joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400400dc
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
or qword [rsp + 0x60], 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x1400402b4
mov ebx, r9d
mov ebp, r8d
lea r14, [rsp + 0x78]
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov r8, r14
call fcn.1400a5219
mov rdi, qword [r14]
mov r15, qword [r14 + 8]
test rax, rax
je 0x140040165
mov r12, rax
mov rcx, rdi
mov rdx, r15
call fcn.1400a51b2
mov rdi, 0xffffffffffffffff
mov r15, r12
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x50]
mov rcx, r13
call fcn.1400a50f7
mov rcx, qword [r13 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14004018b
mov rdx, qword [rsp + 0x68]
call fcn.1400a51b2
lea r13, [rsp + 0x50]
mov rcx, qword [r13 + 8]
call fcn.1400a514d
mov rcx, r13
call fcn.1400a28f6
mov rcx, r12
call fcn.1400a2e3a
cmp rdi, 0xffffffffffffffff
je 0x140040298
mov rcx, r15
call fcn.140058834
lea r9, [rsp + 0x50]
mov dword [r9], 1
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140040280
movzx eax, bp
imul eax, eax, 0x3e8
movzx ecx, bx
imul ecx, ecx, 0x3e8
lea r8, [rsp + 0x50]
mov dword [r8], 1
mov dword [r8 + 4], eax
mov dword [r8 + 8], ecx
and dword [rsp + 0x78], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], r14
and qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 0x98000004
mov r9d, 0xc
call qword [sym.imp.ws2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x140040280
lea r9, str.src_netmod.rs
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400a76fd
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
test rax, rax
je 0x140040277
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 8], rcx
mov qword [rsi], rax
jmp 0x1400402a0
call fcn.140057873
mov qword [rsi + 8], rax
and qword [rsi], 0
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1400402a0
mov qword [rsi + 8], r15
and qword [rsi], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersViolet.cargo_registry_src_rsproxy.cn_0dccff568467c15b_tokio_1.39.2_srciopoll_evented.rs
call fcn.1400ea927
int3
Function at 0x140046528
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r10, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [r10 + r8*2]
xor eax, eax
cmp r10, r8
je 0x1400465be
lea r14, [r10 + 2]
movzx r15d, byte [r10 + 1]
lea r11, [rax + r15]
cmp byte [r10], bl
jne 0x14004659a
cmp r11, rax
jb 0x140046609
cmp r11, rdx
ja 0x1400465fa
add rax, r9
xor r10d, r10d
cmp r15, r10
je 0x1400465a4
lea r12, [r10 + 1]
cmp byte [rax + r10], cl
mov r10, r12
jne 0x140046586
jmp 0x1400465ac
mov r10, r14
mov rax, r11
jbe 0x14004655b
jmp 0x1400465be
mov r10, r14
mov rax, r11
jmp 0x14004655b
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add rsi, rdi
mov al, 1
cmp rdi, rsi
je 0x1400465ae
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400465db
mov rdi, r8
jmp 0x1400465f2
cmp r8, rsi
je 0x14004661b
and edx, 0x7f
shl edx, 8
movzx r8d, byte [rdi + 1]
add rdi, 2
or edx, r8d
sub ecx, edx
js 0x1400465ae
xor al, 1
jmp 0x1400465c6
lea r8, str.C:UsersViolet.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrarycore_srcunicodeprintable.rs
mov rcx, r11
call fcn.1400ea5e4
lea r8, str.C:UsersViolet.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r11
call fcn.1400ea7de
lea rcx, str.C:UsersViolet.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrarycore_srcunicodeprintable.rs
call fcn.1400ea927
int3

