joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14012a110]
test ecx, ecx
je 0x1400d0319
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400d0274
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400d0274
add rdi, 0x10
jmp 0x1400d030f
mov ecx, dword [0x14012a110]
test ecx, ecx
je 0x1400d032c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400d030d
mov rsi, rax
test rax, rax
jne 0x1400d02dc
movzx eax, byte [0x140195158]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400d034f
mov rsi, rax
lea rax, [0x14012a0f8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14012a110]
test ecx, ecx
je 0x1400d033f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400d030f
test rcx, rcx
je 0x1400d030f
lock dec qword [rcx]
jne 0x1400d030f
call fcn.1400d0360
jmp 0x1400d030f
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14012a0f8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400d0256
lea rcx, [0x14012a0f8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400d0284
lea rcx, [0x14012a0f8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400d02d4
mov ecx, 8
mov edx, 0x18
call fcn.1400024c0
int3
Function at 0x1400d82d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.1400aecb0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, rbx
jne 0x1400d830d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
jmp 0x1400d833a
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400d8200
mov r14, qword [rsp + 0x28]
cmp r14, rbx
jne 0x1400d8353
lea rcx, [rsp + 0x30]
call fcn.1400ac5c0
mov qword [rsi], rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400d8377
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400d8347
mov qword [rsi], rbx
test r14, r14
je 0x1400d8347
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400f4d54
Function at 0x1400d9e90
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov r14, rdx
mov rbx, rcx
movzx eax, byte [0x140195158]
mov edx, 0x10
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400d9f59
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400d9fd0]
xor edi, edi
xor ecx, ecx
mov rdx, rbx
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x1400d9f4c
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rdi
call qword [r14]
cmp qword [r14 + 8], 0
je 0x1400d9f27
cmp qword [r14 + 0x10], 0x11
jb 0x1400d9f16
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, rdi
call fcn.1400f4d54
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, rsi
call fcn.1400f4d54
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400024c0
ud2

Function at 0x1400da2b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.1400f4bb0
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xorps xmm6, xmm6
lea r15, [rsp + 0x3c]
lea rbx, [0x1400d1a90]
lea r13, [rsp + 0x60]
lea r12, [0x14012f068]
mov qword [rsp + 0x48], rdi

Function at 0x1400da7d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400da806
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1400cc4d0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.140004c80
ud2
Function at 0x1400dcbc0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400dcd09
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x1400dcbf7
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400dccf3
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400dccd6
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x1400dcc58
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1400dcc89
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x1400dcc8d
call sub.KERNEL32.dll_GetLastError
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x1400dcc91
cmp eax, 0x6d
jne 0x1400dccbc
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x1400dcc96
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400dccc2
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400ac5c0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400dcccc
cmp rax, 1
je 0x1400dcc41
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x1400dcc4b
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400b2420
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x1400dcc04
mov r8d, 0x10
mov rcx, rbx
call fcn.1400b2420
mov rax, qword [rbx]
jmp 0x1400dcbf7
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400dcd20
int3
Function at 0x1400e1b30
