joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044e00
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x140044e12
add rcx, 8
jmp fcn.14009ab9b
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x38], rdx
mov rcx, r8
call fcn.140044fa4
mov rbx, rax
mov r14, rdx
lea r15, [rsp + 0x28]
mov rcx, rsi
call fcn.14004507b
test rdx, rdx
jne 0x140044eb5
mov rcx, r15
mov rdx, rsi
call fcn.1400438ff
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x140044f44
test eax, eax
je 0x140044eb5
cmp qword [rsi + 0xf8], 0
je 0x140044e98
mov rcx, r15
mov rdx, rsi
call fcn.1400445c6
cmp qword [rsp + 0x28], 0
jne 0x140044f44
cmp qword [rsp + 0x30], 0
je 0x140044eb5
and qword [rsi + 0xf8], 0
mov rcx, r15
mov rdx, rsi
call fcn.1400447eb
cmp byte [rsp + 0x28], 0
jne 0x140044f44
cmp byte [rsp + 0x29], 0
je 0x140044e3e
mov rcx, rsi
call fcn.14004507b
mov r15, rdx
test rax, rax
je 0x140044f49
mov r13, rax
cmp r14, r15
mov r12, r15
cmovb r12, r14
lea r9, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.14004457c
mov rbx, rax
mov r14, rdx
lea r9, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov rcx, r13
mov rdx, r15
mov r8, r12
call case.0x1400199a7.454
mov r9, rdx
lea rcx, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.14003836d
mov rax, qword [rsi + 0x78]
add rax, r12
cmp rax, qword [rsi + 0x70]
ja 0x140044f8a
mov qword [rsi + 0x78], rax
mov rcx, rdi
mov rdx, r12
call fcn.140045011
xor r15d, r15d
jmp 0x140044f70
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov rcx, r15
call fcn.14001e1fd
cmp al, 0xd
jne 0x140044f70
and qword [rsi + 0x38], 0
lea rcx, [rsp + 0x28]
call fcn.140039eaf
mov eax, 1
jmp 0x140044f77
and qword [rsi + 0x38], 0
xor eax, eax
mov rdx, r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov edx, 0x3b
call fcn.1400a55b0
ud2
Function at 0x140048470
Capabilities:
Resolve function by parsing pe exports
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x378
mov r15, r8
mov rbx, rdx
mov qword [rsp + 0x50], rcx
movzx eax, byte [rdx + 0x378]
test eax, eax
je 0x1400484bc
cmp eax, 3
jne case.default.0x1400484ba
lea r12, [rbx + 0x1f0]
movzx eax, byte [rbx + 0x280]
lea rcx, [0x14015ff44]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
and qword [rbx + 0x20], 0
mov qword [rbx + 0x40], rax
jmp 0x1400484e9
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_0.14.28_srcclientconnecthttp.rs
add eax, 0xe6604
jmp 0x140048ec5
Function at 0x14006005b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6c8
mov r15, r8
mov rdi, rdx
mov qword [rsp + 0x78], rcx
mov rdx, qword [rdx + 0x400]
add rdx, 0x10
lea rsi, [rsp + 0x180]
mov rcx, rsi
call fcn.140019b5c
lea rdx, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001fh2_0.3.22_srcproto_streams_streams.rs
mov rcx, rsi
call fcn.14003cdeb
mov rcx, qword [rax + 0x168]
or rcx, qword [rax + 0x178]
je 0x1400600bd
mov rcx, rax
call fcn.140097b01
jmp 0x1400600e9
mov rsi, qword [rax + 0x218]
mov rcx, rax
call fcn.140097b01
cmp rsi, 1
ja 0x1400600e9
mov rdx, qword [rdi + 0x400]
add rdx, 0x10
lea rcx, [rdi + 0x3a0]
call fcn.1400690b0
mov rdx, qword [rdi + 0x378]
cmp rdx, 2
jne 0x140060104
mov qword [rsp + 0x180], 2
jmp 0x140060153
lea rsi, [rdi + 0x378]
lea rbx, [rdi + 0x390]
mov rcx, qword [rdi + 0x380]
mov rax, qword [rdi + 0x388]
test rdx, rdx
je 0x140060133
mov rdx, rax
call fcn.140049b8a
mov rcx, rax
mov rax, rdx
mov rdx, rbx
call qword [rax + 0x70]
mov rbx, rax
lea r14, [rsp + 0x180]
mov rcx, r14
mov rdx, rsi
call fcn.14009c977
mov qword [r14 + 0x18], rbx
mov rax, qword [rdi + 0x398]
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
movups xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x460], xmm0
mov qword [rsp + 0x450], rcx
mov qword [rsp + 0x458], rdx
mov qword [rsp + 0x470], rax
cmp dword [rsp + 0x450], 2
je 0x1400601b1
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x450]
call fcn.14009c9f0
mov qword [rsp + 0x5d8], 2
and qword [rsp + 0x5f8], 0
lea r14, [rdi + 0x48]
lea rax, [rdi + 0x410]
mov qword [rsp + 0x170], rax
lea rax, [rdi + 0x3a0]
mov qword [rsp + 0x178], rax
lea r12, [rsp + 0x2b8]
lea rbp, [rsp + 0x180]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], r15
mov qword [rsp + 0xc8], r14
