400cc0d0]
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b8dfc
cmp qword [rax], 0
je 0x1400b8dfc
add rax, 8
jmp 0x1400b8e74
lea rbx, [0x1400cc0d0]
mov rcx, rbx
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b8e72
mov rdi, rax
test rax, rax
jne 0x1400b8e47
mov ecx, 0x18
call fcn.1400b8e93
mov rdi, rax
and qword [rax], 0
mov qword [rax + 0x10], rbx
mov rcx, rbx
call fcn.1400b8e7c
mov ecx, eax
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x1400b8e5f
mov rax, qword [rsi]
and qword [rsi], 0
cmp rax, 1
jne 0x1400b8e5f
mov rcx, qword [rsi + 8]
jmp 0x1400b8e61
xor ecx, ecx
lea rax, [rdi + 8]
mov qword [rdi], 1
mov qword [rdi + 8], rcx
jmp 0x1400b8e74
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400b8f28
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1400cc0e0]
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b8f57
cmp qword [rax], 0
je 0x1400b8f57
add rax, 8
jmp 0x1400b8fcf
lea rbx, [0x1400cc0e0]
mov rcx, rbx
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b8fcd
mov rdi, rax
test rax, rax
jne 0x1400b8fa2
mov ecx, 0x18
call fcn.1400b8e93
mov rdi, rax
and qword [rax], 0
mov qword [rax + 0x10], rbx
mov rcx, rbx
call fcn.1400b8e7c
mov ecx, eax
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x1400b8fba
mov rax, qword [rsi]
and qword [rsi], 0
cmp rax, 1
jne 0x1400b8fba
mov rcx, qword [rsi + 8]
jmp 0x1400b8fbc
xor ecx, ecx
lea rax, [rdi + 8]
mov qword [rdi], 1
mov qword [rdi + 8], rcx
jmp 0x1400b8fcf
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400b9321
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov r14, rcx
lea rcx, [0x1400cc0b0]
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b935d
mov rsi, rax
cmp qword [rax], 0
je 0x1400b935d
add rsi, 8
jmp 0x1400b9502
lea rsi, [0x1400cc0b0]
mov rcx, rsi
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b9459
mov rbx, rax
test rax, rax
jne 0x1400b93ac
mov ecx, 0x70
call fcn.1400b8e93
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x68], rsi
mov rcx, rsi
call fcn.1400b8e7c
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test r14, r14
je 0x1400b946a
lea rax, [rsp + 0x68]
mov ecx, 0xd
mov rdi, rax
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
and qword [r14], 0
cmp dword [rax], 1
jne 0x1400b9460
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x50], xmm0
mov r9, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xd0], xmm0
mov eax, dword [rsp + 0xc0]
mov edx, dword [rsp + 0xc4]
mov r10b, byte [rsp + 0xc8]
mov r11b, byte [rsp + 0xc9]
movzx ecx, word [rsp + 0xce]
mov word [rsp + 0x2c], cx
mov ecx, dword [rsp + 0xca]
mov dword [rsp + 0x28], ecx
jmp 0x1400b948b
xor esi, esi
jmp 0x1400b9502
lea rcx, [rsp + 0x68]
call fcn.1400b95c1
call fcn.1400b9514
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x38], xmm0
mov r9d, 2
mov r10b, 2
xor r11d, r11d
xor r14d, r14d
lea r8, [rsp + 0x68]
mov ecx, 0xd
mov rdi, r8
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 1
lea rsi, [rbx + 8]
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 8], xmm0
mov qword [rbx + 0x18], r9
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x28], r14
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x30], xmm0
mov rcx, qword [rsp + 0x40]
mov qword [rbx + 0x40], rcx
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [rbx + 0x48], xmm0
mov dword [rbx + 0x58], eax
mov dword [rbx + 0x5c], edx
mov byte [rbx + 0x60], r10b
mov byte [rbx + 0x61], r11b
mov eax, dword [rsp + 0x28]
mov dword [rbx + 0x62], eax
movzx eax, word [rsp + 0x2c]
mov word [rbx + 0x66], ax
mov rcx, r8
call fcn.1400b95c1
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400bf442
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400bf449
test al, 1
je 0x1400bf468
test al, 2
jne 0x1400bf47d
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140126040]
mov edx, 0x23
jmp 0x1400bf490
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140126080]
mov edx, 0x25
call fcn.14000e4f0
ud2
Function at 0x1400bfd5e
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400be7ff
mov rcx, qword [rax + 8]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400bfd9a
xor eax, eax
jmp 0x1400bfda7
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400c0030
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov rbp, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xd0]
lea rcx, [rdx + 0x10]
mov qword [rsp + 0x40], rcx
mov ecx, 0x7fffffff
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x48], rcx
lea r15, [rsp + 0x3a]
lea rdi, [rsp + 0x30]
mov rdx, qword [rbp + 0x20]
mov rcx, rdi
mov r8, qword [rsp + 0x58]
call fcn.1400bfd56
mov r12b, byte [rsp + 0x39]
cmp r12b, 3
je 0x1400c01af
mov r13, qword [rsp + 0x30]
cmp r12b, 2
je 0x1400c01bd
mov bl, byte [rsp + 0x38]
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x1400c00ce
mov rsi, rbp
jmp 0x1400c00d0
xor esi, esi
mov rcx, rsi
lea rdx, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_tokio_1.28.2_src_io_poll_evented.rs