Function at 0x1400566d1
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
test rdi, rdi
je 0x140056746
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call r13
cmp eax, 0xbfffffff
jbe 0x1400566fb
mov ebp, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x1400566fb
and ebp, 0x7fffffff
mov eax, ebp
jmp 0x140056748
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
jne 0x1400566d1
xor eax, eax
ret
Function at 0x1400588d2
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [rcx]
cmp byte [rax], 0
mov byte [rax], 0
je 0x140058ad3
invalid
lea rdx, str.127.0.0.1:0capacity_overflow
lea rsi, [rsp + 0x38]
mov r8d, 0xb
add byte [rax], al
mov rcx, rsi
call fcn.14009f827
cmp qword [rsi], 0
je 0x140058a85
invalid
lea rax, [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
and al, 0x60
xor r14d, r14d
mov rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x78]
je 0x140058a6b
lea rcx, [rax + 0x20]
mov qword [rsp + 0x68], rcx
movzx ebp, word [rax]
cmp bp, 2
std
add cl, byte [rdi]
test byte [rcx + rax], dl
add byte [rax], al
mov qword [rsp + 0x28], r14
mov esi, dword [rax + 2]
movzx r14d, word [rax + 6]
mov r15d, dword [rax + 8]
mov rbx, qword [rax + 0xc]
mov r12d, dword [rax + 0x14]
mov edi, dword [rax + 0x18]
movzx r13d, word [rax + 0x1c]
movzx ebp, word [rax + 0x1c]
call fcn.14009f6a9
mov ecx, ebp
mov edx, 2
call fcn.14009f9ee
jo 0x14005898c
add byte [rcx - 0x77], cl
ror byte [rax - 0x7b], cl
invalid
je 0x14005899e
mov rsi, qword [rsp + 0x28]
mov r14, r10
mov esi, edx
jmp 0x140058a5e
add byte [rax], al
shl r14, 0x20
or r14, rsi
test bp, bp
je 0x1400589db
mov r11d, edi
mov edx, r12d
movabs rax, 0xffffffff0000
add byte [rcx + 0x21], cl
invalid
shr r14, 0x10
mov r8d, 0x1c
mov cx, 0x17
mov rdi, rbx
mov r12d, r11d
mov rax, r14
mov rsi, qword [rsp + 0x28]
jmp 0x140058a03
mov r13, r14
shr r13, 0x20
mov r8d, 0x10
mov cx, 2
xor eax, eax
xor r15d, r15d
mov edx, r14d
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov edi, dword [rsp + 0x58]
mov r12d, dword [rsp + 0x34]
mov esp, dword [rsp + 0x34]
mov rbx, r10
rol r13w, 8
mov word [rsp + 0x38], cx
mov word [rsp + 0x3a], r13w
mov dword [rsp + 0x3c], edx
shl r15, 0x20
or r15, rax
invalid
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rdi
and al, 0x48
mov dword [rsp + 0x50], r12d
mov rcx, r10
ror dword [rax - 0x73], 1
push rsp
and al, 0x38
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x140058aa4
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x58], rdi
call fcn.14009f780
insd dword [rdi], dx
add al, 0
mov r14, rax
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_closesocket]
mov rcx, rsi
call fcn.140056fd7
in eax, 0xff
invalid
jmp 0x140058931
lea rcx, [rsp + 0x60]
call fcn.140056fbc
test r14, r14
lea rcx, str.could_not_resolve_to_any_addresses
cmovne rcx, r14
cmovne ecx, esi
jmp 0x140058a8a
mov rcx, qword [rsp + 0x40]
call fcn.14005696a
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x60]
call fcn.140056fbc
mov rcx, rsi
call fcn.140056fd7
mov rcx, rbx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop rbp
pop r14
pop r15
pop rdi
jmp qword [sym.imp.ws2_32.dll_closesocket]
lea rcx, str.C:UsersViolet.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrary_std_src_synconce.rs
call fcn.1400ea927
or dword [rax], eax
int3
Function at 0x14005c13a
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
test rdi, rdi
je 0x140056746
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call r13
cmp eax, 0xbfffffff
jbe 0x1400566fb
mov ebp, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x1400566fb
and ebp, 0x7fffffff
mov eax, ebp
jmp 0x140056748
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
jne 0x1400566d1
xor eax, eax
ret