Function at 0x14007bee0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.14007c008
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.14003999b
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14007bf7d
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.1400398e1
mov rbx, qword [rsp + 0x40]
jmp 0x14007bf48
test eax, eax
jne 0x14007bf9f
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14007bfbd
movabs rax, 0xde00000002
jmp 0x14007bfa7
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140033fcf
jmp 0x14007bfd1
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.140001ca2
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400802b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.14000ebd0
cmp rax, rcx
je 0x1400802d5
cmp rdx, 4
jae 0x1400802d8
xor eax, eax
xor r8d, r8d
jmp 0x140080370
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400a9640]
movdqa xmm3, xmmword [0x1400a9650]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140080300
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140080387
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140080370
ret
Function at 0x1400812d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14008132b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14008132b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140081346
cmp eax, 0x42
jne 0x14008132b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400813f6
cmp byte [r9 + r11], 0x5f
jne 0x1400813f6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14008145e
mov rcx, rsi
xor edx, edx
call fcn.14007cd30
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14007cd30
test al, al
jne 0x1400814f1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140081382
lea rdx, [0x140132383]
mov r8d, 1
call fcn.14000f040
test al, al
jne 0x1400814f1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14008133a
xor r14d, r14d
lea rbx, [0x140132738]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400813b4
cmp byte [rax + rcx], 0x45
je 0x140081513
sub r14, 1
jb 0x1400813d9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400813d9
mov r8d, 2
mov rdx, rbx
call fcn.14000f040
test al, al
jne 0x1400814f1
mov rcx, rsi
call fcn.14007e540
test al, al
jne 0x1400814f1
mov rax, qword [rsi]
test rax, rax
jne 0x1400813a0
jmp 0x14008133a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1400814b8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140081452
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14008143c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14008142b
add dl, 0xa9
jmp 0x14008143a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400814b8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400814b8
movzx edx, bl
add rax, rdx
jae 0x140081400
jmp 0x1400814b8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400814b8
cmp rax, rcx
jae 0x1400814b5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14008150b
cmp qword [rsi + 0x20], 0
je 0x140081504
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400812d0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14008133c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400814f9
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x1401326f8]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.14000f040
test al, al
je 0x1400814f9
mov dil, 2
jmp 0x14008133a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14008133a
mov dil, 1
xor r8d, r8d
jmp 0x1400814ba
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14008133a
Function at 0x140085d83
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140085db0
xor eax, eax
jmp 0x140085db5
call fcn.1400388d5
nop
add rsp, 0x38
ret

Function at 0x140087590
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
test r9, r9
je 0x1400875e3
mov r14, r9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140087600

Function at 0x14008b8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, rdx
movzx r9d, byte [rdx + 0x38]
movzx r8d, byte [rdx + 0x3a]
cmp sil, byte [rcx]
rol byte [rcx - 0x80], cl
stc
add dword [rdi + 0x4b], esi
movzx r11d, byte [rax + 0x10]
test r8b, r8b
ror byte [rdi], 0x85
sahf
add dword [rax], eax
invalid
cmp r11b, 5
jb 0x14008bab8
mov r10, qword [rax]
mov rdx, qword [rax + 8]
