joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140147380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1401d00e0]
test ecx, ecx
je 0x140147420
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1401473ac
cmp byte [rax + 8], 0
jne 0x14014741a
mov ecx, dword [0x1401d00e0]
test ecx, ecx
je 0x140147442
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14014745f
test rax, rax
jne 0x140147414
movzx eax, byte [0x1402792e0]
mov edx, 0x10
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x14014747e
lea rcx, [0x1401d00c8]
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x1401d00e0]
test ecx, ecx
je 0x140147468
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov word [rax + 8], 1
add rax, 9
jmp 0x140147461
lea rcx, [0x1401d00c8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1401473a6
jmp 0x1401473ac
lea rcx, [0x1401d00c8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1401473cb
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1401d00c8]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x140147406
mov ecx, 8
mov edx, 0x10
call fcn.140041910
int3

Function at 0x140147940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1401d00c0]
test ecx, ecx
je 0x140147972
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14014798b
cmp qword [rax + 8], 0
je 0x14014798b
add rax, 0x10
jmp 0x140147a2f
lea rcx, [0x1401d00a8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140147962
mov ecx, dword [0x1401d00c0]
test ecx, ecx
je 0x140147a10
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140147a2d
test rax, rax
jne 0x1401479f3
movzx eax, byte [0x1402792e0]
mov edx, 0x20
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x140147a4c
lea rcx, [0x1401d00a8]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401d00c0]
test ecx, ecx
je 0x140147a36
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov qword [rax + 8], 1
mov rcx, rax
add rax, 0x10
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 0
jmp 0x140147a2f
lea rcx, [0x1401d00a8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1401479a6
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1401d00a8]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x1401479e5
mov ecx, 8
mov edx, 0x20
call fcn.140041910
int3
Function at 0x14014bac0
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov rax, r8
mov rsi, rcx
mov dword [rbp + 8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 7
mov qword [rbp + 0x24], 0
mov word [rbp + 0x2c], 0
mov byte [rbp + 0x28], 1
lea r8, [rbp + 8]
mov rcx, rdx
mov rdx, rax
call fcn.140164170
mov rdi, rdx
test rax, rax
je 0x14014bb47
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rdi
call fcn.140145310
mov qword [rsi], 0
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 8]
mov rdx, rdi
call fcn.140164940
cmp dword [rbp + 8], 2
jne 0x14014bb6b
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 2
jmp 0x14014bb9a
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
movups xmm2, xmmword [rbp + 0x28]
movups xmm3, xmmword [rbp + 0x38]
movaps xmmword [rbp - 0x40], xmm0
mov rax, qword [rbp + 0x48]
mov qword [rbp], rax
movaps xmmword [rbp - 0x10], xmm3
movaps xmmword [rbp - 0x20], xmm2
movaps xmmword [rbp - 0x30], xmm1
cmp qword [rbp - 0x40], 2
jne 0x14014bbc3
lea rcx, [rbp - 0x38]
call fcn.140145310
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rbp - 8]
test rdi, rdi
je 0x14014bc11
mov qword [rbp - 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x14014bc8d
mov rbx, qword [rbp - 0x40]
jmp 0x14014bc13
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x14014bc7c
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x14014bc7c
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x14014bcb6
mov qword [rsi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x14014bcb6
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 8], 1
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], rax
call fcn.140145310
mov qword [rsi], 0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
jmp 0x14014bb35
Function at 0x140165d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi

Function at 0x1401662c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8

Function at 0x140167060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x1401d0100]
test ecx, ecx
je 0x140167092
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1401670ab
cmp qword [rax + 8], 0
je 0x1401670ab
add rax, 0x10
jmp 0x140167180
lea rcx, [0x1401d00e8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140167082
mov ecx, dword [0x1401d0100]
test ecx, ecx
je 0x140167161
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14016717e
test rax, rax
jne 0x140167127
mov qword [rbp - 8], 0
lea rax, [0x1401d00e8]
mov qword [rbp - 0x10], rax
movzx eax, byte [0x1402792e0]
mov edx, 0x18
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x1401671a0
mov rcx, qword [rbp]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
mov ecx, dword [0x1401d0100]
test ecx, ecx
je 0x140167187
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov rdx, rax
add rax, 0x10
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 8], 0
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], 0
je 0x140167180
test rcx, rcx
je 0x140167180
lock dec qword [rcx]
jne 0x140167180
mov rsi, rax
call fcn.1401671d0
mov rax, rsi
jmp 0x140167180
lea rcx, [0x1401d00e8]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1401670ca
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x1401d00e8]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x140167119
mov ecx, 8
mov edx, 0x18
call fcn.140041910
ud2
Function at 0x1401678b0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x140279288]
cmp rax, 3
jne 0x140167aa0
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x140167ac6
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x140167948
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140167a04
inc rdx
cmp rax, rdx
jne 0x140167930
jmp 0x140167a6b
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x14016797e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140167a04
inc rdx
cmp rcx, rdx
jne 0x140167960
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x140167982
jmp 0x1401679ce
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x1401da060]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1401679ce
add rcx, 0x10
cmp rcx, rdx
jbe 0x1401679a0
sub rax, rcx
je 0x140167a6b
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x140167a01
inc rdx
cmp rax, rdx
jne 0x1401679f0
jmp 0x140167a6b
add rdx, rcx
cmp rdx, rdi
jne 0x140167a6b
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x140167a7f
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140167a97
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140167ad8
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x140167ad8
mov rbx, rdx
call fcn.140167f90
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x140167907
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.140168000
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140168000
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x140168223
js 0x14016822f
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x1402792e0]
xor ecx, ecx
mov rdx, r14
call fcn.1401685e0
test rax, rax
je 0x140168234
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call sub.msvcrt.dll_memcpy
cmp rbx, 0x10
jae 0x140168098
test rbx, rbx
je 0x14016813f
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1401681a5
inc rax
cmp rbx, rax
jne 0x140168080
jmp 0x14016813f
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x1401680f0
lea rcx, [rbx - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x1401da070]
movabs rdx, 0x8080808080808080
nop dword [rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x14016811c
add rax, 0x10
cmp rax, rcx
jbe 0x1401680c0
jmp 0x14016811c
cmp rax, rbx
cmovae rax, rbx
xor ecx, ecx
nop dword [rax]
cmp byte [r15 + rcx], 0
je 0x1401681a5
inc rcx
cmp rax, rcx
jne 0x140168100
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x1401680ab
cmp rax, rbx
je 0x14016813f
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1401681a5
inc rax
cmp rbx, rax
jne 0x140168130
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.140041ac0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1401681dd
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401681f1
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x140168211
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, r12
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.1401abdbc
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x140168211
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, rbx
call fcn.1401abdbc
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.140049c70
call fcn.1400418d0
mov ecx, 1
mov rdx, r14
call fcn.1400418b0
int3
Function at 0x14016cd00
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov eax, 1
test rcx, rcx
jne 0x14016ce84
mov rax, qword [0x140279288]
cmp rax, 3
jne 0x14016ce8f
mov r14, rdx
cmp word [rdx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14016cd9a
cmp word [r14], 0
je 0x14016ce0b
movups xmm0, xmmword [r14 + 4]
mov eax, dword [r14 + 0x14]
mov edx, dword [r14 + 0x18]
movzx ecx, word [r14 + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x14016ce22
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x14016cdb3
mov ebx, eax
cmp eax, 0x2726
jne 0x14016ce74
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14016ce6d
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x14016cd6d
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov rcx, rsi
call sub.ws2_32.dll_closesocket
jmp 0x14016ce74
mov eax, dword [r14 + 2]
movzx ecx, word [r14 + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r9w, 2
rol cx, 8
mov word [rbp - 0x1c], r9w
mov word [rbp - 0x1a], cx
mov dword [rbp - 0x18], eax
movups xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], edx
lea rdx, [rbp - 0x1c]
mov rcx, rsi
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
je 0x14016ce51
xor eax, eax
mov rdx, rsi
jmp 0x14016ce84
call sub.ws2_32.dll_WSAGetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov rdx, rdi
jmp 0x14016ce7f
call sub.ws2_32.dll_WSAGetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rdx, rbx
mov eax, 1
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rsi, rdx
call fcn.140167f90
mov rdx, rsi
jmp 0x14016cd2e
Function at 0x14016cee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x1401d0120]
test ecx, ecx
je 0x14016cfaf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14016cf11
cmp qword [rax + 8], 0
jne 0x14016cfa9
mov ecx, dword [0x1401d0120]
test ecx, ecx
je 0x14016cfd1
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14016cfee
mov rsi, rax
test rax, rax
jne 0x14016cf81
movzx eax, byte [0x1402792e0]
mov edx, 0x20
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x14016d010
lea rcx, [0x1401d0108]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401d0120]
test ecx, ecx
je 0x14016cff7
dec ecx
mov rsi, rax
mov rdx, rax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm0, xmmword [rbp - 0x10]
mov rax, rsi
mov qword [rsi + 8], 1
movups xmmword [rsi + 0x10], xmm0
add rax, 0x10
jmp 0x14016cff0
lea rcx, [0x1401d0108]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14016cf06
