joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017fff0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140180062
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x140180028
add rdi, rbx
sub rsi, rbx
je 0x140180062
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x140180020
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x140180020
add ebp, 0x80000000
jmp 0x140180064
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14018a3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r12, r9
mov r9d, r8d
mov rdi, rdx
mov r14, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, rdi
mov byte [rsp + 0x27], r9b
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
mov esi, 2
cmp al, 3
jne 0x14018a3f5
jmp 0x14018a54f
mov r13, qword [r12]
mov rcx, qword [r12 + 8]
mov qword [rsp + 0x40], rcx
add r13, 0x18
mov rcx, qword [r12 + 0x10]
mov qword [rsp + 0x38], rcx
lea rsi, [rsp + 0x28]
jmp 0x14018a45a
dec r15
mov edx, 0x18
mov r8d, 8
mov rcx, r15
call fcn.140055580
mov rsi, rbx
mov rcx, rbx
mov rdx, r14
mov r8, rdi
movzx r9d, byte [rsp + 0x27]
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x14018a54a
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x14018a53f
cmp qword [r13], 0xffffffffffffffff
je 0x14018a569
movzx r12d, byte [rsp + 0x30]
mov qword [rsp + 0x28], r13
mov rbx, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
call fcn.14019fbc0
mov r15, rdx
test rax, rax
je 0x14018a546
mov rsi, rax
mov rcx, r15
call fcn.140189e80
cmp al, 0xd
jne 0x14018a552
and ebp, 0x23
mov rax, qword [r14 + 0x90]
xor rbp, 0x2f
mov rcx, r12
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp r12b, dl
jne 0x14018a4ec
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r14 + 0x90], rdx
jne 0x14018a4d0
mov eax, r15d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14018a436
test rax, rax
je 0x14018a436
mov rsi, qword [r15 - 1]
mov r12, qword [r15 + 7]
mov rax, qword [r12]
test rax, rax
je 0x14018a51f
mov rcx, rsi
call rax
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x14018a420
mov r8, qword [r12 + 0x10]
mov rcx, rsi
call fcn.140055580
jmp 0x14018a420
mov esi, 1
jmp 0x14018a54f
xor esi, esi
jmp 0x14018a552
mov esi, 2
mov r15, rbp
mov rax, rsi
mov rdx, r15
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x14018a750
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14018a760
test al, 1
je 0x14018a77b
test al, 2
jne 0x14018a77b
xor rax, 3
ret
ud2

Function at 0x14018c250
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14018c260
add rcx, 0x18
jmp 0x14019fb80
ud2
jmp 0x1401ae2d0
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1401ae308
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x14018c2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140191350
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14019139a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1401913c5
mov eax, 1
jmp 0x140191533
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1401914fc
mov eax, 1
jmp 0x140191533
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x14019141f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140055580
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140191390
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140191505
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x14019154f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.14019fba0
mov r13, rdx
test rax, rax
je 0x140191509
mov rcx, r13
call fcn.140190ff0
cmp al, 0xd
jne 0x14019152e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x1401914ac
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140191490
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401913f6
test rax, rax
je 0x1401913f6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1401914de
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1401913e0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140055580
jmp 0x1401913e0
cmp al, 2
jne 0x140191547
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140191533
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x14019151d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x14019154f
cmp rax, rcx
ja 0x14019154f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x14018c300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140191560
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1401915b1
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1401915dc
mov eax, 2
jmp 0x140191716
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1401916fc
mov eax, 2
jmp 0x140191716
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140191623
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140055580
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x1401915a7
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x140191711
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.14019fbb0
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x14019170c
mov rcx, r13
call fcn.140190ff0
cmp al, 0xd
jne 0x14019170c
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x1401916ac
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140191690
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140191606
test rax, rax
je 0x140191606
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x1401916de
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1401915f0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140055580
jmp 0x1401915f0
cmp al, 2
jne 0x14019172d
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x140191719
mov rax, rsi
jmp 0x140191719
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140191350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140191350
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14019139a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1401913c5
mov eax, 1
jmp 0x140191533
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1401914fc
mov eax, 1
jmp 0x140191533
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x14019141f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140055580
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14018a1b0
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140191390
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140191505
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x14019154f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.14019fba0
mov r13, rdx
test rax, rax
je 0x140191509
mov rcx, r13
call fcn.140190ff0
cmp al, 0xd
jne 0x14019152e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x1401914ac
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140191490
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401913f6
test rax, rax
je 0x1401913f6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1401914de
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1401913e0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140055580
jmp 0x1401913e0
cmp al, 2
jne 0x140191547
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140191533
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x14019151d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x14019154f