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x1400e1b5b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x1401950f8]
cmp rax, 3
jne 0x1400e1cd7
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400e1bd0
cmp word [rbx], 0
je 0x1400e1c46
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x1400e1c5b
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x1400e1bea
mov r14d, eax
cmp eax, 0x2726
jne 0x1400e1cc6
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400e1cbe
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x1400e1ba8
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x1400e1cc6
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x34], r9w
mov word [rsp + 0x36], cx
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], edx
lea rdx, [rsp + 0x34]
mov rcx, rdi
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
je 0x1400e1c99
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1400e1b50
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x1400e1b50
call sub.ws2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x1400e1b49
call fcn.1400d0e00
jmp 0x1400e1b6c
Function at 0x1400e1d30
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14012a130]
test ecx, ecx
je 0x1400e1e26
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e1d60
cmp qword [rax + 8], 0
je 0x1400e1d60
add rax, 0x10
jmp 0x1400e1e20
mov ecx, dword [0x14012a130]
test ecx, ecx
je 0x1400e1e39
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400e1e00
mov rsi, rax
test rax, rax
jne 0x1400e1dd0
movzx eax, byte [0x140195158]
mov edx, 0x20
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400e1e5f
mov rsi, rax
lea rax, [0x14012a118]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14012a130]
test ecx, ecx
je 0x1400e1e4c
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400e1e04
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400e1e0c
xor eax, eax
jmp 0x1400e1e20
call fcn.1400da7d0
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14012a118]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e1d45
lea rcx, [0x14012a118]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e1d70
lea rcx, [0x14012a118]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e1dc8
mov ecx, 8
mov edx, 0x20
call fcn.1400024c0
int3

Function at 0x1400e299e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14012a170]
test ecx, ecx
je 0x1400e2a68
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e29d2
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400e29d2
add rdi, 8
jmp 0x1400e2a5e
mov ecx, dword [0x14012a170]
test ecx, ecx
je 0x1400e2a7b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400e2a5c
mov rsi, rax
test rax, rax
jne 0x1400e2a39
mov al, byte [0x140195158]
mov edx, 0x10
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400e2a9e
mov rsi, rax
lea rax, [0x14012a158]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14012a170]
test ecx, ecx
je 0x1400e2a8e
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
call fcn.1400e233a
mov rcx, qword [rsi + 8]
mov qword [rsi + 8], rax
test rcx, rcx
je 0x1400e2a5e
lock dec qword [rcx]
jne 0x1400e2a5e
call fcn.140029e46
jmp 0x1400e2a5e
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14012a158]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e29b4
lea rcx, [0x14012a158]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e29e2
lea rcx, [0x14012a158]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e2a31
mov ecx, 8
mov edx, 0x10
call fcn.1400024c0
int3
Function at 0x1400e2aae
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov r14, rcx
mov ecx, dword [0x14012a150]
test ecx, ecx
je 0x1400e2bf7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e2aed
mov rbx, rax
cmp qword [rax + 8], 0
je 0x1400e2aed
add rbx, 0x10
jmp 0x1400e2be5
mov ecx, dword [0x14012a150]
test ecx, ecx
je 0x1400e2c0a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400e2b8c
mov rbx, rax
test rax, rax
jne 0x1400e2b5c
mov al, byte [0x140195158]
mov edx, 0x58
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400e2c30
mov rbx, rax
lea rax, [0x14012a138]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x14012a150]
test ecx, ecx
je 0x1400e2c1d
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
lea r15, [rbx + 8]
test r14, r14
je 0x1400e2b9a
lea rax, [rsp + 0x28]
mov ecx, 0xa
mov rdi, rax
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
mov qword [r14], 0
cmp qword [rax], 0
je 0x1400e2b90
lea rsi, [rsp + 0x30]
jmp 0x1400e2ba1
xor ebx, ebx
jmp 0x1400e2be5
lea rcx, [rsp + 0x28]
call fcn.1400e2389
lea rsi, [0x1401791a0]
lea rdi, [rsp + 0x78]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
lea rax, [rsp + 0x28]
mov ecx, 0xa
mov rdi, rax
mov rsi, r15
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 8], 1
add rbx, 0x10
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov rcx, rax
call fcn.1400e2389
mov rax, rbx
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x14012a138]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e2acf
lea rcx, [0x14012a138]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e2afd
lea rcx, [0x14012a138]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400e2b54
mov ecx, 8
mov edx, 0x58
call fcn.1400024c0
int3

Function at 0x1400e3de6
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x1400e3e2e
movzx eax, dl
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400e3e1c
xor eax, eax
jmp 0x1400e3e29
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rcx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
call fcn.140008ef0
int3
Function at 0x1400e4098
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov rbx, r8
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xd0]
lea r13, [rsp + 0x42]
lea r14, [rsp + 0x52]
mov r12, qword [rdx + 8]
mov r15, qword [rdx + 0x10]
mov edi, 0x7fffffff
cmp rax, rdi
cmovb rdi, rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x58], rax
lea rax, [r12 + 0x80]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x38]
mov rdx, r12
mov r8, rbx
mov r9b, 1
call fcn.1400e8dbc
mov al, byte [rsp + 0x41]
cmp al, 3
je 0x1400e420b
mov rcx, qword [rsp + 0x38]
cmp al, 2
je 0x1400e4219
mov dl, byte [rsp + 0x40]
movzx r8d, word [r13 + 4]
mov word [r14 + 4], r8w
mov r8d, dword [r13]
mov dword [r14], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
cmp r15, 0xffffffffffffffff
je 0x1400e425d
mov rcx, r15
mov rdx, rbp
mov r8d, edi
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400e4227
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.14001a67d
cmp al, 0xd
jne 0x1400e41e3
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1400e41e3
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400e4269
mov rdi, r15
mov r15, r14
mov r14, rbx
mov rbx, r13
mov r13, rbp
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.140038e77
test rax, rax
je 0x1400e41cf
mov rbp, rax
mov rcx, rsi
call fcn.1400a1402
mov rsi, rbp
mov rbp, r13
mov r13, rbx
mov rbx, r14
mov r14, r15
mov r15, rdi
mov rdi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14001a67d
cmp al, 0xd
jne 0x1400e423c
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x48]
call fcn.1400e72fd
mov rcx, rsi
call fcn.1400a1402
jmp 0x1400e40f4
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x1400e424c
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
jmp 0x1400e4236
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov qword [rax + 8], rcx
jmp 0x1400e424c
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
call fcn.140008ef0
ud2
Function at 0x1400e426b
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x78], r9
mov rbx, r8
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x100]
mov r15, qword [rdx + 8]
mov r12, qword [rdx + 0x10]
lea rcx, [r15 + 0x80]
mov qword [rsp + 0x70], rcx
mov ebp, 0xffffffff
cmp rax, rbp
cmovb rbp, rax
mov rdi, qword [rdx + 0x18]
xor r13d, r13d
xorps xmm6, xmm6
lea rcx, [rsp + 0x40]
mov rdx, r15
mov r8, rbx
mov r9b, 1
call fcn.1400e8dbc
mov al, byte [rsp + 0x49]
cmp al, 3
je 0x1400e43f1
mov rcx, qword [rsp + 0x40]
cmp al, 2
je 0x1400e43ff
mov dl, byte [rsp + 0x48]
lea r9, [rsp + 0x4a]
movzx r8d, word [r9 + 4]
lea r10, [rsp + 0x6a]
mov word [r10 + 4], r8w
mov r8d, dword [r9]
mov dword [r10], r8d
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x69], al
cmp r12, 0xffffffffffffffff
je 0x1400e445b
mov dword [rsp + 0x54], r13d
movups xmmword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], r13d
mov rcx, r12
mov rdx, qword [rsp + 0x78]
mov r8d, ebp
lea r9, [rsp + 0x54]
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
jne 0x1400e4411
call sub.ws2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov rcx, r14