jmp 0x14016cf11
lea rcx, [0x1401d0108]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14016cf30
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x1401d0108]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x14016cf76
mov ecx, 8
mov edx, 0x20
call fcn.140041910
int3
Function at 0x14016ed10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14016ed52
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14016ed5a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14016ed6b
jmp 0x14016ed82
xor r10d, r10d
jmp 0x14016ee0d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14016ed82
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14016ed99
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14016edb9
add r11, r8
jmp 0x14016eeeb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14016ee82
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14016ee30
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14016eea0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14016eeb2
jmp 0x14016eecd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14016eecd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14016eee7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14016ef00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x1401d0168]
test ecx, ecx
je 0x14016f045
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14016ef2e
cmp qword [rax + 8], 0
jne 0x14016f07d
mov ecx, dword [0x1401d0168]
test ecx, ecx
je 0x14016f08a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14016f0a7
test rax, rax
jne 0x14016ef9e
movzx eax, byte [0x1402792e0]
mov edx, 0x60
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x14016f0cb
lea rcx, [0x1401d0150]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1401d0168]
test ecx, ecx
je 0x14016f0b2
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov rcx, qword [rax + 0x58]
mov qword [rsp + 0x70], rcx
movups xmm0, xmmword [rax + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax + 8]
movups xmm1, xmmword [rax + 0x18]
movups xmm2, xmmword [rax + 0x28]
movups xmm3, xmmword [rax + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rax + 8], 1
movups xmm0, xmmword [0x14020e7e0]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [0x14020e7d0]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x14020e7c0]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x14020e7b0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14020e7a0]
movups xmmword [rax + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x14016f07d
mov rdx, qword [rsp + 0x30]
cmp rdx, 2
je 0x14016f07d
lea rcx, [rsp + 0x38]
test rdx, rdx
je 0x14016f067
mov rdx, qword [rsp + 0x38]
lock dec qword [rdx]
jne 0x14016f07d
mov rsi, rax
call fcn.14016dbf0
jmp 0x14016f07a
lea rcx, [0x1401d0150]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14016ef23
jmp 0x14016ef2e
mov rdx, qword [rsp + 0x38]
lock dec qword [rdx]
jne 0x14016f07d
mov rsi, rax
call fcn.14016db30
mov rax, rsi
add rax, 0x10
add rsp, 0x80
pop rsi
ret
lea rcx, [0x1401d0150]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14016ef4d
xor eax, eax
add rsp, 0x80
pop rsi
ret
lea rcx, [0x1401d0150]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x14016ef90
mov ecx, 8
mov edx, 0x60
call fcn.140041910
int3
Function at 0x140171fb0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x30], r8
mov rsi, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x140172147
mov r14, qword [rdx]
cmp r9, 0x7fffffff
mov r15d, 0x7fffffff
cmovb r15, r9
mov r12, qword [rcx + 0x20]
jmp 0x140172025
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, rbp
call fcn.1401abdbc
dec r13
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, r13
call fcn.1401abdbc
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov r8, r14
mov r9b, 1
call fcn.140171920
movzx eax, byte [rsp + 0x29]
cmp al, 3
je 0x140172163
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x14017217d
movzx edi, byte [rsp + 0x28]
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
mov r8d, r15d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x140172187
call sub.ws2_32.dll_WSAGetLastError
mov r13d, eax
shl r13, 0x20
or r13, 2
mov rcx, r13
call fcn.1400699e0
cmp al, 0xd
jne 0x1401720c2
test r12, r12
je 0x1401720c2
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
lock inc qword [rdx]
jle 0x1401721a0
add rcx, 0x10
mov r8, qword [r12 + 0x10]
movzx r9d, byte [r12 + 0x18]
call fcn.140068820
test rax, rax
cmovne r13, rax
mov rcx, r13
call fcn.140074110
cmp al, 0xd
jne 0x140172176
and ebp, 0x23
mov rax, qword [rsi + 0x90]
mov ecx, edi
shl ecx, 0x10
xor rbp, 0x2f
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14017210c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [rsi + 0x90], rdx
jne 0x1401720f0
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x140172025
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rcx, rbp
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x140172011
cmp qword [rdi + 0x10], 0x11
jb 0x140172000
mov rbp, qword [rbp - 8]
jmp 0x140172000
mov r8, qword [rdx]
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov r9b, 1
call fcn.140171920
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x14017216d
mov eax, 2
mov r13, rbp
jmp 0x14017218c
cmp al, 2
jne 0x1401721a2
mov r13, qword [rsp + 0x20]
mov eax, 1
jmp 0x14017218c
mov eax, 1
mov r13, rbp
jmp 0x14017218c
movsxd r13, eax
xor eax, eax
mov rdx, r13
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str._home_dreamingcodes_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_io_poll_evented.rs
call fcn.140049c70
int3