joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002edc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14002ee4a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002ee40
cmp r11, r10
ja 0x14002eec6
cmp r10, rdx
ja 0x14002eed8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14002ee42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002ee20
jmp 0x14002eea7
ja 0x14002ee4a
mov r11, r10
cmp rax, r8
jne 0x14002ede7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14002eeab
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002ee80
mov r8, r10
sub ecx, r9d
jns 0x14002ee9e
jmp 0x14002eead
cmp r10, rdx
je 0x14002eeba
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002eead
xor al, 1
cmp r8, rdx
jne 0x14002ee60
jmp 0x14002eead
xor eax, eax
jmp 0x14002eead
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140032470
lea r8, str.___t_
mov rcx, r11
mov rdx, r10
call fcn.1400328d0
lea r8, str.___t_
mov rcx, r10
call fcn.1400328c0
int3

Function at 0x140030ea4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140030eee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140030eee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140030eee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140030eee
cmp dword [rcx + 0x84], 0xe
jbe 0x140030eee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030ef0
xor al, al
add rsp, 0x28
ret
Function at 0x1407e02c0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407e0447
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407e02f1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e02d7
add dl, dl
jne 0x1407e02fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e035e
xor eax, eax
add dl, dl
jne 0x1407e030d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e0415
add dl, dl
jne 0x1407e031e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e032b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e0338
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e0345
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407e0352
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407e02e6
mov eax, 1
add dl, dl
jne 0x1407e036e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e037b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e0363
sub eax, ebx
mov ebx, 1
jne 0x1407e03b4
mov ecx, 1
add dl, dl
jne 0x1407e0396
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407e03a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e038b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e02e6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407e03d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407e03dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e03c5
cmp eax, 0x7d00
jae 0x1407e0403
cmp eax, 0x500
jb 0x1407e03fe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e02e6
cmp eax, 0x7f
ja 0x1407e0406
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e02e6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407e043a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407e02e6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140047940
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
jne 0x14004795d
xor r10d, r10d
jmp 0x140047a6b
movabs rcx, 0x6580f32cb415e021
lea r10, [rcx + 8]
xor r10, rcx
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
movabs rcx, 0x7bd318fc317d7955
lea r9, [rcx + 1]
xor r9, rcx
cmp rdi, r9
jbe 0x14004799b
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1400479a0
xor esi, esi
xor r9d, r9d
movabs rcx, 0x2cf207fc45bbf536
lea rbx, [rcx + 1]
xor rbx, rcx
or rbx, r9
cmp rbx, rdi
jae 0x1400479e0
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
movabs rcx, 0x5ff65d9a9a8e46d5
lea rbx, [rcx + 2]
xor rbx, rcx
or r9, rbx
cmp r9, rdi
jae 0x1400479f7
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140047a17
add r11, r8
jmp 0x140047b7a
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140047af1
movabs r14, 0x1d995e0e46b03cc5
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
lea rbx, [r14 + 8]
xor rbx, r14
nop
mov r14, qword [rdx + r10]
xor rdi, r14
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, r14
add r10, rbx
cmp r10, r8
jb 0x140047aa0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
movabs rcx, 0xf7c6c76077bf65a8
lea r8, [rcx + 3]
xor r8, rcx
cmp r11, r8
jbe 0x140047b13
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140047b19
xor r9d, r9d
xor r8d, r8d
movabs rcx, 0xc1590df236cd92b2
lea rsi, [rcx + 1]
xor rsi, rcx
or rsi, r8
cmp rsi, r11
jae 0x140047b5c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
movabs rcx, 0x3073a74deef49639
lea rsi, [rcx + 2]
xor rsi, rcx
or r8, rsi
cmp r8, r11
jae 0x140047b76
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140055230
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1400552bc
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x1400552c1
cmp eax, 0x40
jb 0x1400553b1
cmp rax, r8
ja 0x1400553b1
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x1400552c6
mov r10b, 5
cmp r9d, 0x20b
jne 0x1400552f1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1400552f1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x1400552f1
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x1400552f1
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x140055324
jmp 0x1400553b1
xor r10d, r10d
jmp 0x1400552f1
mov r10b, 1
jmp 0x1400552f1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1400552f1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x1400552f1
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x140055311
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x1400553b1
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x1400553b1
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x1400552ff
ud2
Function at 0x14005ec10
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14005ec20
test al, 1
je 0x14005ec3b
test al, 2
jne 0x14005ec3b
xor rax, 3
ret
ud2

Function at 0x1400611a0
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1400611b0
add rcx, 0x18
jmp 0x140073270
ud2
jmp 0x14007a680
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14007a6b8
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x140061240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140069840
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14006988a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400698b5
mov eax, 1
jmp 0x140069a23
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400699ec
mov eax, 1
jmp 0x140069a23
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x14006990f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.1400546c0
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140069880
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400699f5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x140069a3f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140073290
mov r13, rdx
test rax, rax
je 0x1400699f9
mov rcx, r13
call fcn.1400694e0
cmp al, 0xd
jne 0x140069a1e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14006999c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140069980
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400698e6
test rax, rax
je 0x1400698e6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400699ce
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400698d0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.1400546c0
jmp 0x1400698d0
cmp al, 2
jne 0x140069a37
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140069a23
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x140069a0d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x140069a3f
cmp rax, rcx
ja 0x140069a3f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2

Function at 0x140062370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140069840
Function at 0x140069840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140069840
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14006988a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400698b5
mov eax, 1
jmp 0x140069a23
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400699ec
mov eax, 1
jmp 0x140069a23
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x14006990f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.1400546c0
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14005e830
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140069880
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400699f5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x140069a3f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140073290
mov r13, rdx
test rax, rax
je 0x1400699f9
mov rcx, r13
call fcn.1400694e0
cmp al, 0xd
jne 0x140069a1e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14006999c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140069980
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400698e6
test rax, rax
je 0x1400698e6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400699ce
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400698d0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.1400546c0
jmp 0x1400698d0
cmp al, 2
jne 0x140069a37
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140069a23
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x140069a0d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x140069a3f
cmp rax, rcx
ja 0x140069a3f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x140069a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140069a50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140069aa1
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14005e830
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140069acc
mov eax, 2
jmp 0x140069c06
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.14005e830
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140069bec
mov eax, 2
jmp 0x140069c06
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140069b13
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.1400546c0
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14005e830
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x140069a97
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x140069c01
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.1400732a0
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x140069bfc
mov rcx, r13
call fcn.1400694e0
cmp al, 0xd
jne 0x140069bfc
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x140069b9c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140069b80
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140069af6
test rax, rax
je 0x140069af6
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140069bce
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140069ae0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.1400546c0
jmp 0x140069ae0
cmp al, 2
jne 0x140069c1d
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x140069c09
mov rax, rsi
jmp 0x140069c09
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1400725b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400725c0
test al, 1
je 0x1400726b3
test al, 2
jne 0x1400726b3
test al, 8
jne 0x1400725fb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140061fe0
jmp 0x140072613
test al, 0x10
je 0x140072613
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x1400726b3
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x1400726b3
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x14007267c
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x140072682
test rax, rax
jne 0x14007268b
mov rdx, qword [rsi + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14007268b
test rdx, rdx
je 0x14007268b
mov rcx, qword [rsi + 0x38]
mov r8d, 1
call fcn.1400546c0
jmp 0x14007268b
add rsp, 0x50
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.14005f580
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14007269b
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1400546c0
ud2

Function at 0x1400730a0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov eax, dword [0x1400d6618]
cmp eax, 3
jne 0x14007313d
mov ecx, edi
mov edx, esi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x140073118
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x14007312e
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
jmp 0x140073133
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov eax, 1
jmp 0x140073133
xor eax, eax
mov rdi, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_1.0.2_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d6618]
lea r9, [0x1400bb6f0]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400b4220
jmp 0x1400730c4
Function at 0x140073180
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.1400730a0
mov rdi, rdx
test rax, rax
je 0x1400731b2
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x140073253
cmp word [rbx], 0
je 0x1400731d7
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x1400731f0
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14007322a
call sub.kernel32.dll_GetLastError
cmp eax, 0x2733
jne 0x140073237
mov qword [rsi], rdi
mov qword [rsi + 8], 0
jmp 0x140073253
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140076af0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x140076b80
jmp 0x140076b6f
jae 0x140076c3c
cmp r8, 0x201
jae 0x140076b80
mov esi, 0x200
lea r13, [rsp + 0x78]
mov rbp, r8
jmp 0x140076bab
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x140076c0c
cmp rdi, rbx
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x48], r12
mov rsi, r12
mov r13, qword [rsp + 0x28]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call r14
mov r15d, eax
test eax, eax
jne 0x140076bd0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140076cef
mov r8d, r15d
cmp rbp, r8
jne 0x140076b60
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140076d1a
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x140076b6f
jmp 0x140076b80
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x38]
mov rdx, r12
call fcn.1400b13b0
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x140076b8e
cmp rsi, r8
jb 0x140076d1a
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rbx, qword [rax + 8]
lea r14, [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.140082010
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, r14
call fcn.1400847a0
cmp byte [rbx], 0
jne 0x140076c8c
lea rdx, [0x1400bbf28]
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.140085140
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14007ced0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140076cbd
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call fcn.1400546c0
test rdi, rdi
je 0x140076cd8
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1400546c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000001
mov qword [rsi], rax
test rdi, rdi
jne 0x140076cc2
jmp 0x140076cd8
ud2