xor esi, esi
test r9b, r9b
jne 0x14008b947
cmp r11b, 6
je 0x14008b947
mov esi, 2
cmp rdx, 2
jb 0x14008bb5e
invalid
cmp rsi, rdx
jne 0x14008ba78
xor edx, edx
jmp 0x14008bab8
xor r10d, r10d
add rdx, r10
lea rdi, [r10 + rsi]
inc rdi
lea r8, str.library_std_srcpath.rs
mov ecx, 2
call fcn.1400a5430
ud2
Function at 0x140090ad0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401672b8]
mov ecx, 0x10
mov edx, 8
call fcn.140009f00
test rax, rax
je 0x140090ba7
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140090c30]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140090b99
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x140090b76
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140009f90
mov edx, 8
mov rcx, qword [rbp - 0x18]
call fcn.140009f90
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400a5170
ud2

Function at 0x140090d50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x140090d93
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14008cd10]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400a53f0
ud2

Function at 0x140094bb0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140094be5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140094bea
call fcn.140090d50
nop
add rsp, 0x38
ret

Function at 0x14009a216
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14009a21d
test al, 1
je 0x14009a23c
test al, 2
jne 0x14009a251
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140139748]
mov edx, 0x23
jmp 0x14009a264
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140139788]
mov edx, 0x25
call fcn.1400a55b0
ud2
Function at 0x14009ab4b
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.140099aa4
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14009ab87
xor eax, eax
jmp 0x14009ab95
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x14009adf2
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rbp, [rsp + 0x3a]
lea r13, [rsp + 0x52]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
lea r15, [rdx + 0x18]
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
mov rdx, qword [r14 + 0x10]
mov rcx, rsi
mov r8, rbx
call fcn.14009ab43
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x14009af64
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x14009af72
mov dl, byte [rsp + 0x38]
movzx r8d, word [rbp + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rbp]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r15
lea rdx, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.35.1_srciopoll_evented.rs
call fcn.140001e4b
mov rcx, qword [r15]
mov rdx, rdi
mov r8d, r12d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14009af84
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.14001e1fd
cmp al, 0xd
jne 0x14009af34
mov rax, qword [r15 + 8]
test rax, rax
je 0x14009af34
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x14009afb6
mov r15, r14
mov r14, rbx
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400391d3
mov rbx, rax
xor ecx, ecx
call fcn.140085832
test rbx, rbx
je 0x14009af29
mov ecx, 1
mov rdx, rsi
call fcn.1400392f8
mov rsi, rbx
mov rbx, r14
mov r14, r15
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140097b29
cmp al, 0xd
jne 0x14009af95
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.14009a8e0
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.140095cb1
jmp 0x14009ae48
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x14009afa5
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x14009afa5
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14009afa5
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x53a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rdx, [0x004ad000]
movabs rdi, 0
push rdx
not dword [rdx + 0x1c4]
xor dword [rdx + 0x2fc], 0x19f80242
xor dword [rdx + 0x28c], 0x54cb740f
sub dword [rdx + 0x198], 0x4869d3
xor dword [rdx + 0x314], 0x14d925a5
add dword [rdx], 0x4b41104e
not dword [rdx + 0x17c]
xor dword [rdx + 0x1d4], 0x3e7279e
add dword [rdx + 0x19c], 0x4b424882
xor dword [rdx + 0x8c], 0x11986e77
not dword [rdx + 0x1b8]
add dword [rdx + 0x130], 0xd1c40b6
sub dword [rdx + 0x1cc], 0x757a0bed
not dword [rdx + 0xc0]
not dword [rdx + 0x2e4]
add dword [rdx + 0x1fc], 0xf0b7141
