joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004415a
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x48]
mov rdx, qword [rdx + 0x40]
cmp rdx, rcx
jb 0x1400442f3
mov rax, qword [rdi + 0x38]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0xe8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x140044269
cmp eax, 0x80090318
je 0x1400442c7
test eax, eax
jne 0x1400442b7
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x38]
mov rax, qword [rdi + 0x40]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x20], 0
add r9, r8
jb 0x1400442ff
cmp rax, r9
jb 0x14004430e
lea rax, [rdi + 0x10]
add rdx, rcx
mov rcx, rax
call case.0x1400ac5ad.356
mov qword [rdi + 0x28], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x48]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140044321
xor eax, eax
cmp qword [rdi + 0x48], 0
sete al
mov qword [rdi + 0x108], rax
mov byte [rsi + 1], 0
jmp 0x1400442e9
cmp eax, 0x90317
je 0x1400442e3
cmp eax, 0x90321
jne 0x1400442b7
mov dword [rdi + 0xa0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xa4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x48]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140044321
mov qword [rdi + 0x108], 0
mov byte [rsi + 1], bl
jmp 0x1400442e9
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400442e9
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x108], rax
mov byte [rsi + 1], 0
jmp 0x1400442e7
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsStartSizeSizeLwsExtensionSizeLfBodyCrBodyLfTrailerTrailerLfEndCrEndLfEndC:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.6.0_src_buf_take.rsassertion_failed:_cnt___self.limit
call fcn.1400ff6c0
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsStartSizeSizeLwsExtensionSizeLfBodyCrBodyLfTrailerTrailerLfEndCrEndLfEndC:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.6.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rdx, r9
call fcn.1400ff950
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsStartSizeSizeLwsExtensionSizeLfBodyCrBodyLfTrailerTrailerLfEndCrEndLfEndC:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.6.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rcx, r9
mov rdx, rax
call fcn.1400ff6c0
int3
Function at 0x14004b74d
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea r12, [rsp + 0x50]
mov r8d, 0xb
mov rcx, r12
mov rdx, rax
call fcn.14009538a
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r14, [rsp + 0x34]
mov dword [r14], 0
mov ecx, 0x800
xor edx, edx
call fcn.140003e8c
mov rdi, rdx
lea r15, [rsp + 0x38]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0
mov r12, qword [r12 + 8]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
mov r9, r14
call rbp
cmp eax, 0xea
jne 0x14004b809
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x14004b7c4
mov rcx, r15
call fcn.140104616
mov rdi, qword [rsp + 0x40]
jmp 0x14004b7c4
test eax, eax
jne 0x14004b82b
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x14004b860
movabs rax, 0xde00000002
jmp 0x14004b833
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x38], 0
je 0x14004b874
mov rcx, qword [0x140165ff0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004b874
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x50], 0
je 0x14004b890
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x140165ff0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140065b60
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsp
Function at 0x140066908
Capabilities:
Connect socket
Enumerate pe sections

