joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60caef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9w, bp
rdtsc
stc
jns 0x60cb1c
js 0x60cb25
mov r9, rsp
mov r8, r12
bt rax, rax
jmp 0x60cb74
push cx
jmp 0x60cafa
push cx
mov r9, rsp
mov r8, r12
bt rax, rax
push rax
jmp 0x60cb75
rdtsc
lea rax, [r9 + rbp]
mov r8, 0x4091064d
mov edx, dword [rsp]
mov dil, r15b
mov ebx, dword [rsp]
jmp 0x60cb84
push rax
mov ecx, 0xe44d64f0
lea rsp, [rsp + 2]
add r15b, sil
jmp 0x60cbb4
lea r8, [rbx + r9]
mov r13, rax
call fcn.0060cc4b
sti
push 0xffffffffac6899fe
add eax, 0x49cea7b4
mov eax, 0x4091064d
mov r8, 0x4091064d
mov edx, dword [rsp]
jmp 0x60cb5e
jo 0x60cb4e
rdtsc
lea rax, [r9 + rbp]
jmp 0x60cb9a

Function at 0x732ca8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 0x14]
bswap ebx
lea rsp, [rsp + 0x15]
btc cx, r12w
jmp 0x732c86

Function at 0x733152
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x733336
lea rsi, [rsi + r15]
mov al, r9b
xchg bl, r8b
mov byte [rsp + 0xa], r11b
pop word [rsp + 2]
jmp 0x7331dc
cpuid
xchg dword [rsp], ebx
mov si, r8w
pop r12w
mov byte [rsp], cl
pushfq
jmp 0x7331f2
lea rsp, [rsp + 0xa]
mov rax, 0xfffffffff20520a0
mov word [rsp], bx
inc r14
lea rcx, [rsp + r9]
mov rax, rcx
jmp 0x73320f
mov edx, 0xad2436e7
mov ebx, 0x30ad288f
dec r8
shl r8w, cl
mov esi, dword [rsp + 9]
xchg ebx, r8d
jmp 0x7332bb
Function at 0x73372b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop qword [rsp]
pop r14
add rsp, 1
xor esi, 0xa6b82c64
mov r14, r13
jmp 0x733778
xchg ecx, eax
bswap eax
mov r8d, 0xb78f4c5b
rcl cx, cl
xchg word [rsp + 0x1d], cx
jmp 0x7337a5
push rbx
sub rsp, 0x16
mov r12b, r10b
mov dx, word [rsp + 0x12]
bsr eax, r9d
lea rax, [rbx + r14]
jmp 0x73375d
xchg dword [rsp + 0x1d], ebx
rdtsc
lea rbx, [rsi + riz]
xchg dword [rsp + 0x1a], ebx
dec dl
jmp 0x7337d6
mov rbx, qword [rsp + 7]
cpuid
rcl r14w, 6
push qword [rsp + 0x21]
cmc
cmp rsi, 0x710e1b6b
jmp 0x73378f
bswap r12
clc
setbe r14b
push bx
pushfq
xchg r14, r12
jmp 0x7337ed
xchg word [rsp + 3], cx
xchg rbx, r14
xchg r14d, ecx
not esi
xchg rcx, r8
pop word [rsp + 6]
jmp 0x7337c0
mov rbx, 0xffffffffeaeb4589
mov ebx, 0x48c5f255
mov rcx, qword [rsp + 0x12]
jmp 0x733822
add rsp, 0x23
mov r12w, 0x1848
mov dword [rsp + 2], esp
jmp 0x73387a
mov ax, word [rsp + 0x28]
mov bx, sp
mov bx, 0xd50c
push qword [rsp + 0xd]
xchg word [rsp + 0x14], si
mov r12b, byte [rsp + 6]
jmp 0x73380c
lea rsi, [r13*4]
dec r8d
bt bx, r9w
jmp 0x733891
mov ax, word [rsp + 0xf]
pop r12w
xchg r12b, cl
lea rax, [rcx + riz - 0xc5]
xchg qword [rsp + 8], rcx
jmp 0x73383f
setle r8b
mov byte [rsp + 0x15], al
mov rdx, qword [rsp + 3]
setp bl
cmc
mov cx, r8w
jmp 0x733855
bswap r12
or rcx, rbp
mov qword [rsp], rsi
mov cl, 0xba
pop qword [rsp]
mov rsi, qword [rsp + 8]
jmp 0x733bed
xchg ecx, eax
bsf r8w, ax
xchg r12, rdx
neg ecx
setnp cl
pop rax
jmp 0x733900
pop qword [rsp]
pop word [rsp + 2]
rdtsc
bts ebx, esp
mov r12, rsi
cpuid
jmp 0x7338d5
bsr rsi, rbx
lea r14, [rsi + riz + 0x731d]
mov eax, r13d
bswap ebx
or dx, ax
mov si, word [rsp + 1]
jmp 0x73395c
cpuid
push r15w
mov r12w, cx
cld
mov rbx, 0xffffffffaba2366d
mov r12d, dword [rsp + 0x10]
jmp 0x7338eb
std
shl r8b, cl
mov dx, 0x5d6c
lea rbx, [rax + riz + 0xca]
stc
dec r8
jmp 0x733970
mov cl, 0xb5
cpuid
pop word [rsp]
lea rax, [r11 + r14]
neg r14b
xchg byte [rsp], bl
jmp 0x73393f
bsr eax, r14d
mov r12d, dword [rsp]
rdtsc
bsf r12, rbx
mov word [rsp], sp
stc
jmp 0x733b1e
neg r8d
mov dword [rsp + 3], r15d
xchg dword [rsp + 1], r8d
xchg byte [rsp + 2], dl
sub rsp, 4
mov ecx, dword [rsp + 1]
jmp 0x733926
setg r8b
mov esi, eax
mov r14w, word [rsp + 1]
shr edx, cl
cld
jmp 0x7339f2
mov bx, sp
cmp rsi, 0xffffffff988eafe0
xchg word [rsp], r14w
add rsp, 0
rdtsc
mov ebx, 0x78a23f
jmp 0x7339aa
xchg bl, cl
pop si
cmp ebx, 0x1cd85958
call fcn.007339dc
jg 0x7efcb427
cmpsd dword [rsi], dword [rdi]
and byte [rsi - 0x223fdf2f], dh
sub al, 0x3f
bsf rbx, rdi
mov r12b, byte [rsp]
cmp r14b, r12b
bsr rsi, r14
mov r12, r8
mov r8, qword [rsp]
jmp 0x7339c0
mov eax, 0xed7f3858
clc
xchg rsi, rax
add rsp, 0
xchg edx, r8d
setle cl
jmp 0x733a11
xchg dx, r8w
mov rax, 0xffffffffdd9e73cd
push word [rsp + 0xb]
mov r8d, 0x579b08e5
btr rdx, r15
lea rdx, [r10 + r10]
jmp 0x73398c
Function at 0x7360e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11b, spl
rdtsc
jmp 0x7360f0
mov r11d, 0x63eaa660
push si
mov byte [rsp + 3], dl
jmp 0x736122
mov r14, 0xffffffffcf18bbb0
push qword [rsp + 2]
mov al, 0x1d
mov rax, qword [rsp + 0x1a]
mov ax, 0xe849
mov rax, r15
jmp 0x736170
lea rsp, [rsp + 0x18]
mov r14b, byte [rsp + 2]
xchg dword [rsp], r14d
mov r11b, 0xd1
mov byte [rsp + 1], cl
mov word [rsp], r15w
jmp 0x736343
pop rax
call fcn.0073619d
lea r11, [rdx + rsi]
lea rax, [rax + r12]
bswap eax
mov al, 0x72
mov eax, 0xecfd5636
setle dl
jmp 0x7361b3
xchg dword [rsp], r11d
pop r11w
xchg edx, eax
rdtsc
lea rsp, [rsp + 5]
xchg r13w, r11w
jmp 0x736265
Function at 0x140050590
Capabilities:
Get session user name