call fcn.14001a67d
cmp al, 0xd
jne 0x1400e43b9
test rdi, rdi
je 0x1400e43b9
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
lock inc qword [rdx]
jle 0x1400e4467
add rcx, 0x10
mov r8, qword [rdi + 0x10]
mov r9b, byte [rdi + 0x18]
call fcn.140038e77
test rax, rax
je 0x1400e43b9
mov rsi, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 1
mov rcx, r14
call fcn.1400a1402
mov r14, rsi
jmp 0x1400e43c7
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], r14
mov rcx, r14
call fcn.14001a67d
cmp al, 0xd
jne 0x1400e442f
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
call fcn.1400e72fd
lea rcx, [rsp + 0x48]
call fcn.1400f33c9
jmp 0x1400e42c5
mov rax, qword [rsp + 0x58]
mov qword [rax], 2
jmp 0x1400e443f
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x1400e443f
mov edx, dword [rsp + 0x54]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov rax, qword [rsp + 0x58]
mov qword [rax], rcx
mov qword [rax + 8], rdx
jmp 0x1400e443f
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
mov qword [rax + 8], r14
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
call fcn.140008ef0
ud2

Function at 0x1400e792c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400e7933
test al, 1
je 0x1400e7952
test al, 2
jne 0x1400e796a
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017a130]
mov edx, 0x23
call fcn.140005ad0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017a170]
mov edx, 0x25
call fcn.140005ad0
int3
Function at 0x1400f374a
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx]
test rax, rax
je 0x1400f381d
cmp eax, 1
jne 0x1400f3845
lea rdx, [rsi + 8]
mov rcx, rdi
mov r8, r14
mov r9, r15
call fcn.1400f35e9
test r15, r15
je 0x1400f398c
mov edx, dword [rsi + 0x28]
mov ecx, dword [rsi + 0x20]
mov eax, dword [rsi + 0x24]
xor r8d, r8d
lea r9, [0x14017d010]
mov r10d, 0xff
mov edi, edx
or edi, 3
mov r11d, edi
and r11d, 0xfffffffe
imul r11d, edi
shr r11d, 8
xor r11b, byte [r14 + r8]
mov edi, ecx
shr edi, 8
xor cl, r11b
movzx ebx, cl
mov ecx, edi
xor ecx, dword [r9 + rbx*4]
mov edi, ecx
and edi, r10d
add edi, eax
imul eax, edi, 0x8088405
inc eax
mov edi, eax
shr edi, 0x18
mov ebx, edx
shr ebx, 8
and edx, r10d
mov r12d, edx
xor r12d, edi
mov edx, ebx
xor edx, dword [r9 + r12*4]
mov byte [r14 + r8], r11b
inc r8
cmp r15, r8
jne 0x1400f37b2
mov dword [rsi + 0x28], edx
mov dword [rsi + 0x20], ecx
mov dword [rsi + 0x24], eax
jmp 0x1400f398c
add rsi, 8
mov rcx, rdi
mov rdx, rsi
mov r8, r14
mov r9, r15
add rsp, 0xc8
add byte [rbx + 0x5d], bl
mov r9, qword [rsi + 0x30]
test r9, r9
je 0x1400f3887
lea r12, [rsi + 8]
cmp r9, r15
cmovae r9, r15
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r12
mov r8, r14
call fcn.1400f35e9
cmp qword [rbx], 0
je 0x1400f3892
mov rax, qword [rsp + 0x38]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
jmp 0x1400f398c
mov rbx, qword [rsp + 0x38]
sub qword [rsi + 0x30], rbx
cmp rbx, r15
ja 0x1400f3b62
lea r13, [rsi + 0x98]
movzx r15d, byte [rsi + 0xd8]
mov eax, 0x40
sub rax, r15
mov rbp, rbx
sub rbp, rax
jae 0x1400f38da
lea rcx, [r15 + r13]
mov rdx, r14
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add r15, rbx
jmp 0x1400f3962
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, r14
test r15, r15
je 0x1400f3927
lea rcx, [r14 + rax]
mov qword [rsp + 0x28], rcx
mov r13, qword [rsp + 0x20]
add r15, r13
mov rcx, r15
mov rdx, r14
mov r8, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
inc qword [rsi + 0x38]
lea rcx, [rsi + 0x40]
mov r8d, 1
mov rdx, r13
call fcn.1400a04f2
mov rdx, qword [rsp + 0x28]
mov r8, rbp
mov rbp, r8
and rbp, 0xffffffffffffffc0
mov r15d, r8d
and r15d, 0x3f
add rbp, rdx
cmp r8, 0x40
jb 0x1400f394f
shr r8, 6
add qword [rsi + 0x38], r8
lea rcx, [rsi + 0x40]
call fcn.1400a04f2
mov r13, qword [rsp + 0x20]
mov rcx, r13
mov rdx, rbp
mov r8, r15
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov byte [rsi + 0xd8], r15b
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
mov rdx, r14
mov r8, rbx
call qword [rax + 0x18]
cmp qword [rsi + 0x30], 0
je 0x1400f39a0
mov qword [rsp + 0x20], r13
cmp byte [rsi + 0xe0], 0
jne 0x1400f3b74
lea rax, [rsi + 0x38]
mov qword [rsp + 0x28], rax
mov byte [rsi + 0xe0], 1
lea r13, [rsp + 0x60]
mov word [r13 + 8], 0
mov qword [r13], 0
mov dword [rbp], 0