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x70]
test eax, eax
je 0x140066948
cmp eax, 3
je 0x140066a88
lea rcx, str._async_fn__resumed_after_completion
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_src_net_tcp_socket.rs
mov edx, 0x23
call fcn.1400ff740
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x28], rcx
mov edx, dword [rsi + 2]
movzx eax, word [rsi + 6]
shl rax, 0x20
or rax, rdx
cmp word [rsi], 0
je 0x1400669e3
mov edx, dword [rsi + 0x14]
movsd xmm0, qword [rsi + 8]
movss xmm1, dword [rsi + 0x10]
shufps xmm1, xmm0, 0x30
shufps xmm0, xmm1, 0x84
mov r8d, dword [rsi + 0x18]
movzx r9d, word [rsi + 0x1c]
shr rax, 0x10
movd xmm1, eax
pshufd xmm0, xmm0, 0x90
movss xmm0, xmm1
rol r9w, 8
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], r8d
xorps xmm0, xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
mov dword [rsp + 0xa4], 0
mov r8d, 0x1c
mov r10w, 0x17
mov eax, edx
jmp 0x140066a32
mov r9, rax
shr r9, 0x20
rol r9w, 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0xa0], 0
mov r8d, 0x10
mov r10w, 2
lea rdx, [rsp + 0x28]
mov word [rdx], r10w
mov word [rdx + 2], r9w
mov dword [rdx + 4], eax
mov dword [rdx + 0x80], r8d
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x140066a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, rax
shl r14, 0x20
or r14, 2
cmp eax, 0x2733
jne 0x140066acf
mov rcx, r14
call fcn.14006679c
mov rax, qword [rsi + 0x28]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0
mov byte [rsi + 0x68], 0
lea r15, [rsi + 0x30]
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140066b8e
cmp qword [r14], 0
je 0x140066aae
mov al, 3
mov ecx, 1
jmp 0x140066af3
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0xb0], xmm0
mov rcx, r15
call fcn.140053052
jmp 0x140066adb
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.ws2_32.dll_closesocket]
xor ebx, ebx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r14
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x18], xmm0
mov al, 1
xor ecx, ecx
mov qword [rdi], rcx
mov byte [rsi + 0x70], al
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14007d64d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov rsi, rdx
mov rdi, rcx
mov dl, byte [rdx + 0xb8]
movzx eax, byte [rsi + 0xd8]
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14007d6a8
cmp eax, 1
jne 0x14007d6c5
cmp dl, 7
jne 0x14007d6a8
mov cl, 1
mov dl, 4
call fcn.14002b18c
lea rcx, [rsp + 0x180]
mov qword [rcx], 3
mov qword [rcx + 8], rax
jmp 0x14007d929
movzx eax, byte [rsi + 0x60]
test rax, rax
mov byte [rsp + 0x34], dl
je 0x14007d72d
cmp eax, 1
jne 0x14007d735
mov r12b, byte [rsi + 0x61]
mov r13b, 1
xor ebp, ebp
jmp 0x14007d733
mov cl, 1
mov dl, 3
call fcn.14002b18c
mov rdi, rax
mov al, byte [0x1401660a0]
mov ecx, 0xa0
mov edx, 8
call fcn.140001ab0
test rax, rax
je 0x14007e01e
mov rbx, rax
mov qword [rax], 3
mov qword [rax + 8], rdi
mov al, byte [0x1401660a0]
mov ecx, 8
mov edx, 8
call fcn.140001ab0
test rax, rax
je 0x14007e02d
mov rdi, rax
mov qword [rax], rbx
lea rbx, [0x1401221f0]
jmp 0x14007d934
xor r13d, r13d
mov bpl, 1
jmp 0x14007d770
call fcn.14002cbbf
mov r14, rax
mov rax, qword [rsi + 0x68]
lea rdx, [rax + 0x18]
mov r10, qword [rax]
mov r8, qword [rax + 8]
mov r9, qword [rax + 0x10]
lea rbx, [rsp + 0x60]
mov rcx, rbx
call qword [r10]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov r13b, 2
xor ebp, ebp
lea rdx, [rsi + 0x88]
mov rax, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
lea rbx, [rsp + 0x190]
mov rcx, rbx
call qword [rax]
lea rdx, [rsi + 0xa8]
mov rax, qword [rsi + 0x90]
mov r8, qword [rsi + 0x98]
mov r9, qword [rsi + 0xa0]
lea r15, [rsp + 0x60]
mov rcx, r15
call qword [rax]
movzx eax, word [rsi + 0xb0]
mov word [r15 + 0x20], ax
mov byte [rbx - 0x10], r13b
mov byte [rbx - 0xf], r12b
mov qword [rbx - 8], r14
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm1
mov rax, qword [r15 + 0x20]
mov qword [rbx + 0x40], rax
mov rbx, qword [rbx + 0x10]
test bpl, bpl
je 0x14007d849
test rbx, rbx
je 0x14007d86c
cmp byte [rsp + 0x34], 7
test rbx, rbx
je 0x14007d86c
test r13b, r13b
je 0x14007d941
add byte [rax], al
invalid
movzx eax, r13b
cmp eax, 1
jne 0x14007d945
mov bpl, 1
jmp 0x14007d943
xor ebp, ebp
jmp 0x14007d97b
call fcn.14002cbbf
mov ecx, 8
mov edx, 0xa0
call fcn.1400ff110
mov ecx, 8
mov edx, 8
call fcn.1400ff110
Function at 0x14009dc90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.1400045a0
cmp rax, rcx
je 0x14009dcb5
cmp rdx, 4
jae 0x14009dcb8
xor eax, eax
xor r8d, r8d
jmp 0x14009dd50
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140105700]
movdqa xmm3, xmmword [0x140105710]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14009dce0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14009dd67
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14009dd50
ret

Function at 0x1400a169f
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
mov qword [r8], 0
add byte [rax], al
add byte [rax], al
add byte [rdx + 0x53], bh

Function at 0x1400a199b
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x29
and al, 0x50
push rax
Function at 0x1400a3156
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a3183
xor eax, eax
jmp 0x1400a3191
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x1400ab850
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
sub esp, 0xa8

Function at 0x1400af000
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov esi, ecx
Function at 0x1400b7530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call case.0x14006609e.574
dec dword [rax - 0x75]
and al, 0x40

Function at 0x1400b8a10
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x68], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 8], rax
nop

