joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005e2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1800b44b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x18005e314
mov rcx, qword [rdx]
jmp 0x18005e317
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x18005e337
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.18005e080
jmp 0x18005e478
xor r15d, r15d
bt eax, 0xa
jae 0x18005e438
cmp qword [rdi + 0x18], 8
jb 0x18005e350
mov rdx, qword [rdi]
jmp 0x18005e353
mov rdx, rdi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rdx], r15w
jne 0x18005e372
mov r8, r15
jmp 0x18005e380
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x18005e376
lea rcx, [rsp + 0x50]
call fcn.1800046a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x68], 8
jb 0x18005e3da
mov rcx, qword [rsp + 0x50]
call fcn.180022e04
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp rbx, 0xffffffffffffffff
jne 0x18005e405
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.18005e080
nop
jmp 0x18005e478
mov rcx, rdi
call fcn.18005dc90
test al, al
jne 0x18005e42f
mov edx, ebp
mov rcx, rdi
call fcn.18005dd60
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005e478
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x18005e449
mov dword [r14], r15d
call fcn.180060ae0
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x18005e464
mov dword [rsp + 0x40], 2
call fcn.18005dd60
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180022a00
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14000d61d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140018ae4
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002fc3
test rax, rax
je 0x140018b0f
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400306c0
Function at 0x14001998e
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002fc3
test rax, rax
je 0x1400199b5
mov qword [rsi], rax
mov byte [rsi + 0x68], 2
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14003626b

Function at 0x1400199c6
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002fc3
test rax, rax
je 0x1400199ee
mov qword [rsi], rax
and qword [rsi + 0x18], 0
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140032f48
Function at 0x140041f3a
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rcx + 8], rdx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x140041f96
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
mov byte [rsi], 0x19
jmp 0x140041fa1
call sub.KERNEL32.dll_GetLastError
mov byte [rsi], reloc.WS2_32.dll_send
mov dword [rsi + 4], eax
add rsp, 0x60
pop rsi
ret

Function at 0x14007c224
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test cl, cl
je 0x14007c241
mov rcx, rdx
mov rdx, r8
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.140155c80
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.1401543d0
mov rdi, qword [rsi]
mov rsi, qword [rsi + 8]
test rsi, rsi
je 0x14007c285
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14007c290
xor ebx, ebx
test rdi, rdi
mov edi, 0
je 0x14007c285
mov edx, 2
mov rcx, rsi
call fcn.1400576f0
mov rdi, rbx
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
mov rdi, rbx
jne 0x14007c275
jmp 0x14007c285
Function at 0x140086f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140086fe0
cmp r10, rax
jb 0x140087054
cmp r10, rdx
ja 0x140087068
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140086fe2
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140086fc0
jmp 0x140087043
ja 0x140086fea
mov rax, r10
cmp r11, r8
jne 0x140086f92
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140087020
mov r15, rbx
sub ecx, edx
jns 0x14008703a
jmp 0x140087045
cmp rbx, r14
je 0x140087079
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140087045
xor al, 1
cmp r15, r14
jne 0x140087000
jmp 0x140087045
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140332f90
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140332d00
ud2
lea rcx, [0x140438bf0]
lea r8, str._y4_
mov edx, 0x2b
call fcn.140332d10
ud2
Function at 0x14008c205
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r9, r8
mov rax, rdx
not ecx
lea rbx, [0x14034b698]
mov r15d, 0xff
lea r14, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x14008c333
mov edi, 4
sub rdi, 1
jb 0x14008c22d
cmp r9, 0xf
jbe 0x14008c35e
movzx edx, byte [rax + 0xf]
movzx ebp, byte [rax + 0xe]
mov ebp, dword [rbx + rbp*4 + 0x400]
xor ebp, dword [rbx + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rbx + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rbx + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rbx + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rbx + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rbx + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rbx + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rbx + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rbx + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rbx + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rbx + rdx*4 + 0x2c00]
movzx edx, byte [rax + 3]
mov esi, ecx
shr esi, 0x18
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3000]
movzx edx, byte [rax + 2]
mov esi, ecx
shr esi, 0x10
and esi, r15d
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3400]
movzx edx, byte [rax + 1]
mov esi, ecx
shr esi, 8
and esi, r15d
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3800]
movzx edx, byte [rax]
and ecx, r15d
xor rcx, rdx
xor ebp, dword [rbx + rcx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, r14
call fcn.14008c861
mov r9, rdx
mov ecx, ebp
jmp 0x14008c23c
xor ebp, ebp
cmp r9, rbp
je 0x14008c34d
mov dl, byte [rax + rbp]
xor dl, cl
movzx edx, dl
shr ecx, 8
xor ecx, dword [rbx + rdx*4]
inc rbp
jmp 0x14008c335
not ecx
mov eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.3.2_src_baseline.rs
mov ecx, reloc.WS2_32.dll_ntohs
mov rdx, r9
call fcn.140332c70
ud2
Function at 0x14009869c
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx]
xor r11d, r11d
movabs r10, 0x100000001b3
cmp r8, r11
je 0x1400986c2
movzx eax, byte [rdx + r11]
xor r9, rax
imul r9, r10
inc r11
jmp 0x1400986ac
mov qword [rcx], r9
ret

Function at 0x1400bb551
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, dword [rdx + 2]
movzx eax, word [rdx + 6]
shl rax, 0x20
or rax, r8
cmp word [rdx], 0
je 0x1400bb5bf
movzx r8d, word [rdx + 0x1c]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
rol r8w, 8
shr rax, 0x10
mov dword [rcx + 8], eax
mov rax, qword [rdx + 8]
mov qword [rcx + 0xc], rax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x14], eax
xorps xmm0, xmm0
movups xmmword [rcx + 0x1c], xmm0
movups xmmword [rcx + 0x2c], xmm0
movups xmmword [rcx + 0x3c], xmm0
movups xmmword [rcx + 0x4c], xmm0
movups xmmword [rcx + 0x5c], xmm0
movups xmmword [rcx + 0x6c], xmm0
and dword [rcx + 0x7c], 0
mov word [rcx], reloc.WS2_32.dll_socket
mov dword [rcx + 0x18], r10d
mov edx, 0x1c
mov eax, r9d
jmp 0x1400bb5f9
mov r8, rax
shr r8, 0x20
rol r8w, 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x70], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
mov word [rcx], 2
and qword [rcx + 8], 0
mov edx, reloc.WS2_32.dll_recv
mov word [rcx + 2], r8w
mov dword [rcx + 4], eax
mov dword [rcx + 0x80], edx
ret
Function at 0x1400c8c7d
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
cmp qword [rdi + 0x18], 0
setne cl
call fcn.14009f882
cmp qword [rdi + 0x18], 0
je 0x1400c8cb4
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14009869c
mov cl, byte [rdi]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14009f8a5

Function at 0x1400ce473
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
lea rdx, [0x14040d2b8]
mov r8d, 1
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400ce4ab
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call fcn.1400e0a6a
nop
add rsp, 0x28
ret
Function at 0x1400e1375
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x40]
lea rcx, [rax - 2]
cmp rcx, 2
jae 0x1400e13ac
mov edx, 1
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400e14ac
test rax, rax
jne 0x1400e14a0
lea rcx, [rsi + 0x20]
cmp qword [rsi + 0x30], 0
je 0x1400e13cc
mov rax, qword [rsi + 0x38]
mov rdx, qword [rax]
and edx, 0xe
jmp 0x1400e13ce
xor edx, edx
lea r14, [rsi + 0x40]
call fcn.1400e14d0
mov r15, qword [rbx]
lea rdx, [rsp + 0x50]
and dword [rdx], 0
lea rax, [r15 + 0x90]
lea rcx, str.description___is_deprecated__use_Displaycalled__Option::unwrap____on_a__None__value
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x38]
and dword [rdi], 0
lea rbx, [rsp + 0x3c]
and dword [rbx], 0
mov rcx, qword [r15 + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
and qword [rsp + 0x30], 0
mov r8d, 1
mov r9, rbx
call sub.WS2_32.dll_WSARecv
mov r8d, dword [rbx]
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov edx, eax
call fcn.1400e23db
mov rax, qword [rbx]
cmp rax, 1
je 0x1400e1464
cmp eax, 2
jne 0x1400e1489
mov rdi, qword [rsp + 0x48]
mov rcx, r14
call fcn.1400e151b
mov qword [rsi + 0x40], 3
mov qword [rsi + 0x48], rdi
jmp 0x1400e147a
cmp byte [rsi + 0x78], 0
je 0x1400e1489
mov rcx, r14
call fcn.1400e151b
mov qword [rsi + 0x40], 2
mov edx, 1
mov rcx, rsi
call fcn.1400e14ac
jmp 0x1400e14a0
mov rcx, r14
call fcn.1400e151b
mov qword [r14], 1
lock inc qword [r15 + 0xe8]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400e197d
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, r9
mov rbx, r8
mov r13, rdx
mov rsi, rcx
lea rcx, [r9 + 0x20]
cmp qword [r9 + 0x30], 0
je 0x1400e19b3
mov rax, qword [rdi + 0x38]
mov rdx, qword [rax]
and edx, 0xd
jmp 0x1400e19b5
xor edx, edx
mov qword [rsp + 0x50], rcx
call fcn.1400e14d0
mov r12, qword [rsi]
lea rbp, [r12 + 0xb8]
mov r15, qword [r13 + 0x10]
mov qword [rsp + 0x48], rdi
mov r14b, byte [rdi + 0x78]
mov qword [rsp + 0x58], rbx
mov rsi, rbx
mov rdi, r15
sub rdi, rsi
jb 0x1400e1bc0
mov rbx, qword [r13 + 8]
lea rax, [rbx + rsi]
mov ecx, 0xffffffff
cmp rdi, rcx
mov ecx, 0xffffffff
cmovb rcx, rdi
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x78], rax
and dword [rsp + 0x44], 0
mov rcx, qword [r12 + 0xe0]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbp
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov r8d, 1
lea r9, [rsp + 0x44]
call sub.WS2_32.dll_WSASend
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x60]
mov edx, eax
call fcn.1400e23db
mov rax, qword [rsp + 0x60]
cmp rax, 1
jne 0x1400e1a7a
test r14b, r14b
je 0x1400e1b28
mov rax, qword [rsp + 0x68]
cmp rax, rdi
je 0x1400e1b63
add rsi, rax
jmp 0x1400e19df
cmp eax, 2
jne 0x1400e1b2d
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
lea rcx, [rdi + 0x50]
call fcn.1400e1712
mov qword [rdi + 0x50], 3
mov qword [rdi + 0x58], rsi
mov edx, 2
mov rcx, rdi
call fcn.1400e14ac
mov rsi, qword [r13]
mov rax, qword [rdi + 0x28]
cmp rax, 2
jne 0x1400e1b89
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400e1b89
add rdx, 0x20
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.1400e0ba1
lea rdx, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823mio_0.6.23_src_syswindows_selector.rs
mov rcx, rdi
call fcn.1400e166c
mov rdi, rax
mov ebp, edx
mov rax, qword [rax + 0x20]
cmp rax, qword [rdi + 0x10]
jae 0x1400e1ba9
mov rcx, qword [rdi + 0x18]
imul rdx, rax, 0x18
mov qword [rcx + rdx], rsi
mov qword [rcx + rdx + 8], rbx
and qword [rcx + rdx + 0x10], 0
inc rax
mov qword [rdi + 0x20], rax
jmp 0x1400e1bb4
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
lea rcx, [rdi + 0x50]
call fcn.1400e1712
mov qword [rdi + 0x50], 1
movups xmm0, xmmword [r13]
movups xmmword [rdi + 0x58], xmm0
mov rax, qword [r13 + 0x10]
mov qword [rdi + 0x68], rax
mov qword [rdi + 0x70], rsi
lock inc qword [r12 + 0xe8]
jmp 0x1400e1b94
mov edx, 2
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call fcn.1400e14ac
lea rcx, [rsi + 0x50]
call fcn.1400e1712
and qword [rsi + 0x50], 0
mov rcx, qword [r13]
jmp 0x1400e1b8c
mov rcx, rsi
mov rdx, rbx
call fcn.140059ae6
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
mov rdx, rbx
call fcn.140059ae6
mov rcx, rdi
mov edx, ebp
call fcn.1400e1598
jmp 0x1400e1b94
lea r8, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823mio_0.6.23_src_syswindows_tcp.rs
mov rcx, rsi
mov rdx, r15
call fcn.140332cf0
ud2
Function at 0x1400e385d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r12, rdx
add rdx, 0x28
cmp qword [r12 + 0x20], 0
je 0x1400e38ad
cmp qword [r12 + 0x58], 0xffffffffffffffff
mov r8, qword [r12]
mov r9, qword [r12 + 8]
mov rax, qword [r12 + 0x10]
mov rbp, qword [r12 + 0x18]
je 0x1400e399f
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x1400e39ae