call fcn.1400be816
mov rcx, qword [rsi + 8]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400c01cf
call sub.ws2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov rcx, r14
call fcn.14001dc78
cmp al, 0xd
jne 0x1400c0163
mov rax, qword [rsi]
test rax, rax
je 0x1400c0163
mov rcx, qword [rax]
mov rdx, qword [rax + 0x10]
lock inc qword [rdx]
jle 0x1400c0201
add rcx, 0x10
mov r8, qword [rax + 8]
mov r9b, byte [rax + 0x18]
call fcn.14003e05a
mov rsi, rax
xor ecx, ecx
call fcn.14003c428
test rsi, rsi
je 0x1400c0163
mov ecx, 1
mov rdx, r14
call fcn.14003e180
mov r14, rsi
mov rcx, r14
call fcn.1400bbb9d
cmp al, 0xd
jne 0x1400c01e0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x30], r13
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], r12b
movzx eax, word [rsp + 0x24]
mov word [r15 + 4], ax
mov eax, dword [rsp + 0x20]
mov dword [r15], eax
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call fcn.1400bfaf6
lea rcx, [rsp + 0x60]
call fcn.1400ba5f1
jmp 0x1400c007e
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x1400c01f0
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], r13
jmp 0x1400c01f0
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x1400c01f0
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], r14
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1400c0239
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, [0x1400cc0c0]
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400c0261
mov rsi, rax
cmp qword [rax], 0
jne 0x1400c02c8
lea rdi, [0x1400cc0c0]
mov rcx, rdi
call fcn.1400b8e7c
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400c02c6
mov rsi, rax
test rax, rax
jne 0x1400c02ac
mov ecx, 0x10
call fcn.1400b8e93
mov rsi, rax
and qword [rax], 0
mov qword [rax + 8], rdi
mov rcx, rdi
call fcn.1400b8e7c
mov ecx, eax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
call fcn.1400bd3c3
mov rdx, qword [rsi]
mov qword [rsi], rax
lea rcx, [rsp + 0x20]
mov qword [rcx], rdx
call fcn.1400bd3f2
jmp 0x1400c02c8
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400ca340
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400cb100
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400cb100
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400ca3b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14015b214]
mov rbx, rcx
test esi, esi
jle 0x1400ca4e0
mov rax, qword [0x14015b218]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400ca3fb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400ca485
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400ca3e0
mov rcx, rbx
call fcn.1400cae20
mov rdi, rax
test rax, rax
je 0x1400ca502
mov rax, qword [0x14015b218]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400caf60
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14015b218]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400ca4e7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400ca47e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400ca490
add dword [0x14015b214], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14015b218]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400ca47e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400ca340
nop dword [rax]
xor esi, esi
jmp 0x1400ca408
mov rax, qword [0x14015b218]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400ca340
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400ca340
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400caa90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14015b280]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14015b260]
test rbx, rbx
je 0x1400caaec
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400caae3
test eax, eax
jne 0x1400caae3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400caac8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400cae20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14014b9f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400cae40
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400cae48
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400cae40
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400cae9d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400cae94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400cae40
add rax, 0x28
cmp rax, r9
jne 0x1400cae80
xor eax, eax
ret

Function at 0x1400caea0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14014b9f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400caebf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400caec8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400caebf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400caf60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14014b9f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400caf7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400caf88
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret