joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b100
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
call fcn.1401c5310
cmp qword [rax], 0
je 0x14003b13f
add rax, 8
jmp 0x14003b149
mov rcx, rax
xor edx, edx
call fcn.14009d1a0
movdqu xmm6, xmmword [rax]
inc qword [rax]
pshufd xmm7, xmm6, 0x44
pxor xmm7, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm8, xmm6, 0xee
pxor xmm8, xmmword [0x1401f1c90]
mov ebx, 1
lea r14, [rsp + 0x60]
xorps xmm9, xmm9
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x28]
nop word cs:[rax + rax]
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm6
movaps xmmword [r14], xmm9
mov qword [r14 + 0x10], 0
mov qword [rsp + 0x28], rbx
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.140007690
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
add rax, rcx
rol rcx, 0xd
xor rdx, r9
xor rcx, rax
rol rax, 0x20
mov r8, qword [rsp + 0x38]
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rdx, rax
xor rcx, r8
rol r8, 0x20
xor rax, r9
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
xor r8, 0xff
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
add r8, rdx
rol rdx, 0x10
xor rdx, r8
rol rdx, 0x15
xor rcx, rax
add r8, rcx
rol rcx, 0x11
mov rax, r8
rol rax, 0x20
xor rax, rcx
xor rax, rdx
inc rbx
xor rax, r8
je 0x14003b190
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007f550
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r9
mov r13, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.140081790
mov eax, dword [rsp + 0x20]
cmp eax, 2
jne 0x14007f589
mov rax, qword [rsp + 0x28]
jmp 0x14007f6e5
test eax, eax
je 0x14007f6db
mov rdx, qword [rdi + 0x1c0]
mov r15, qword [rdi + 0x1c8]
cmp r15, rdx
jne case.0x14007bf73.374
mov rbx, qword [rsp + 0x28]
mov r14d, ebx
shr rbx, 0x20
cmp r12, rbx
cmovb rbx, r12
mov ebp, dword [rsp + 0x24]
lea r12, [rbx + rbp]
add r14, r12
sub r14, r15
jbe 0x14007f61a
mov rax, qword [rdi + 0x1b0]
sub rax, r15
cmp rax, r14
jb 0x14007f7aa
mov rax, qword [rdi + 0x1b8]
lea rcx, [rax + r15]
cmp r14, 2
jb 0x14007f60d
lea r8, [r14 - 1]
xor edx, edx
mov qword [rsp + 0x60], rax
call sub.VCRUNTIME140.dll_memset
add r15, r14
dec r15
mov rcx, qword [rsp + 0x60]
add rcx, r15
mov byte [rcx], 0
inc r15
mov qword [rdi + 0x1c0], r15
cmp r12, r15
ja 0x14007f7ec
mov rcx, qword [rdi + 0x1b8]
add rcx, rbp
mov rdx, r13
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rdi + 0x1c0]
cmp rdx, rbp
jb 0x14007f7fe
cmp rdx, r12
jb 0x14007f80d
mov rax, qword [rdi + 0x1b8]
lea rcx, [rax + rbp]
sub edx, r12d
add r12, rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x24], 7
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x44], 6
mov qword [rsp + 0x48], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
lea rcx, [rdi + 0x220]
lea r8, [rsp + 0x68]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x14007f705
shl rax, 0x20
or rax, 2
jmp 0x14007f6e5
movabs rax, 0x8009031700000002
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x20]
add eax, dword [rsp + 0x40]
mov rdx, qword [rdi + 0x1c0]
cmp rdx, rax
jb 0x14007f727
mov qword [rdi + 0x1c0], rax
mov rdx, rax
mov qword [rdi + 0x1c8], 0
mov qword [rdi + 0x248], rbx
xor r15d, r15d
lea rcx, [rdi + 0x1b0]
mov rdx, r15
mov r8, r14
call fcn.1401e9d10
mov r15, qword [rdi + 0x1c0]
mov rax, qword [rdi + 0x1b8]
lea rcx, [rax + r15]
cmp r14, 2
jae 0x14007f5ef
jmp 0x14007f60d
Function at 0x14007f820
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140080180
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x14007f85c
mov rax, qword [rsp + 0x38]
jmp 0x14007f9bc
test eax, eax
je 0x14007f9b2
mov rdx, qword [rdi + 0xc0]
mov rbx, qword [rdi + 0xc8]
cmp rbx, rdx
jne 0x14007fa15
mov r14, qword [rsp + 0x38]
mov r15d, r14d
shr r14, 0x20
cmp r12, r14
cmovb r14, r12
mov ebp, dword [rsp + 0x34]
lea r12, [r14 + rbp]
add r15, r12
sub r15, rbx
jbe 0x14007f8ed
mov rax, qword [rdi + 0xb0]
sub rax, rbx
cmp rax, r15
jb 0x14007fab3
mov rax, qword [rdi + 0xb8]
lea rcx, [rax + rbx]
cmp r15, 2
jb 0x14007f8e0
lea r8, [r15 - 1]
xor edx, edx
mov qword [rsp + 0x70], rax
call sub.VCRUNTIME140.dll_memset
add rbx, r15
dec rbx
mov rcx, qword [rsp + 0x70]
add rcx, rbx
mov byte [rcx], 0
inc rbx
mov qword [rdi + 0xc0], rbx
cmp r12, rbx
ja 0x14007fb0d
mov rcx, qword [rdi + 0xb8]
add rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rdi + 0xc0]
cmp rdx, rbp
jb 0x14007fb1f
cmp rdx, r12
jb 0x14007fb2e
mov rax, qword [rdi + 0xb8]
lea rcx, [rax + rbp]
sub edx, r12d
add r12, rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
lea rcx, [rdi + 0x120]
lea r8, [rsp + 0x78]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x14007f9df
shl rax, 0x20
or rax, 2
jmp 0x14007f9bc
movabs rax, 0x8009031700000002
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
mov rdx, qword [rdi + 0xc0]
cmp rdx, rax
jb 0x14007fa01
mov qword [rdi + 0xc0], rax
mov rdx, rax
mov qword [rdi + 0xc8], 0
mov qword [rdi + 0x148], r14
xor ebx, ebx
cmp rbx, rdx
je 0x14007fa92
lea r14, [rdi + 0x10]
lea r15, [rsp + 0x30]
nop word cs:[rax + rax]
lea rcx, [rdi + 0xb0]
mov rdx, rbx
mov r8, r15
call fcn.1401e9d10
mov rbx, qword [rdi + 0xc0]
mov rax, qword [rdi + 0xb8]
lea rcx, [rax + rbx]
cmp r15, 2
jae 0x14007f8c2
jmp 0x14007f8e0
Function at 0x1400cee70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov qword [rbp - 0x30], rcx
add r9, r8
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
mov word [rbp - 0x18], 0
mov dword [rbp - 0x10], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x28]
call fcn.1400af740
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
movzx eax, byte [0x140304c81]
mov ecx, 0x800
mov edx, 1
call fcn.14000e990
test rax, rax
je 0x1400cf000
mov rbx, rax
mov qword [rbp - 0x28], 0x800
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
mov rdi, qword [rbp - 0x40]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov rsi, qword [rbp - 0x28]
mov r13, qword [rbp - 0x18]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400cef5d
mov r8d, dword [rbp - 4]
cmp rsi, r8
jae 0x1400cef20
lea rcx, [rbp - 0x28]
mov rdx, r13
call fcn.1401e9d10
mov rbx, qword [rbp - 0x20]
jmp 0x1400cef0f
test eax, eax
jne 0x1400cef7c
mov eax, dword [rbp - 4]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
jbe 0x1400cefdf
movabs rax, 0xde00000002
jmp 0x1400cef84
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp - 0x30]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400cefb0
mov r8d, 1
mov rcx, rbx
call fcn.14000e9a0
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x1400cefca
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.14000e9a0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x48]
test rdx, rdx
jne 0x1400cefb9
jmp 0x1400cefca
mov ecx, 1
mov edx, 0x800
call fcn.1401ef780
ud2
Function at 0x14011c7c0
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x14011c7f4
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x140134a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rdx, str.keep_aliveclose
mov r8d, 0xa
jmp fcn.140134a20

Function at 0x140134a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
call fcn.1401c35a0
test rax, rax
je 0x140134bc6
mov rbx, rax
mov r14, rdx
mov qword [rsp + 0x20], rsi
lea r12, [rsi - 1]
xor r15d, r15d
xor r13d, r13d
jmp 0x140134a70
mov r15, rsi
test bpl, bpl
je 0x140134bc6
nop word [rax + rax]
cmp r13, r14
ja 0x140134afa
mov r8, r14
sub r8, r13
lea rax, [rbx + r13]
cmp r8, 0x10
jae 0x140134ac0
xor edx, edx
test r8, r8
je 0x140134aa1
cmp byte [rax + rdx], 0x2c
je 0x140134aed
inc rdx
cmp r8, rdx
jne 0x140134a90
mov rdx, r8
xor eax, eax
cmp rax, 1
je 0x140134ad0
xor ebp, ebp
mov rsi, r15
mov r13, r14
jmp 0x140134aff
mov cl, 0x2c
mov rdx, rax
call fcn.1401e50d0
cmp rax, 1
jne 0x140134aa9
lea rax, [rdx + r13]
add r13, rdx
inc r13
cmp rax, r14
jae 0x140134a70
cmp byte [rbx + rax], 0x2c
jne 0x140134a70
mov bpl, 1
mov rsi, r13
jmp 0x140134b02
mov eax, 1
cmp rax, 1
je 0x140134ad0
jmp 0x140134aa9
xor ebp, ebp
mov rsi, r15
mov rax, r14
sub rax, r15
add r15, rbx
mov rcx, r15
mov rdx, rax
call fcn.140133e60
mov r15, qword [rsp + 0x20]
cmp rdx, r15
jne 0x140134a5b
mov rcx, rax
mov al, 1
test r15, r15
je 0x140134bc8
movzx edx, byte [rcx]
movzx r8d, byte [rdi]
lea r9d, [rdx - 0x41]
cmp r9b, 0x1a
setb r9b
shl r9b, 5
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r9b, dl
or r10b, r8b
cmp r9b, r10b
jne 0x140134a5b
xor edx, edx
nop word [rax + rax]
cmp r12, rdx
je 0x140134bc8
movzx r8d, byte [rcx + rdx + 1]
movzx r9d, byte [rdi + rdx + 1]
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
lea r11d, [r9 - 0x41]
cmp r11b, 0x1a
setb r11b
shl r11b, 5
or r10b, r8b
or r11b, r9b
inc rdx
cmp r10b, r11b
je 0x140134b70
cmp rdx, r15
setae al
jae 0x140134bc8
xor bpl, 1
mov r15, rsi
je 0x140134a70
jmp 0x140134bc8
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140180770
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call sub.ws2_32.dll_setsockopt
test eax, eax
je 0x1401807b1
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140198e50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
nop word [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140198e60
test al, 1
je 0x140198e7f
test al, 2
jne 0x140198e97
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140266010]
mov edx, 0x23
call fcn.1401efaa0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140266050]
mov edx, 0x25
call fcn.1401efaa0
int3
Function at 0x14019dc00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov ebx, r8d
mov qword [rbp - 0x20], rdx
mov rsi, rcx
test r8b, r8b
je 0x14019dc94
lea rcx, [rsi + 0x30]
mov qword [rbp - 0x18], rcx
call fcn.14019b730
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx + 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rdx + 0x20], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
mov rax, qword [rsi]
mov rcx, rdx
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rsi], rdx
jne 0x14019dc60
test al, 1
je 0x14019ddf8
test al, 2
jne 0x14019de16
test al, 8
jne 0x14019dcd1
call fcn.14019b730
mov rax, qword [rbp - 0x18]
mov qword [rax], 5
jmp 0x14019dcf0
mov rax, qword [rsi]
nop word [rax + rax]
mov rcx, rax
or rcx, 2
cmp rcx, 0x40
jb 0x14019ddb7
add rcx, 0xffffffffffffffc0
lock cmpxchg qword [rsi], rcx
jne 0x14019dca0
mov al, 1
cmp rcx, 0x3f
jbe 0x14019dd25
test bl, bl
je 0x14019dd65
jmp 0x14019ddae
test al, 0x10
je 0x14019dcf0
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14019de34
mov rax, qword [rax + 0x10]
mov rcx, qword [rsi + 0x68]
mov byte [rbp - 9], 0
call rax
mov rax, qword [rsi]
nop word cs:[rax + rax]
test al, 2
je 0x14019ddbb
cmp rax, 0x40
jb 0x14019ddd9
lea rcx, [rax - 0x40]
lock cmpxchg qword [rsi], rcx
jne 0x14019dd00
xor eax, eax
cmp rcx, 0x3f
ja 0x14019dcc4
mov dword [rbp - 0x24], eax
lea rcx, [rsi + 0x30]
mov qword [rbp - 0x18], rsi
call fcn.14019b730
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x60]
test rax, rax
je 0x14019dd4d
mov rcx, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x68]
call qword [rax + 0x18]
mov edx, 0x70
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.14000e9a0
test bl, bl
jne 0x14019ddae
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
cmp rax, 2
je 0x14019ddae
test rax, rax
je 0x14019ddae
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rax
call qword [rax]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14019ddae
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x18]
add rsp, 0x50
pop rbx
pop rsi
pop rbp
jmp fcn.14000e9a0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rbp
ret
mov al, 1
jmp 0x14019dddb
mov byte [rbp - 9], 0
lea rcx, str.assertion_failed:_snapshot.is_complete_____
lea r8, [0x140266090]
mov edx, 0x28
call fcn.1401efaa0
jmp 0x14019de50
xor eax, eax
mov byte [rbp - 9], al
lea rcx, str.assertion_failed:_self.ref_count_____0
lea r8, [0x140266218]
mov edx, 0x26
call fcn.1401efaa0
jmp 0x14019de50
mov byte [rbp - 9], 0
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140266010]
mov edx, 0x23
call fcn.1401efaa0
jmp 0x14019de50
mov byte [rbp - 9], 0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140266050]
mov edx, 0x25
call fcn.1401efaa0
jmp 0x14019de50
mov byte [rbp - 9], 0
lea rcx, str.waker_missing
lea r8, [0x140266a80]
mov edx, 0xd
call fcn.1401eda00
ud2
Function at 0x14019faa0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx], 0
je 0x14019fab7
add rcx, 8
add rsp, 0x28
jmp 0x1401a4540
lea rcx, [0x140266f27]
lea r8, str.Ro_
mov edx, 0x2b
call fcn.1401efaa0
int3
mov rcx, qword [rcx + 0x20]
jmp 0x1401cab60
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1401cab98