mov r14b, byte [r12 + 0x3a]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov r8, qword [r12 + 0x28]
mov r15b, byte [r12 + 0x38]
xor r11d, r11d
test r14b, r14b
jne 0x1400e39d6
mov ebx, r15d
xor bl, 1
mov byte [r12 + 0x38], bl
test r8, r8
je 0x1400e38f8
cmp r9, r8
jbe 0x1400e38f2
cmp byte [r10 + r8], 0xbf
jg 0x1400e38f8
jmp 0x1400e39e8
jne 0x1400e39e8
cmp r8, r9
je 0x1400e39b5
mov al, byte [r10 + r8]
movzx ebp, al
test bpl, bpl
jns 0x1400e395b
mov esi, ebp
and esi, 0x1f
movzx edi, byte [r10 + r8 + 1]
and edi, 0x3f
cmp bpl, 0xdf
jbe 0x1400e394d
movzx ebp, byte [r10 + r8 + 2]
shl edi, 6
and ebp, 0x3f
or ebp, edi
cmp al, 0xf0
jb 0x1400e3956
movzx eax, byte [r10 + r8 + 3]
and esi, 7
shl esi, 0x12
shl ebp, 6
and eax, 0x3f
or eax, ebp
or eax, esi
mov ebp, eax
jmp 0x1400e395b
shl esi, 6
or esi, edi
mov ebp, esi
jmp 0x1400e395b
shl esi, 0xc
or ebp, esi
test r15b, r15b
jne 0x1400e39c5
cmp ebp, 0x110000
je 0x1400e39ba
mov eax, 1
cmp ebp, 0x80
jb 0x1400e3991
mov eax, 2
cmp ebp, 0x800
jb 0x1400e3991
cmp ebp, 0x10000
mov eax, 4
sbb rax, 0
add r8, rax
mov qword [rdx], r8
mov r15d, ebx
jmp 0x1400e38c8
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
call fcn.1400e3ad1
jmp 0x1400e39d9
test r15b, r15b
jne 0x1400e39c8
mov byte [r12 + 0x3a], 1
xor r11d, r11d
jmp 0x1400e39d6
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r11d, 1
mov qword [rcx], r11
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str._rustc_2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.1403331a0
ud2

Function at 0x1400e3efa
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400e3f26
xor eax, eax
jmp 0x1400e3f2b
call fcn.1400e152a
nop
add rsp, 0x38
ret
Function at 0x1400f6279
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, r9
mov rsi, r8
mov r9, rdx
mov r14, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
lea rdi, [r8*8]
movabs rax, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
mov rbx, r14
test rdi, rdi
je 0x1400f62ea
movzx ebp, byte [rbx + 4]
xor rax, rbp
imul rax, rdx
movzx ebp, byte [rbx + 5]
xor rbp, rax
mov eax, dword [rbx]
add rbx, 8
imul rbp, rdx
xor rax, rbp
imul rax, rdx
add rdi, 0xfffffffffffffff8
jmp 0x1400f62bc
mov rbp, qword [rsi + 0x18]
test rbp, rbp
je 0x1400f6445
xor edx, edx
div rbp
mov r12, rdx
mov rax, qword [rsi + 0x10]
mov r13, rdx
shl r13, 5
movzx edx, word [rax + r13 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x1400f635c
cmp qword [rax + r13 + 0x10], r8
jne 0x1400f635c
mov rdi, qword [rax + r13 + 8]
xor ebp, ebp
cmp r8, rbp
je 0x1400f6418
mov rdx, rbp
mov bl, byte [rdi + rbp*8 + 4]
cmp bl, byte [r14 + rbp*8 + 4]
jne 0x1400f6353
mov bl, byte [r14 + rdx*8 + 5]
cmp byte [rdi + rdx*8 + 5], bl
jne 0x1400f6353
lea rbp, [rdx + 1]
mov ebx, dword [rdi + rdx*8]
cmp ebx, dword [r14 + rdx*8]
je 0x1400f6324
cmp rdx, r8
jae 0x1400f6418
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, r14
mov rbx, r9
call fcn.1400f6470
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.1400f6475
mov rax, qword [rbp]
cmp rax, 9
jne 0x1400f63f8
mov rdx, qword [rsi + 0x18]
cmp rdx, r12
jbe 0x1400f645f
mov edi, dword [rsp + 0x48]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi + 0x10]
mov rcx, qword [rsi + r13]
mov rdx, qword [rsi + r13 + 8]
call fcn.14005ef5d
mov rax, qword [r15 + 0x10]
mov qword [rsi + r13 + 0x10], rax
movups xmm0, xmmword [r15]
movups xmmword [rsi + r13], xmm0
mov dword [rsi + r13 + 0x18], edi
mov word [rsi + r13 + 0x1c], bp
mov rbx, qword [rsp + 0x20]
mov dword [rbx + 8], edi
mov qword [rbx], 9
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x4c]
mov edx, dword [rsi - 4]
mov rbx, qword [rsp + 0x20]
lea rdi, [rbx + 0xc]
mov ecx, 0x1f
rep movsd dword [rdi], dword [rsi]
mov qword [rbx], rax
mov dword [rbx + 8], edx
jmp 0x1400f6427
mov eax, dword [rax + r13 + 0x18]
mov dword [rcx + 8], eax
mov qword [rcx], 9
mov rcx, qword [r15]
mov rdx, r14
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14005ef5d
lea rcx, [0x1403a4230]
lea r8, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_automata_0.3.8_src_nfa_thompsonmap.rs
mov edx, 0x39
call fcn.140332d10
ud2
lea r8, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_automata_0.3.8_src_nfa_thompsonmap.rs
mov rcx, r12
call fcn.140332c70
ud2