cmp rax, rcx
ja 0x14019154f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x140191560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140191560
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1401915b1
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1401915dc
mov eax, 2
jmp 0x140191716
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1401916fc
mov eax, 2
jmp 0x140191716
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140191623
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140055580
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14018a1b0
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x1401915a7
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x140191711
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.14019fbb0
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x14019170c
mov rcx, r13
call fcn.140190ff0
cmp al, 0xd
jne 0x14019170c
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x1401916ac
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140191690
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140191606
test rax, rax
je 0x140191606
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x1401916de
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1401915f0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140055580
jmp 0x1401915f0
cmp al, 2
jne 0x14019172d
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x140191719
mov rax, rsi
jmp 0x140191719
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x140191730
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14019d200
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d238
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x140191740
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14019d250
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d285
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x140191750
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14019d1b0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d1e5
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x140196460
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140196470
test al, 1
je 0x140196563
test al, 2
jne 0x140196563
test al, 8
jne 0x1401964ab
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.14018e5d0
jmp 0x1401964c3
test al, 0x10
je 0x1401964c3
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140196563
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x140196563
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x14019652c
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x140196532
test rax, rax
jne 0x14019653b
mov rdx, qword [rsi + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14019653b
test rdx, rdx
je 0x14019653b
mov rcx, qword [rsi + 0x38]
mov r8d, 1
call fcn.140055580
jmp 0x14019653b
add rsp, 0x50
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.1401320a0
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14019654b
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.140055580
ud2
Function at 0x14019d130
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x14019d15a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x14019d170
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14019d19a
xor eax, eax
add rsp, 0x28
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x14019d1b0
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14019d1b0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d1e5
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14019d200
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14019d200
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d238
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14019d250
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14019d250
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d285
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x14019d2a0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rsi, qword [rcx]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14019d3c7
mov r9d, dword [rdi + 8]
xor ecx, ecx
mov r8d, 0
cmp r9d, 0x3b9aca00
je 0x14019d328
mov eax, 0x3e8
mul qword [rdi]
mov r8d, r9d
imul r9, r8, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor r8d, r8d
neg rdx
sbb r8d, r8d
or r8d, r9d
mov r9d, dword [rdi + 0x18]
cmp r9d, 0x3b9aca00
je 0x14019d369
mov eax, 0x3e8
mul qword [rdi + 0x10]
mov ecx, r9d
imul r9, rcx, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor ecx, ecx
neg rdx
sbb ecx, ecx
or ecx, r9d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x48]
mov rcx, rsi
mov edx, 0x98000004
mov r9d, 0xc
call qword [sym.imp.ws2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x14019d3c7
xor eax, eax
jmp 0x14019d3d4
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14019f970
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov eax, dword [0x14027f390]
cmp eax, 3
jne 0x14019fa0d
mov ecx, edi
mov edx, esi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x14019f9e8
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x14019f9fe
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
jmp 0x14019fa03
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov eax, 1
jmp 0x14019fa03
xor eax, eax
mov rdi, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_1.0.2_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x14027f390]
lea r9, [0x14025f848]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1401fbf20
jmp 0x14019f994
Function at 0x14019fa50
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.14019f970
mov rdi, rdx
test rax, rax
je 0x14019fa82
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x14019fb23
cmp word [rbx], 0
je 0x14019faa7
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x14019fac0
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14019fafa
call sub.kernel32.dll_GetLastError
cmp eax, 0x2733
jne 0x14019fb07
mov qword [rsi], rdi
mov qword [rsi + 8], 0
jmp 0x14019fb23
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401a8540
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1401a85cc
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x1401a85d1
cmp eax, 0x40
jb 0x1401a86c1
cmp rax, r8
ja 0x1401a86c1
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x1401a85d6
mov r10b, 5
cmp r9d, 0x20b
jne 0x1401a8601
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1401a8601
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x1401a8601
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x1401a8601
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x1401a8634
jmp 0x1401a86c1
xor r10d, r10d
jmp 0x1401a8601
mov r10b, 1
jmp 0x1401a8601
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1401a8601
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x1401a8601
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x1401a8621
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x1401a86c1
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x1401a86c1
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x1401a860f
ud2