add dword [rdx + 0x214], 0x4aee7392
xor dword [rdx + 0x90], 0x98b2de8
not dword [rdx + 0xf4]
xor dword [rdx + 0x11c], 0x5c583ad8
not dword [rdx + 0x2ec]
add dword [rdx + 0x3e8], 0x11a02edc
sub dword [rdx + 0x310], 0x4fd63646
not dword [rdx + 0x398]
add dword [rdx + 0x34], 0x42c44918
xor dword [rdx + 0x68], 0x57de290c
xor dword [rdx + 0x324], 0x45f20973
sub dword [rdx + 0x14], 0x6ed05dd7
add dword [rdx + 0x294], 0x641d71d3
add dword [rdx + 0x3e0], 0x29000d78
sub dword [rdx + 0x230], 0x68274447
not dword [rdx + 0x184]
add dword [rdx + 0x2c4], 0x7d5f0d04
not dword [rdx + 0x104]
xor dword [rdx + 0x34c], 0x4d231c35
add dword [rdx + 0x23c], 0x3dcb54b8
xor dword [rdx + 0x358], 0x439d719e
not dword [rdx + 0xe8]
sub dword [rdx + 0x330], 0x5dfb233e
xor dword [rdx + 0x3ac], 0x3ab9705b
sub dword [rdx + 0x160], 0x73943418
not dword [rdx + 0x384]
xor dword [rdx + 0x194], 0x66f32ba9
xor dword [rdx + 0x3c], 0x5e754560
sub dword [rdx + 0x21c], 0x1a785ad2
xor dword [rdx + 0x174], 0x7dda74e6
sub dword [rdx + 0x1c8], 0x16f72296
xor dword [rdx + 0x1f0], 0x603f245c
not dword [rdx + 0x1c]
add dword [rdx + 0x204], 0x7dda0cfd
not dword [rdx + 0x15c]
sub dword [rdx + 0xf8], 0x13be19d0
not dword [rdx + 0x354]
add dword [rdx + 0x33c], 0x3e1578af
xor dword [rdx + 0x94], 0x793d5604
not dword [rdx + 0x124]
xor dword [rdx + 0x344], 0x4f1c681e
not dword [rdx + 0x1ac]
not dword [rdx + 0x28]
not dword [rdx + 0x1c0]
add dword [rdx + 0x1f8], 0x3c9b2447
not dword [rdx + 0x44]
sub dword [rdx + 0xb4], 0x3abb551c
not dword [rdx + 0xb8]
add dword [rdx + 0x80], 0x286a0858
sub dword [rdx + 0x1e4], 0x33ef23a0
invalid
xchg edx, eax
invalid
add eax, dword [rax]
Function at 0x140001c71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x140001cb7
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x140001d9b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 0
jmp 0x140001daa
cmp byte [rax + 0x3a], 0
jne 0x140001dda
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov r8, qword [rax + 0x28]
mov r14b, byte [rax + 0x38]
mov r11d, r14d
xor r11b, 1
test r8, r8
je 0x140001cf3
cmp r9, r8
jbe 0x140001ced
cmp byte [r10 + r8], 0xbf
jg 0x140001cf3
jmp 0x140001dea
jne 0x140001dea
cmp r8, r9
je 0x140001db1
mov bl, byte [r10 + r8]
movzx esi, bl
test sil, sil
jns 0x140001d57
mov edi, esi
and edi, 0x1f
movzx ebp, byte [r10 + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x140001d49
movzx esi, byte [r10 + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x140001d52
movzx ebx, byte [r10 + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
jmp 0x140001d57
shl edi, 6
or edi, ebp
mov esi, edi
jmp 0x140001d57
shl edi, 0xc
or esi, edi
test r14b, r14b
jne 0x140001dbc
cmp esi, 0x110000
je 0x140001dd2
mov edi, 1
cmp esi, 0x80
jb 0x140001d8d
mov edi, 2
cmp esi, 0x800
jb 0x140001d8d
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov r14d, r11d
jmp 0x140001cd3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 1
call fcn.1400012f2
jmp 0x140001ddf
mov byte [rax + 0x38], r11b
test r14b, r14b
jne 0x140001dc3
jmp 0x140001dd6
mov byte [rax + 0x38], r11b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x140001ddc
mov byte [rax + 0x38], r11b
mov byte [rax + 0x3a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rax + 0x38], r11b
lea rax, [0x140051290]
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.140043320
ud2
Function at 0x140008f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140009010
cmp r10, rax
jb 0x140009084
cmp r10, rdx
ja 0x140009098
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140009012
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140008ff0
jmp 0x140009073
ja 0x14000901a
mov rax, r10
cmp r11, r8
jne 0x140008fc2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140009050
mov r15, rbx
sub ecx, edx
jns 0x14000906a
jmp 0x140009075
cmp rbx, r14
je 0x1400090a9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140009075
xor al, 1
cmp r15, r14
jne 0x140009030
jmp 0x140009075
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, [0x140047010]
mov rcx, rax
mov rdx, r10
call fcn.1400431c0
ud2
lea r8, [0x140047010]
mov rcx, r10
call fcn.140043100
ud2
lea rcx, [0x1400510f0]
lea r8, [0x140047028]
mov edx, 0x2b
call fcn.140043110
ud2