joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005016c
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x14005030d
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rbx, [r14 + r8]
add rdx, rbx
lea rdi, [rcx + 0x80]
cmp qword [rcx + 0x90], rdx
jae 0x1400501bb
mov rcx, rdi
xor r8d, r8d
call fcn.140011227
lea r9, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004e9b9
lea rcx, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.140086118
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
call fcn.14004e9a3
mov r9, rdx
lea r15, [rsp + 0x78]
mov rcx, r15
mov edx, 7
mov r8, rax
call fcn.140086421
lea r9, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004e9b9
mov r9, rdx
lea r14, [rsp + 0x88]
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140086421
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, rbx
call fcn.14004e93e
mov r9, rdx
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov edx, 6
mov r8, rax
call fcn.140086421
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140086421
movups xmm0, xmmword [r15]
movaps xmmword [r12 - 0x30], xmm0
movups xmm0, xmmword [r14]
movaps xmmword [r12 - 0x20], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r12 - 0x10], xmm0
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rbx
call fcn.140086438
lea rcx, [rsi + 0xf0]
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x1400502de
shl rax, 0x20
or rax, 2
jmp 0x1400502fc
mov edx, dword [rsp + 0x40]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.140082a24
and qword [rsi + 0x98], 0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov edx, 0x3e
call fcn.1401d7a80
int3
Function at 0x140050326
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x1400504c7
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rbx, [r14 + r8]
add rdx, rbx
lea rdi, [rcx + 0x180]
cmp qword [rcx + 0x190], rdx
jae 0x140050375
mov rcx, rdi
xor r8d, r8d
call fcn.140011227
lea r9, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004e9b9
lea rcx, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.140086118
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
call fcn.14004e9a3
mov r9, rdx
lea r15, [rsp + 0x78]
mov rcx, r15
mov edx, 7
mov r8, rax
call fcn.140086421
lea r9, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004e9b9
mov r9, rdx
lea r14, [rsp + 0x88]
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140086421
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rdi
mov rdx, rbx
call fcn.14004e93e
mov r9, rdx
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov edx, 6
mov r8, rax
call fcn.140086421
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140086421
movups xmm0, xmmword [r15]
movaps xmmword [r12 - 0x30], xmm0
movups xmm0, xmmword [r14]
movaps xmmword [r12 - 0x20], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r12 - 0x10], xmm0
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rbx
call fcn.140086438
lea rcx, [rsi + 0x1f0]
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x140050498
shl rax, 0x20
or rax, 2
jmp 0x1400504b6
mov edx, dword [rsp + 0x40]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.140082a24
and qword [rsi + 0x198], 0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov edx, 0x3e
call fcn.1401d7a80
int3
Function at 0x140085e4a
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov rsi, rcx
mov byte [rbp + 0x67], dl
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x20], 4
mov dword [rbp + 0x28], 0x400010
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x18], rax
je 0x140085ead
mov ecx, dword [rsi + 0x28]
mov dword [rbp + 8], ecx
mov rcx, qword [rsi + 0x20]
mov qword [rbp + 0x10], rcx
cmp qword [rsi + 0x30], rax
je 0x140085edb
mov rax, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x40]
add rdx, rax
lea rcx, [rbp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rbp + 0x67]
mov qword [rcx + 0x10], rax
xor edx, edx
call fcn.140086020
mov dword [rbp + 0x18], eax
mov rdx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
lea r8, [rdx + rax*8]
lea rsi, [rbp - 0x38]
mov rcx, rsi
call fcn.14008654b
mov eax, dword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsi + 8]
cmp byte [rbp + 0x67], 1
mov qword [rcx + 8], rax
push 2
pop r8
sbb r8d, 0
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x140085f52
mov esi, eax
shl rsi, 0x20
or rsi, 2
push 1
pop rdi
jmp 0x140085f8f
movaps xmm0, xmmword [rbp + 0x30]
push 1
pop rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
movups xmmword [rbp + 0x50], xmm0
mov al, byte [0x1402ea381]
push 0x20
pop rcx
push 8
pop rdx
call fcn.14000eb70
test rax, rax
je 0x140085fa9
mov rsi, rax
movups xmm0, xmmword [rbp + 0x40]
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor edi, edi
lea rcx, [rbp - 0x38]
call fcn.140018ac8
mov rax, rdi
mov rdx, rsi
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
push 8
pop rcx
push 0x20
pop rdx
call fcn.1401d7720
ud2