Function at 0x1400b9760
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401660a0]
mov ecx, 0x10
mov edx, 8
call fcn.140001ab0
test rax, rax
je 0x1400b9856
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b9960]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400b9848
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400b9821
cmp qword [rax + 0x10], 0x11
jae 0x1400b980a
mov r8, qword [rbp - 0x10]
jmp 0x1400b9812
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x140165ff0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x140165ff0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add bh, bh
adc eax, 0x4b827
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
jge 0x1400b9846
Function at 0x1400ba3d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400ba413
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1400aa3f0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400ff580
ud2

Function at 0x1400bc360
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400bc4ab
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x1400bc397
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400bc495
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400bc478
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bc3f9
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1400bc42b
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x1400bc42f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x1400bc433
cmp eax, 0x6d
jne 0x1400bc45e
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x1400bc438
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400bc464
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400a38e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400bc46e
cmp rax, 1
je 0x1400bc3e2
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x1400bc3ec
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.140103520
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x1400bc3a4
mov r8d, 0x10
mov rcx, rbx
call fcn.140103520
mov rax, qword [rbx]
jmp 0x1400bc397
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140103870
int3

Function at 0x1400bfda0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400bfdd5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400bfdda
call fcn.1400ba3d0
nop
add rsp, 0x38
ret
Function at 0x1400bfee0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x1400bff0b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x140165ff8]
cmp rax, 3
jne 0x1400c0091
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bff81
cmp word [rbx], 0
je 0x1400bfffc
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x1400c0011
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1400bff9c
mov r14d, eax
cmp eax, 0x2726
jne 0x1400c0080
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1400c0077
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400bff59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1400c0080
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x34], r9w
mov word [rsp + 0x36], cx
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], edx
lea rdx, [rsp + 0x34]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400c0050
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1400bff00
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1400bff00
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x1400bfef9
call fcn.1401036b0
jmp 0x1400bff1c

Function at 0x1400c10ab
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400c10b2
test al, 1
je 0x1400c10d1
test al, 2
jne 0x1400c10e9
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ede8]
mov edx, 0x23
call fcn.1400ff740
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014ee28]
mov edx, 0x25
call fcn.1400ff740
int3
Function at 0x1400c2b59
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x1400c2ba3
movzx eax, dl
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400c2b90
xor eax, eax
jmp 0x1400c2b9e
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
mov edx, 0x2b
call fcn.1400ff740
int3

Function at 0x1400c2bbc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov r12, rcx
lea r14, [rsp + 0x72]
lea rbp, [rsp + 0x3a]
mov r13, qword [r8 + 8]
mov rbx, qword [r8 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0x40], r8
mov rax, qword [r8]
add rax, rbx
mov qword [rsp + 0x58], rax
mov rcx, r13
sub rcx, rbx
mov eax, 0x7fffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x48], rax
lea r15, [rsp + 0x68]
mov qword [rsp + 0x28], rsi
mov rcx, r15
mov rdx, qword [rsp + 0x60]
mov r8, rdi
xor r9d, r9d
call fcn.1400c2144
mov al, byte [rsp + 0x71]
cmp al, 3
je 0x1400c2d67
Function at 0x1400c2e33
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xd0]
lea r15, [rsp + 0x3a]
lea r13, [rsp + 0x52]
mov rbp, qword [rdx + 8]
mov r12, qword [rdx + 0x10]
mov ecx, 0x7fffffff
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x58], rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
mov r9b, 1
call fcn.1400c2144
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x1400c2fb0
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x1400c2fbe
mov dl, byte [rsp + 0x38]
movzx r8d, word [r15 + 4]
mov word [r13 + 4], r8w
mov r8d, dword [r15]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
cmp r12, 0xffffffffffffffff
je 0x1400c3002
mov rcx, r12
mov rdx, rdi
mov r8, qword [rsp + 0x60]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400c2fcc
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.1400101a1
cmp al, 0xd
jne 0x1400c2f80
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1400c2f80
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400c301a
mov rbp, r12
mov r12, r14
mov r14, r15
mov r15, rbx
mov rbx, rdi
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.14003deac
test rax, rax
je 0x1400c2f6c
mov rdi, rax
mov rcx, rsi
call fcn.140010048
mov rsi, rdi
mov rdi, rbx
mov rbx, r15
mov r15, r14
mov r14, r12
mov r12, rbp
mov rbp, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400101a1
cmp al, 0xd
jne 0x1400c2fe1
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.1400c2384
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d1102
jmp 0x1400c2e8f
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x1400c2ff1
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
jmp 0x1400c2fdb
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov qword [rax + 8], rcx
jmp 0x1400c2ff1
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
mov edx, 0x2b
call fcn.1400ff740
ud2