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14019fad0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx], 0
je 0x14019fae7
add rcx, 8
add rsp, 0x28
jmp 0x1401a4550
lea rcx, [0x140266f27]
lea r8, str.Ro_
mov edx, 0x2b
call fcn.1401efaa0
int3
mov rcx, qword [rcx + 0x20]
jmp 0x1401a7690
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1401a76c4
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14019fb00
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx], 0
je 0x14019fb17
add rcx, 8
add rsp, 0x28
jmp 0x1401a4560
lea rcx, [0x140266f27]
lea r8, str.Ro_
mov edx, 0x2b
call fcn.1401efaa0
int3
mov rcx, qword [rcx + 0x20]
jmp 0x1401a76e0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1401a7714
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1401a0220
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x1401a7200
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rsp + 0x80]
mov ecx, 0xffffffff
cmp r9, rcx
cmovb rcx, r9
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 0
mov rcx, qword [rdx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov r8d, 1
call sub.ws2_32.dll_WSARecv
cmp eax, 0xffffffff
je 0x1401a727b
mov eax, dword [rsp + 0x38]
mov qword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x1401a729f
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x1401a728b
xor eax, eax
jmp 0x1401a729c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 2
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x1401a72b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rsp + 0x80]
mov ecx, 0xffffffff
cmp r9, rcx
cmovb rcx, r9
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x3c], 0
mov rcx, qword [rdx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x3c]
mov r8d, 1
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x1401a7321
mov eax, dword [rsp + 0x3c]
mov qword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x1401a7345
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x1401a7331
xor eax, eax
jmp 0x1401a7342
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 2
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x1401a7380
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 0
xor esi, esi
mov edx, 0xffff
mov r8d, 0x7010
xor r9d, r9d
call sub.ws2_32.dll_setsockopt
test eax, eax
je 0x1401a73b8
call sub.kernel32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x1401a7690
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx], 0
je 0x14019fae7
add rcx, 8
add rsp, 0x28
jmp 0x1401a4550
lea rcx, [0x140266f27]
lea r8, str.Ro_
mov edx, 0x2b
call fcn.1401efaa0
int3
mov rcx, qword [rcx + 0x20]
jmp 0x1401a7690
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1401a76c4
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1401a76e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp qword [rcx], 0
je 0x14019fb17
add rcx, 8
add rsp, 0x28
jmp 0x1401a4560
lea rcx, [0x140266f27]
lea r8, str.Ro_
mov edx, 0x2b
call fcn.1401efaa0
int3
mov rcx, qword [rcx + 0x20]
jmp 0x1401a76e0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1401a7714
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x1401c80d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x1401c8170
jmp 0x1401c815f
jae 0x1401c8230
cmp r8, 0x201
jae 0x1401c8170
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1401c81c8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x1401c819f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1401ee9c0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1401c81f1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1401c8298
mov r8d, r14d
cmp r15, r8
jne 0x1401c8150
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401c82c5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1401c815f
jmp 0x1401c8170
cmp rsi, r8
jb 0x1401c82df
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1401cace0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x1401c8281
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.14000e9a0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x1401c8269
jmp 0x1401c8281
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str._4_
mov edx, 0x28
call fcn.1401efaa0
jmp 0x1401c82f4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1401eff70
ud2