Function at 0x14008f9fd
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14008fa23
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14008fa0d
mov qword [rcx], rax
ret
Function at 0x1401000f8
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movabs r9, 0x100000001b3
shl r8, 3
movabs rax, 0xcbf29ce484222325
test r8, r8
je 0x140100144
movzx r10d, byte [rdx + 4]
xor rax, r10
imul rax, r9
movzx r10d, byte [rdx + 5]
xor r10, rax
mov eax, dword [rdx]
add rdx, 8
imul r10, r9
xor rax, r10
imul rax, r9
add r8, 0xfffffffffffffff8
jmp 0x140100114
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010015a
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x28
ret
lea rcx, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_src_nfa_thompsonmap.rs
call fcn.1401d8180
int3

Function at 0x1401002ba
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140100308
mov eax, dword [rdx]
movabs r8, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
movzx r10d, byte [rdx + 4]
xor r10, r8
imul r10, r9
movzx eax, byte [rdx + 5]
xor rax, r10
imul rax, r9
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x28
ret
lea rcx, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_src_nfa_thompsonmap.rs
call fcn.1401d8180
int3
Function at 0x140172216
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, r8
call fcn.140171ec2
add rbx, 8
lea rdx, [rsi + 8]
mov rcx, rbx
call fcn.140171ec2
mov edx, 8
mov rcx, rsi
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14017249d

Function at 0x14017249d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
shr rsi, 1
mov r9, rdx
and r9, 0xfffffffffffffffe
lea rax, [rcx + r9]
lea r10, [rcx + r9]
add r10, 0xfffffffffffffffe
lea r9, [rcx + rdx*2]
add r9, 0xfffffffffffffffe
lea rdi, [r8 + rdx*2]
add rdi, 0xfffffffffffffffe
xor r11d, r11d
cmp rsi, r11
je 0x140172554
mov bl, byte [rax]
cmp bl, byte [rcx]
setb bl
jne 0x1401724ec
mov bl, byte [rax + 1]
cmp bl, byte [rcx + 1]
setb bl
mov r14, rax
test bl, bl
jne 0x1401724f6
mov r14, rcx
movzx ebp, word [r14]
mov word [r8 + r11*2], bp
mov bpl, byte [r9]
cmp bpl, byte [r10]
setb bpl
jne 0x140172517
mov bpl, byte [r9 + 1]
cmp bpl, byte [r10 + 1]
setb bpl
mov r14, r10
test bpl, bpl
jne 0x140172522
mov r14, r9
movzx r15d, bl
xor bl, 1
lea rax, [rax + r15*2]
movzx ebx, bl
lea rcx, [rcx + rbx*2]
movzx ebx, word [r14]
mov word [rdi], bx
movzx ebx, bpl
add ebx, ebx
add r9, rbx
add r9, 0xfffffffffffffffe
sub r10, rbx
add rdi, 0xfffffffffffffffe
inc r11
jmp 0x1401724d5
add r10, 2
test dl, 1
je 0x140172582
xor edx, edx
xor esi, esi
cmp rcx, r10
setae dl
setb sil
mov rdi, rax
cmovb rdi, rcx
movzx edi, word [rdi]
mov word [r8 + r11*2], di
lea rcx, [rcx + rsi*2]
lea rax, [rax + rdx*2]
cmp rcx, r10
jne 0x14017259d
add r9, 2
cmp rax, r9
jne 0x14017259d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1401ca500
int3

Function at 0x14017c691
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14018ffbc
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 4
jmp 0x14019040b

Function at 0x14017c696
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14018ffd3
mov r9, rdx
mov rcx, qword [rcx]
mov edx, 0xffff
mov r8d, 0x1001
jmp 0x14019040b

Function at 0x14017c69d
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x14018ffa6
mov r9, rdx
mov rcx, qword [rcx]
mov edx, 0xffff
mov r8d, 0x1002
jmp 0x14019040b

Function at 0x140185277
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.140185134
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x1401938b4
jmp 0x1401a5720
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rbp - 4], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp - 4]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1401a575d
xor eax, eax
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbp
ret
Function at 0x14018a307
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14018a30e
test al, 1
je 0x14018a32d
test al, 2
jne 0x14018a345
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140277cf0]
mov edx, 0x23
call fcn.1401d7a80
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140277d30]
mov edx, 0x25
call fcn.1401d7a80
int3