Function at 0x14006338c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.140062b24
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
cmp eax, 1
je 0x1400633c0
cmp eax, 2
jne 0x1400633cd
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400c3620
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400c39c0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400e0680
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [rdi]
call fcn.1400c3880
call fcn.1400c2f00
movdqu xmmword [rsi], xmm0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
movups xmm2, xmmword [rcx]
mov eax, dword [r8 + 0xf0]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec eax
movups xmm1, xmmword [r8]
lea r8, [r8 + 0x10]
jne 0x1400c39da
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rdx], xmm2
pxor xmm2, xmm2
ret
push rbx
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x140145058]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, rdx
mov rbx, rcx
mov rdx, r8
lea rcx, [rsp + 0x60]
mov rdi, r8
call fcn.1400df740
mov r8d, 1
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400e02d8
mov edx, dword [rdi + 0xf0]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400df670
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call fcn.1400df7d4
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400e8f50
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006946a
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
lea r12, [rsp + 0x78]
xorps xmm0, xmm0
movaps xmmword [r12 + 0x58], xmm0
movaps xmmword [r12 + 0x48], xmm0
movaps xmmword [r12 + 0x38], xmm0
movaps xmmword [r12 + 0x28], xmm0
movaps xmmword [r12 + 0x18], xmm0
movaps xmmword [r12 + 8], xmm0
movaps xmmword [r12 - 8], xmm0
mov byte [r12 + 0x68], 0
movups xmm1, xmmword [0x1400fd970]
lea r13, [rsp + 0x138]
movups xmmword [r13 + 0x38], xmm1
movups xmm1, xmmword [0x1400fd960]
movups xmmword [r13 + 0x28], xmm1
movups xmm1, xmmword [0x1400fd950]
movups xmmword [r13 + 0x18], xmm1
movups xmm1, xmmword [0x1400fd940]
movups xmmword [r13 + 8], xmm1
lea rax, [0x1400fd910]
movups xmmword [r13 + 0x50], xmm0
movups xmmword [r13 + 0x60], xmm0
movups xmmword [r13 + 0x70], xmm0
movups xmmword [r13 + 0x80], xmm0
movups xmmword [r13 + 0x90], xmm0
movups xmmword [r13 + 0xa0], xmm0
movups xmmword [r13 + 0xb0], xmm0
movups xmmword [r13 + 0xc0], xmm0
mov qword [r13], rax
and qword [r13 + 0x48], 0
and qword [r13 + 0xd0], 0
add rdx, 0x20
mov r8d, 0x20
mov rcx, r13
call fcn.1400670ae
mov rcx, r13
mov rdx, r14
mov r8, r15
call fcn.1400670ae
lea rbp, [rsp + 0x210]
mov r8d, 0xd8
mov rcx, rbp
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov rdx, rbp
call fcn.14006723f
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, rbx
call fcn.140069638
call fcn.140063c8a
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, r13
call fcn.140068da2
mov rcx, r12
mov rdx, rbx
call fcn.140068df2
lea r8, [rsi + 0x40]
mov qword [rsp + 0x20], r15
lea rbx, [rsp + 0x138]
mov rcx, rbx
mov rdx, r12
mov r9, r14
call fcn.1400696a4
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rbx
call fcn.140069638
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov rdx, r14
mov r8, rsi
mov r9, r13
call fcn.1400e3350
mov qword [rbx - 0x28], 0x40
lea rsi, [rsp + 0x70]
mov ecx, 0xf
rep movsq qword [rdi], qword [rsi]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400696a4
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1d0
mov rbx, r9
mov r14, r8
mov rsi, rcx
movups xmm0, xmmword [0x1400fd970]
lea rdi, [rsp + 0x20]
movups xmmword [rdi + 0x38], xmm0
movups xmm0, xmmword [0x1400fd960]
movups xmmword [rdi + 0x28], xmm0
movups xmm0, xmmword [0x1400fd950]
movups xmmword [rdi + 0x18], xmm0
movups xmm0, xmmword [0x1400fd940]
movups xmmword [rdi + 8], xmm0
lea rax, [0x1400fd910]
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xc0], xmm0
mov qword [rdi], rax
and qword [rdi + 0x48], 0
mov r15, qword [rsp + 0x220]
and qword [rdi + 0xd0], 0
mov r8d, 0x20
mov rcx, rdi
call fcn.1400670ae
mov r8d, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.1400670ae
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1400670ae
lea rbx, [rsp + 0xf8]
mov r8d, 0xd8
mov rcx, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
mov rdx, rbx
call fcn.14006723f
nop
add rsp, 0x1d0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140099c03
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1401060e8]
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov ecx, 0xffffffff
invalid
invalid
invalid
dec dword [rcx + 0x39]
enter 0xf49, 0x42
enter 0x570f, 0xffffffffffffffc0

