joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140089a18
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x668
movaps xmmword [rsp + 0x650], xmm6
mov rsi, rcx
mov rax, r8
shr rax, 0x3d
jne 0x140089aa7
movzx ebx, r9b
shl rbx, 7
sub rbx, 0xffffffffffffff80
shl r8, 3
cmp r8, rbx
jne 0x140089aa7
mov rdi, rdx
lea rcx, [rsp + 0x140]
mov r8d, 0xf4
xor edx, edx
call fcn.14010e350
call fcn.140089402
cmp eax, 3
je 0x140089a8a
mov eax, eax
lea r8, [rsp + 0x140]
mov rcx, rdi
mov edx, ebx
cmp eax, 2
jne 0x140089a9e
call fcn.1400e5540
jmp 0x140089aa3
lea r8, [rsp + 0x140]
mov rcx, rdi
mov edx, ebx
call fcn.140102a00
jmp 0x140089aa3
call fcn.1400e6a10
test eax, eax
je 0x140089ac2
mov dword [rsi], 2
movaps xmm6, xmmword [rsp + 0x650]
add rsp, 0x668
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [rsp + 0x358]
lea rbx, [rsp + 0x140]
mov r8d, 0xf4
mov rcx, rdi
mov rdx, rbx
call fcn.14010dca0
xorps xmm6, xmm6
movaps xmmword [rbx], xmm6
lea rbx, [rsp + 0x30]
lea r8, [rsp + 0x140]
mov rcx, rbx
mov rdx, rdi
call fcn.140089460
mov r14, qword [rbx]
mov rdi, qword [rbx + 8]
bswap r14
bswap rdi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rdi
xor eax, eax
cmp rax, 0x100
je 0x140089b30
movups xmmword [rsp + rax + 0x140], xmm6
add rax, 0x10
jmp 0x140089b1a
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x140]
mov r8d, 0x100
call fcn.14010dca0
call fcn.140089421
test al, al
je 0x140089b7e
mov rax, r14
shld rax, rdi, 1
shld rdi, r14, 1
sar r14, 0x3f
movabs rcx, 0xc200000000000000
and rcx, r14
xor rcx, rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
jmp 0x140089ba3
mov eax, dword [0x1401e3cbc]
not eax
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x20]
test eax, 0x10400000
jne 0x140089b9e
call fcn.1400e4560
jmp 0x140089ba3
call fcn.1400e3b40
lea rdi, [rsp + 0x450]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov rcx, rdi
call fcn.14010dca0
lea rcx, [rsp + 0x550]
lea rdx, [rsp + 0x358]
mov r8d, 0xf4
call fcn.14010dca0
lea rcx, [rsp + 0x14c]
mov r8d, 0x200
mov rdx, rdi
call fcn.14010dca0
and dword [rsi], 0
add rsi, 4
lea rdx, [rsp + 0x140]
mov r8d, 0x20c
mov rcx, rsi
call fcn.14010dca0
jmp 0x140089aad

Function at 0x14008e390
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
lea rbx, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.16.20_src_rand.rs
mov r12d, 0xffffffff
mov r13, qword [sym.imp.advapi32.dll_SystemFunction036]
mov r14, r15
cmp r15, rsi
jae 0x14008e3ef
mov rcx, rdi
mov rdx, rsi
mov r8, r14
mov r9, rbx
call fcn.140089439
mov r15, rdx
cmp rdx, r12
cmovae r15, r12
mov rcx, rax
mov edx, r15d
call r13
add r15, r14
test al, al
jne 0x14008e3bc
cmp r14, rsi
setb al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140093040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140020b80
cmp rax, rcx
je 0x140093065
cmp rdx, 4
jae 0x140093068
xor eax, eax
xor r8d, r8d
jmp 0x140093100
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140124070]
movdqa xmm3, xmmword [0x140124080]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140093090
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140093117
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140093100
ret
Function at 0x140094060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x1400940bb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1400940bb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x1400940d6
cmp eax, 0x42
jne 0x1400940bb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140094186
cmp byte [r9 + r11], 0x5f
jne 0x140094186
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1400941ee
mov rcx, rsi
xor edx, edx
call fcn.14008fac0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14008fac0
test al, al
jne 0x140094281
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140094112
lea rdx, [0x14016b9f3]
mov r8d, 1
call fcn.140020ff0
test al, al
jne 0x140094281
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400940ca
xor r14d, r14d
lea rbx, [0x14016bda8]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140094144
cmp byte [rax + rcx], 0x45
je 0x1400942a3
sub r14, 1
jb 0x140094169
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140094169
mov r8d, 2
mov rdx, rbx
call fcn.140020ff0
test al, al
jne 0x140094281
mov rcx, rsi
call fcn.1400912d0
test al, al
jne 0x140094281
mov rax, qword [rsi]
test rax, rax
jne 0x140094130
jmp 0x1400940ca
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140094248
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x1400941e2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400941cc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400941bb
add dl, 0xa9
jmp 0x1400941ca
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140094248
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140094248
movzx edx, bl
add rax, rdx
jae 0x140094190
jmp 0x140094248
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140094248
cmp rax, rcx
jae 0x140094245
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14009429b
cmp qword [rsi + 0x20], 0
je 0x140094294
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140094060
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400940cc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140094289
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x14016bd68]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.140020ff0
test al, al
je 0x140094289
mov dil, 2
jmp 0x1400940ca
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1400940ca
mov dil, 1
xor r8d, r8d
jmp 0x14009424a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400940ca
Function at 0x14009ecac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov ecx, ebx
call case.0x140067069.910
mov al, byte [rbx]
cmp al, 0x14
jne 0x14009ed11
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
movzx eax, word [rbx + 2]
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx

Function at 0x1400b698d
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400b69f6
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1400b6a2c
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x1400b6a25
lea r9, [0x14019ec14]
xor r10d, r10d
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp r8, r10
jne 0x1400b6a14
out dx, eax
mov dword [rsp + 0x98], edx
mov r15, qword [rcx + 0x10]
lea rsi, [r15*8]
test r15, r15
je 0x1400b6a7d
mov rax, r15
shr rax, 0x3c
jne 0x1400b6b32
mov rbx, qword [rcx]
mov ecx, 8
mov rdx, rsi
call fcn.1400b5eff
test rax, rax
je 0x1400b6b39
mov rdi, rax
xor eax, eax
mov rcx, qword [rbx + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne case.0x14001ed10.3020
mov eax, r15d
jmp 0x1400b6a84
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x60]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1400b6adb
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
mov esi, 1
jmp 0x1400b6b00
movaps xmm6, xmmword [rsp + 0x50]
mov ecx, 0x20
call fcn.1400b648b
invalid
dec dword [rax - 0x77]
ret
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm6
xor r14d, r14d
test r15, r15
je 0x1400b6b15
mov edx, 8
mov rcx, rdi
mov r8, rsi
call fcn.140002340
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14000ebd0
ud2
mov ecx, 8
mov rdx, rsi
call fcn.14011cc70
ud2
Function at 0x1400b70a6
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
lea eax, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400b70d0
mov rdx, qword [rsp + 0x20]
jmp 0x1400b70d8
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret

Function at 0x1400b7721
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
lea ecx, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400b774d
xor eax, eax
jmp 0x1400b7752
call fcn.1400b67d2
nop
add rsp, 0x38
invalid
cmp bl, al

Function at 0x1400bccf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
in al, dx
and byte [rax - 0x77], cl
rol byte [rdi + rcx - 0x4a], 1
mov dh, 0x4a
cmp byte [rdi + rcx - 0x4a], al
movzx eax, byte [rdx + 0x3a]
cmp dh, byte [rcx]
rol byte [rcx - 0x80], cl
stc
add dword [rdi + 0x4b], esi
ja case.0x14007998e.2402
movzx r11d, byte [rax + 0x10]
test r8b, r8b
jne case.0x1400846ba.2330
add byte [rax], al
invalid
cmp r11b, 5
jb case.0x1400846ba.2330
invalid
xchg esp, eax
add dword [rax], eax
invalid
mov r10, qword [rax]
mov rdx, qword [rax + 8]
xor esi, esi
test r9b, r9b
jne 0x1400bcd47
cmp r11b, 6
je 0x1400bcd47
mov esi, 2
cmp rdx, 2
jb 0x1400bcf5e
invalid
invalid
add al, byte [rax]
invalid
cmp rsi, rdx
jne 0x1400bce78
xor edx, edx
jmp case.0x1400846ba.2330
invalid
xor r10d, r10d
add rdx, r10
lea rdi, [r10 + rsi]
lea edi, [rdx + rsi]
inc rdi
lea r8, str.library_std_srcpath.rs
mov ecx, 2
add byte [rax], al
add al, ch
jno 0x1400bcf74
invalid
add byte [rdi], cl
invalid
Function at 0x1400c0590
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x1401e3bd8]
cmp rax, 3
jne 0x1400c075d
cmp rbx, 0x17f
ja 0x1400c076f
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14010dca0
mov byte [rsp + rbx + 0x60], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x1400c0608
xor edx, edx
nop
cmp byte [rsp + rdx + 0x60], 0
je 0x1400c06c4
inc rdx
cmp rax, rdx
jne 0x1400c05f0
jmp 0x1400c0724
lea rcx, [rsp + 0x67]
and rcx, 0xfffffffffffffff8
sub rcx, r15
je 0x1400c063e
je 0x1400c063e
xor edx, edx
nop word [rax + rax]
cmp byte [rsp + rdx + 0x60], 0
je 0x1400c06c4
inc rdx
cmp rcx, rdx
jne 0x1400c0620
lea rdx, [rbx - 0xf]
cmp rcx, rdx
jbe 0x1400c0644
jmp 0x1400c068e
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x1401240a0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rsp + rcx + 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400c068e
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400c0660
sub rax, rcx
je 0x1400c0724
invalid
lea r8, [rsp + rcx]
add r8, 0x60
call fcn.140120a40
cmp rbx, 0x17f
jbe 0x1400c05ca
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140120aa0
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.14000eda0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140120afa
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x140120b84
mov edx, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14000ea80
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140120b59
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140120b6c
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x140120b84
mov edx, 1
mov rcx, rdi
call fcn.14000ea80
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400c10a0
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
test dx, dx
test edx, edx
Function at 0x1400c11a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, rax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x1400c11f1
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400c1208
call qword [sym.imp.ws2_32.dll_WSAGetLastError]

Function at 0x1400c1220
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
in al, dx
and byte [rcx + rcx*4 - 0x40], cl

Function at 0x1400c1570
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400c15b3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1400be110]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14011d6a0
ud2

Function at 0x1400c5480
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
add al, byte [rax]
add byte [rax], al
Function at 0x1400cada0
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x80], xmm8
movdqa xmmword [rbp + 0x70], xmm7
movdqa xmmword [rbp + 0x60], xmm6
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov r15, r8
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x40]
mov rcx, rsi
call fcn.1400c606a
cmp byte [rdi + 0xc4], 0
je 0x1400cae0e
mov rcx, rbx
call fcn.1400c6d3a
xor ebx, ebx
mov rcx, qword [rdi + 0x50]
mov rax, qword [rdi + 0x60]
cmp rax, rcx
jne 0x1400cae2c
lea rcx, [rdi + 0x48]
call fcn.1400ca5e0
mov rcx, qword [rdi + 0x50]
mov rax, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x58]
add rdx, rax
xor r8d, r8d
cmp rdx, rcx
cmovae r8, rcx
sub rdx, r8
mov rcx, qword [rdi + 0x48]
shl rdx, 4
mov qword [rcx + rdx], rbx
mov byte [rcx + rdx + 8], 1
inc rax
mov qword [rdi + 0x60], rax
lock inc qword [rdi + 0x108]
mov rax, qword [rdi + 0x100]
test rax, rax
je 0x1400cae8e
lock dec qword [rdi + 0x100]
inc dword [rdi + 0xc0]
add rdi, 0xc8
mov rcx, rdi
call fcn.1400c6d57
jmp 0x1400cb32a
mov rax, qword [rdi + 0xf8]
cmp rax, qword [rdi + 0xf0]
je 0x1400cb32a
mov r14, qword [rdi + 0x98]
test r14, r14
je 0x1400cb492
lock inc qword [r14]
jle 0x1400cb48e
mov rbx, qword [rdi + 0xb8]
mov rax, qword [rdi + 0x30]
mov r8, qword [rdi + 0x38]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
lea rdx, [rcx + rax]
add rdx, 0x10
lea rcx, [rbp - 0x20]
call qword [r8 + 0x28]
mov r12, qword [rdi + 0x10]
test r12, r12
mov qword [rbp + 0x40], r14
je 0x1400caef9
mov r13, qword [rdi + 0x18]
jmp 0x1400caef9
mov r14, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
call 0x19052384d
lea rcx, str.assertion_failed:_shared.shutdown_tx.is_some__C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.32.0_src_runtime_blockingpool.rs
lea r8, [0x140175fc8]
push 0x2e
pop rdx
call fcn.14011d860
ud2

Function at 0x1400cb637
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400cb63e
test al, 1
je 0x1400cb65d
test al, 2
jne 0x1400cb672
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140175be0]
mov edx, 0x23
jmp 0x1400cb685
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140175c20]
mov edx, 0x25
call fcn.14011d860
ud2