Function at 0x14018ff87
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401902e7
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14019030a
xor eax, eax
jmp 0x14019030f
call fcn.14004d98c
nop
add rsp, 0x28
ret

Function at 0x14018ff8f
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 8
jmp 0x14019040b
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r9d
mov dword [rsp + 0x20], 4
mov r9, rax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140190431
xor eax, eax
jmp 0x140190436
call fcn.14004d98c
nop
add rsp, 0x38
ret

Function at 0x1401902c2
Capabilities:
Connect socket

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401902c2
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x1401902e0
add rsp, 0x28
jmp fcn.14004d98c
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401902e7
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401902e7
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14019030a
xor eax, eax
jmp 0x14019030f
call fcn.14004d98c
nop
add rsp, 0x28
ret

Function at 0x14019040b
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 8
jmp 0x14019040b
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r9d
mov dword [rsp + 0x20], 4
mov r9, rax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140190431
xor eax, eax
jmp 0x140190436
call fcn.14004d98c
nop
add rsp, 0x38
ret

Function at 0x1401a0290
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x1401a02d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1401a0370
jmp 0x1401a035f
jae 0x1401a042f
cmp r8, 0x201
jae 0x1401a0370
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1401a03c7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1401a039f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1401d5ac0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1401a03f0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1401a049b
mov r8d, r13d
cmp r12, r8
jne 0x1401a0350
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401a04cf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1401a035f
jmp 0x1401a0370
cmp r14, r8
jb 0x1401a04e9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1401a5960
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1401a0484
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000eb80
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1401a046f
jmp 0x1401a0484
lea rcx, [0x14027b488]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1401d7a80
jmp 0x1401a04fe
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1401d7f10
ud2
Function at 0x1401a0e00
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x1401a0e15
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1401a0e30
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1401acca0

Function at 0x1401a5720
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.140185134
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x1401938b4
jmp 0x1401a5720
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rbp - 4], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp - 4]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1401a575d
xor eax, eax
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbp
ret

Function at 0x1401a5780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, qword [rcx]
mov rcx, qword [rax]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
jg 0x1401a57e9
cmovae eax, eax

Function at 0x1401a5850
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp + 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 4]
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1401a58a3
call qword [sym.imp.ws2_32.dll_WSAGetLastError]

Function at 0x1401a9370
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.1401ce9d0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x1401af410]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
Function at 0x1401acca0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1401b6450
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1401acd00
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1401b7b40
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x1401acd0c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1401acd38
test rdi, rdi
je 0x1401acd64
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.14000eb80
xor eax, eax
jmp 0x1401acd03
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x1401acd03
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.14000eb80
jmp 0x1401acd00
xor eax, eax
jmp 0x1401acd03
Function at 0x1401ad410
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.1401b6450
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1401ad486
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.1401b7b40
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rax, rbx
jne 0x1401ad499
mov eax, 1
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.1401b6450
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
cmp rax, rbx
je 0x1401ad4ea
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.1401b7b40
mov rsi, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rsi, rbx
jne 0x1401ad51d
mov rcx, qword [rbp - 8]
mov r14, qword [rbp]
mov eax, 1
test r14, r14
je 0x1401ad48b
add r14, r14
mov r8d, 2
mov rsi, rdx
mov rdx, r14
call fcn.14000eb80
mov eax, 1
mov rdx, rsi
jmp 0x1401ad48b
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x1401ad630]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rbx, rcx
mov rdi, rdx
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
mov r14, qword [rbp]
je 0x1401ad5a2
mov rdx, qword [rbp - 0x20]
test rsi, rsi
je 0x1401ad57c
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.14000eb80
mov rdx, rdi
test r14, r14
je 0x1401ad59b
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rsi, rdx
mov rdx, r14
call fcn.14000eb80
mov rdx, rsi
xor eax, eax
jmp 0x1401ad48b
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
test rsi, rsi
je 0x1401ad5d1
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.14000eb80
mov rdx, rdi
mov rcx, rbx
mov eax, 1
test r14, r14
jne 0x1401ad4fc
jmp 0x1401ad48b