Function at 0x14009bbe7
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rbx, [rsp + 0x78]
and al, 0x78
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov eax, 0x200
mov r15d, 2
xor r12d, r12d
mov r13d, 0xffffffff
xor esi, esi

Function at 0x14009e3de
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1401060e8]
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov ecx, 0xffffffff
cmp r8, rcx
cmovb rcx, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14009e444
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0
cmp eax, 0xc0000011
je 0x14009e47d
cmp eax, 0x103
je 0x14009e489
test eax, eax
js 0x14009e466
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
jmp 0x14009e47d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ecx, 1
mov rax, rcx
add rsp, 0xb0
pop rsi
ret
lea rcx, [rsp + 0x58]
mov byte [rcx + 4], 0
and dword [rcx], 0
lea rax, [0x140106158]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov qword [rdx + 8], 1
lea rax, [rsp + 0x50]
mov qword [rdx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
call fcn.140099f87
lea rcx, [rsp + 0x78]
mov qword [rcx], rax
call fcn.140007d48
mov ecx, 7
int 0x29
ud2

Function at 0x14009f70f
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov rdi, rdx
mov rsi, rcx
mov esi, ecx
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
movaps xmmword [rax], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
and al, 0x28
and qword [r9], 0
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14009f760
call fcn.14009f780
mov ecx, 1
jmp 0x14009f772
invalid
mov rax, qword [rsp + 0x28]
movzx ecx, word [rdi]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov dword [rsi], ecx
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14009f7b1
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov eax, dword [rcx]
mov rdi, qword [rax]
and qword [rax], 0
test rdi, rdi
je 0x14009f807
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_WSAStartup]
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x14009f813
mov rax, qword [sym.imp.ws2_32.dll_WSACleanup]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, str.C:UsersViolet.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrary_std_src_synconce.rs
call fcn.1400ea927
lea rdx, [rsp + 0x30]
and qword [rdx], 0
lea rcx, [rsp + 0x2c]
call fcn.1400eb7b0
int3

Function at 0x14009f9ee
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, edx
test cx, cx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
and dword [rsp + 0x20], 0
mov ecx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14009fa3b
xor edi, edi
mov rax, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x14009fa51
mov esi, eax
cmp eax, 0x2726
jne 0x14009faa7
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14009fab9
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x14009fa2b
call fcn.140057873
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov edi, 1
mov rsi, rbx
jmp 0x14009fa2d
shl rsi, 0x20
or rsi, 2
mov edi, 1
jmp 0x14009fa2d
mov edi, 1
call fcn.14009f780
mov rsi, rax
jmp 0x14009fa2d

Function at 0x14009facb
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x24]
mov dword [r8], 1
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14009faef
xor eax, eax
jmp 0x14009faf4
call fcn.14009f780
nop
add rsp, 0x28
ret
Function at 0x1400a5f48
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
movdqa xmmword [rsp + 0xf0], xmm8
movdqa xmmword [rsp + 0xe0], xmm7
movdqa xmmword [rsp + 0xd0], xmm6
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x40]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
cmp byte [rdi + 0xc4], 0
je 0x1400a5fb3
mov rcx, rbx
call fcn.1400a39c2
xor ebx, ebx
mov rcx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x60]
cmp rax, rcx
jne 0x1400a5fd1
lea rcx, [rdi + 0x48]
call fcn.1400a5039
mov rcx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x58]
add rdx, rax
xor r8d, r8d
cmp rdx, rcx
cmovae r8, rcx
sub rdx, r8
mov rcx, qword [rdi + 0x50]
shl rdx, 4
mov qword [rcx + rdx], rbx
mov byte [rcx + rdx + 8], 1
inc rax
mov qword [rdi + 0x60], rax
lock inc qword [rdi + 0x108]
mov rax, qword [rdi + 0x100]
test rax, rax
je 0x1400a6034
lock dec qword [rdi + 0x100]
inc dword [rdi + 0xc0]
add rdi, 0xc8
mov rcx, rdi
call qword [sym.imp.kernel32.dll_WakeConditionVariable]
jmp 0x1400a649f
add al, 0
invalid
mov rax, qword [rdi + 0xf8]
cmp rax, qword [rdi + 0xf0]
je 0x1400a649f

Function at 0x1400a68c8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400a68cf
test al, 1
je 0x1400a68ee
test al, 2
jne 0x1400a6906
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140109318]
mov edx, 0x23
call fcn.1400ea651
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140109358]
mov edx, 0x25
call fcn.1400ea651
int3

Function at 0x1400a7c94
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
call fcn.1400a5c16
lea r9, [rsp + 0x34]
mov dword [r9], 1
mov rcx, qword [rax]
mov dword [rsp + 0x20], 4
and byte [rax + rax], al
add byte [rax], al
Function at 0x1400a7f3d
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push rbp
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rdx
xlatb
mov rbx, rcx
lea r14, [rsp + 0x2a]
lea r12, [rsp + 0x42]
mov r13, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov eax, 0x7fffffff
cmp r9, rax
cmovb rax, r9
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
and al, 0x48
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], r13
mov rcx, rbp
mov rdx, r13
mov r8, rdi
call fcn.1400a7c8c
mov al, byte [rsp + 0x29]
cmp al, 3
je 0x1400a80aa
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400a80a3
mov cl, byte [rsp + 0x28]
movzx edx, word [r14 + 4]
mov word [r12 + 4], dx
mov edx, dword [r14]
mov dword [r12], edx
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], al
cmp r15, 0xffffffffffffffff
je 0x1400a80ca
mov rcx, r15
mov rdx, rsi
mov r8, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400a80b1
call fcn.14009f780
mov rbp, rax
mov rcx, rax
call fcn.140057fe8
cmp al, 0xd
jne 0x1400a8073
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400a8073
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400a80d6
mov r13, r15
mov r15, rbx
mov rbx, r14
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.140057efa
mov r14, rax
xor ecx, ecx
call fcn.140056fd7
test r14, r14
je 0x1400a8065
mov ecx, 1
mov rdx, rbp
call fcn.1400582a6
add r15b, bl
dec dword [rcx + rcx*4 - 0xb]
mov r14, rbx
mov rbx, r15
mov r15, r13
mov r13, qword [rsp + 0x30]
mov rcx, rbp
call fcn.1400a3194
cmp al, 0xd
jne 0x1400a80a3
mov qword [rsp + 0x20], rbp
mov rcx, rbx
lea rdx, [rsp + 0x38]
call fcn.1400a769a
lea rbp, [rsp + 0x20]
lea ebp, [rsp + 0x20]
mov rcx, rbp
call fcn.140006f68
jmp 0x1400a7f8c
mov eax, 1
jmp 0x1400a80b6
mov eax, 2
jmp 0x1400a80b6
movsxd rbp, eax
xor eax, eax
mov rdx, rbp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersViolet.cargo_registry_src_rsproxy.cn_0dccff568467c15b_tokio_1.39.2_srciopoll_evented.rs
call fcn.1400ea927
ud2

Function at 0x1400a80d8
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
lea r15, [rsp + 0x4a]
lea r13, [rsp + 0x62]
lea r12, [rsp + 0x48]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x78], rax
mov rsi, qword [rcx + 0x10]
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x68], rax
xorps xmm6, xmm6
mov qword [rsp + 0x50], rsi