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp + 4], 0
lea rdx, [rbp + 4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [rbp + 4]
test rax, rax
mov qword [rbp - 0x18], rax
je 0x1400505f1
lea rdi, [rax + rax]
mov edx, 2
mov rcx, rdi
call fcn.14004e800
test rax, rax
jne 0x1400505f6
mov edx, 2
mov rcx, rdi
call fcn.1400bfe40
ud2
mov eax, 2
lea rdx, [rbp + 4]
mov qword [rbp - 8], rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14005064d
mov eax, dword [rbp + 4]
lea r8, [rax - 1]
test rax, rax
cmove r8, rax
mov rcx, rsi
mov rdx, qword [rbp - 8]
call fcn.140096fe0
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x14005063f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 8]
call fcn.14004e810
mov rax, rsi
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0xc], eax
lea rax, [rbp - 0xc]
mov qword [rbp - 0x28], rax
lea rax, [0x1400b9a30]
mov qword [rbp - 0x20], rax
lea rax, str.9__f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rdx, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823whoami_0.9.0_srcwindows.rsFailed_to_get_username:___report_at_https:__github.com_libcala_whoami_issues
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2

Function at 0x140050bb0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 8], 0
lea r9, [rbp - 8]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rbp - 8]
test eax, eax
je 0x140050bf2
call sub.ole32.dll_CoTaskMemFree
mov byte [rsi + 0x18], 2
jmp 0x140050c1f
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.140096fe0
mov rcx, qword [rbp - 8]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret

Function at 0x140053740
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
nop word [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140053750
test al, 1
je 0x14005376f
test al, 2
jne 0x140053789
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
Function at 0x140057200
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057220
test al, 1
je 0x140057298
test al, 2
jne 0x1400572b2
test al, 8
mov qword [rbp + 8], rcx
jne 0x140057249
add rcx, 0x20
call fcn.1400680b0
jmp 0x140057265
test al, 0x10
je 0x140057265
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x14005732b
mov rcx, qword [rcx + 0x60]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp], 1
mov rax, 0xffffffffffffffc0
mov rcx, qword [rbp + 8]
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp]
jb 0x1400572cc
jne 0x14005728e
call fcn.1400561f0
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.1400b9ca0]
mov qword [rbp - 0x20], rax
mov rcx, rbp
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_pb_f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 2
lea rdx, [0x1400c62a0]
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2
lea rcx, str.waker_missing
lea r8, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.24.1_src_runtime_taskcore.rs
mov edx, recv
call fcn.1400bbd10
ud2
Function at 0x140057410
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057430
test al, 1
je 0x1400574a8
test al, 2
jne 0x1400574c2
test al, 8
mov qword [rbp + 8], rcx
jne 0x140057459
add rcx, 0x20
call fcn.1400682b0
jmp 0x140057475
test al, 0x10
je 0x140057475
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + 0x60]
test rax, rax
je 0x14005753b
mov rcx, qword [rcx + 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp], 1
mov rax, 0xffffffffffffffc0
mov rcx, qword [rbp + 8]
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp]
jb 0x1400574dc
jne 0x14005749e
call fcn.1400563e0
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.1400b9ca0]
mov qword [rbp - 0x20], rax
mov rcx, rbp
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_pb_f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 2
lea rdx, [0x1400c62a0]
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2
lea rcx, str.waker_missing
lea r8, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.24.1_src_runtime_taskcore.rs
mov edx, recv
call fcn.1400bbd10
ud2
Function at 0x140057620
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057640
test al, 1
je 0x1400576b8
test al, 2
jne 0x1400576d2
test al, 8
mov qword [rbp + 8], rcx
jne 0x140057669
add rcx, 0x20
call fcn.140067e70
jmp 0x140057685
test al, 0x10
je 0x140057685
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + 0x78]
test rax, rax
je 0x14005774b
mov rcx, qword [rcx + 0x70]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp], 1
mov rax, 0xffffffffffffffc0
mov rcx, qword [rbp + 8]
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp]
jb 0x1400576ec
jne 0x1400576ae
call fcn.1400560e0
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.1400b9ca0]
mov qword [rbp - 0x20], rax
mov rcx, rbp
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_pb_f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 2
lea rdx, [0x1400c62a0]
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2
lea rcx, str.waker_missing
lea r8, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.24.1_src_runtime_taskcore.rs
mov edx, recv
call fcn.1400bbd10
ud2
Function at 0x140057830
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057850
test al, 1
je 0x1400578cb
test al, 2
jne 0x1400578e5
test al, 8
mov qword [rbp + 8], rcx
jne 0x140057879
add rcx, 0x20
call fcn.140067c40
jmp 0x140057898
test al, 0x10
je 0x140057898
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + 0x80]
test rax, rax
je 0x14005795e
mov rcx, qword [rcx + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp], 1
mov rax, 0xffffffffffffffc0
mov rcx, qword [rbp + 8]
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp]
jb 0x1400578ff
jne 0x1400578c1
call fcn.1400562e0
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.1400b9ca0]
mov qword [rbp - 0x20], rax
mov rcx, rbp
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_pb_f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 2
lea rdx, [0x1400c62a0]
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2
lea rcx, str.waker_missing
lea r8, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.24.1_src_runtime_taskcore.rs
mov edx, recv
call fcn.1400bbd10
ud2
Function at 0x140057a40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057a60
test al, 1
je 0x140057adb
test al, 2
jne 0x140057af5
test al, 8
mov qword [rbp + 8], rcx
jne 0x140057a89
add rcx, 0x20
call fcn.1400679d0
jmp 0x140057aa8
test al, 0x10
je 0x140057aa8
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + 0x80]
test rax, rax
je 0x140057b6e
mov rcx, qword [rcx + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp], 1
mov rax, 0xffffffffffffffc0
mov rcx, qword [rbp + 8]
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp]
jb 0x140057b0f
jne 0x140057ad1
call fcn.140056520
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400c6218]
mov edx, 0x23
call fcn.1400bffc0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400c6258]
mov edx, 0x25
call fcn.1400bffc0
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.1400b9ca0]
mov qword [rbp - 0x20], rax
mov rcx, rbp
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:_pb_f_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
mov qword [rbp - 0x58], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 2
lea rdx, [0x1400c62a0]
lea rcx, [rbp - 0x58]
call fcn.1400bfee0
ud2
lea rcx, str.waker_missing
lea r8, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.24.1_src_runtime_taskcore.rs
mov edx, recv
call fcn.1400bbd10
ud2