Function at 0x1400cbf51
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400cad08
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
and al, 0x2c
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400cbf8c
xor eax, eax
jmp 0x1400cbf9a
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400cbfa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x60], rdx
mov r14, rcx
lea r12, [rsp + 0x72]
lea r15, [rcx + 0x18]
xor eax, eax
cmp qword [rcx + 0x18], 0xffffffffffffffff
cmove r15, rax
lea rbp, [rsp + 0x42]
mov rbx, qword [r8 + 8]
mov rdi, qword [r8 + 0x10]
mov rcx, rbx
sub rcx, rdi
mov qword [rsp + 0x48], r8
mov rax, qword [r8]
add rax, rdi
mov qword [rsp + 0x50], rax
mov eax, 0x7fffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x58], rcx
lea r13, [rsp + 0x68]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14

Function at 0x1400cc1f7
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rbp, [rsp + 0x3a]
lea r13, [rsp + 0x52]
lea r15, [rdx + 0x18]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
Function at 0x1400dcd1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3d8
movdqa xmmword [rsp + 0x3c0], xmm8
movdqa xmmword [rsp + 0x3b0], xmm7
movdqa xmmword [rsp + 0x3a0], xmm6
mov rbx, rcx
lea rsi, [rsp + 0x50]
mov rcx, rsi
call case.0x14001edcc.231
cmp byte [rsi + 0x2d], 4
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
jne 0x1400dcd70
cmp byte [rsp + 0x7c], 1
jne 0x1400dcd9f
mov rsi, qword [rsp + 0x70]
cmp r13, rsi
jae 0x1400dce53
mov r14d, 2
mov r13d, 0x2c0e
lea rdi, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001fx509_parser_0.8.2_srcx509_parser.rs
mov rcx, rsi
mov rdx, r14
mov r8, r13
mov r9, rdi
call fcn.140001023
mov r15, rax
mov r12, rdx
mov rcx, rsi
mov rdx, r14
mov r8, r13
mov r9, rdi
call case.0x140066cfa.452
mov rbp, rax
mov rdi, rdx
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.1400db0e2
mov dl, byte [rsi + 0x55]
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
cmp dl, 4
je 0x1400dcd68
mov qword [rsp + 0x308], rdi
lea rax, [rsp + 0x60]
lea r15, [rsp + 0xc0]
mov ecx, 0x45
mov rdi, r15
mov rsi, rax
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rax + 0x46]
mov byte [r15 + 0x45], dl
mov word [r15 + 0x46], ax
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, r15
call fcn.14002a071
mov rcx, r15
call fcn.1400dafca
mov al, byte [rsi + 0x18]
cmp al, 2
jne 0x1400dcf17
lea rcx, [rsp + 0x50]
call fcn.1400dc4e3
mov r14d, 2
mov r13d, 0x10e
jmp 0x1400dcd68
lea rsi, [rsp + 0x50]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x390], rcx
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x380], xmm0
mov edx, dword [rsi + 0x19]
mov dword [rsp + 0x29c], edx
mov edx, dword [rsi + 0x1c]
mov dword [rsp + 0x29f], edx
mov qword [rsp + 0x280], rcx
movdqa xmmword [rsp + 0x270], xmm0
mov byte [rsp + 0x288], al
mov eax, dword [rsp + 0x29c]
mov ecx, dword [rsp + 0x29f]
mov dword [rsp + 0x289], eax
mov dword [rsp + 0x28c], ecx
mov rcx, rsi
mov rdx, r14
mov r8, r13
mov r9d, 1
call fcn.14002a527
cmp byte [rsi + 0x55], 4
jne 0x1400dcfbc
movdqu xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0x115], 4
mov cl, 1
mov al, 4
mov r15, qword [rsp + 0xc0]
jmp 0x1400dd011
lea rsi, [rsp + 0x60]
mov r15, qword [rsi - 0x10]
mov r12, qword [rsi - 8]
mov ecx, 0x48
call fcn.1400db051
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
lea rdx, [rsp + 0x1c0]
and dword [rdx + 4], 0
mov qword [rdx + 8], rax
mov byte [rdx], 0x14
lea rsi, [rsp + 0xd0]
mov rcx, rsi
call fcn.140029ef7
mov qword [rsi - 0x10], r15
mov qword [rsi - 8], r12
mov al, byte [rsi + 0x45]
cmp al, 4
sete cl
test cl, cl
je 0x1400dd066
cmp r15, 1
ja 0x1400dd066
lea rcx, [rsp + 0xc0]
call fcn.1400dafba
lea rsi, [rsp + 0xd0]
mov r12, qword [rsi - 8]
lea rdi, [rsp + 0x130]
mov ecx, 0x45
rep movsb byte [rdi], byte [rsi]
cmp al, 4
add al, 0x75
invalid
cmp r15, 2
movzx r8d, word [rsp + 0x116]
lea rdi, [rsp + 0x210]
lea rsi, [rsp + 0x130]
xor byte [rcx], al
add byte [rax], al