Function at 0x1400709e0
Capabilities:
Terminate process

Disassembly:
jmp 0x140099fe0
sub rsp, 0x28
mov rcx, qword [rcx]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140099ffd
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x140081e00
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140086680
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1400fe178]
cmp rax, 3
jne 0x14008670b
cmp word [rdi], 0
mov eax, 2
mov ecx, reloc.WS2_32.dll_socket
cmove ecx, eax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1400866e0
mov rdi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1400866f8
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400866fe
mov qword [rsi + 8], rdi
xor eax, eax
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823mio_0.8.5_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400fe178]
lea r9, fcn.140003d50
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400bf680
jmp 0x140086699

Function at 0x140086750
Capabilities:
Connect socket

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rdi, rdx
mov r14, rcx
cmp word [rdx], 0
je 0x1400867b6
add rdi, 4
mov rcx, rdi
call fcn.14005ad50
movups xmm6, xmmword [rax]
mov rcx, rdi
call fcn.140096950
mov r15d, eax
mov rcx, rdi
call fcn.140096930
mov esi, eax
rol si, 8
mov rcx, rdi
call fcn.140096940
mov ebx, eax
mov edi, 0x1c
mov ax, reloc.WS2_32.dll_socket
jmp 0x1400867de
add rdi, 2
mov rcx, rdi
call fcn.14005ad50
mov ebx, dword [rax]
mov rcx, rdi
call fcn.140096920
mov esi, eax
rol si, 8
xorps xmm6, xmm6
mov edi, reloc.WS2_32.dll_recv
mov ax, 2
mov word [rbp - 0x40], ax
mov word [rbp - 0x3e], si
mov dword [rbp - 0x3c], ebx
movups xmmword [rbp - 0x38], xmm6
mov dword [rbp - 0x28], r15d
mov rcx, r14
call fcn.14005ad50
mov rcx, rax
call fcn.14005ad50
mov rcx, rax
call fcn.14005ad60
lea rdx, [rbp - 0x40]
mov rcx, rax
mov r8d, edi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140086822
xor eax, eax
jmp 0x140086849
call sub.KERNEL32.dll_GetLastError
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rbp - 0x20], rcx
mov ecx, eax
call fcn.1400a90a0
xor ecx, ecx
cmp al, 0xd
mov rax, qword [rbp - 0x20]
cmove rax, rcx
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x140091900
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x140091921
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov qword [rcx], 0
cmp r8, 1
je 0x140091959
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140091952
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140091959
mov ecx, eax
call fcn.1400a8020
mov r8d, dword [0x1400fe328]
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + r8*8]
mov qword [rcx + 0xd8], 1
mov qword [rcx + 0xe0], rax
mov qword [rcx + 0xe8], rdx
add rsp, 0x38
ret

Function at 0x140091d40
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140091de0
jmp 0x140091dcf
jae 0x140091e9e
cmp r8, 0x201
jae 0x140091de0
lea rbx, [rbp - 0x58]
mov r14d, 0x200
mov rsi, r8
jmp 0x140091e37
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x140091e0f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1400bf090
mov r12, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov rbx, qword [rbp + 0x3e8]
mov r14, rdi
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x140091e5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140091f06
mov r8d, r15d
cmp rsi, r8
jne 0x140091dc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140091f29
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x140091dcf
jmp 0x140091de0
cmp r14, r8
jb 0x140091f43
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.140096fe0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x140091eef
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.14004e810
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140091ed7
jmp 0x140091eef
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400bffc0
jmp 0x140091f58
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400c03c0
ud2
Function at 0x140092760
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
cmp byte [rcx], 0
je 0x14009277e
mov rcx, rdx
mov rdx, r8
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.1400927f0
lea rcx, [rsp + 0x28]
call fcn.1400a2210
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400927af
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400927b4
xor ebx, ebx
test rsi, rsi
jne 0x1400927c9
jmp 0x1400927dd
mov rbx, rsi
jmp 0x1400927dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1400927dd
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004e810
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140096e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov rcx, qword [rcx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140096ec2
cdqe
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140096eea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x140096ed7
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140096eea
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140096f00
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov rcx, qword [rcx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140096f3d
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140096f54
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret