joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400343f3
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.1400b70e0
mov r8, rdx
mov cl, 1
mov rdx, rax
add rsp, 0x28
jmp fcn.1400c340d

Function at 0x140034462
Capabilities:
Move file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
call fcn.1400b70e0
mov rsi, rax
mov rdi, rdx
mov rcx, qword [rbp - 0x10]
call fcn.1400b70e0
mov r14, rax
mov rbx, rdx
lea rcx, [rbp - 0x30]
mov rdx, rsi
mov r8, rdi
call fcn.1400b4600
mov rsi, qword [rbp - 0x20]
mov r15, qword [rbp - 0x28]
cmp qword [rbp - 0x30], 1
jne 0x1400344d6
mov rbx, r15
shrd rbx, rsi, 8
shr rsi, 8
mov r13, rsi
mov r12d, r15d
jmp 0x140034588
lea rcx, [rbp - 0x30]
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rax
mov rdx, r14
mov r8, rbx
call fcn.1400b4600
mov rdi, qword [rbp - 0x20]
mov r14, qword [rbp - 0x28]
cmp qword [rbp - 0x30], 1
jne 0x14003453c
mov rbx, r14
shrd rbx, rdi, 8
shr rdi, 8
mov r13, rdi
mov r12d, r14d
mov rdi, qword [rbp - 8]
test rsi, rsi
je 0x14003458c
test r15, r15
je 0x14003458c
add rsi, rsi
je 0x14003458c
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, r15
call fcn.140116425
jmp 0x14003458c
push 1
pop r8
mov rcx, r15
mov rdx, r14
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
je 0x1400345c4
test rdi, rdi
je 0x14003456a
add rdi, rdi
je 0x14003456a
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, r14
call fcn.140116425
test rsi, rsi
je 0x140034585
add rsi, rsi
je 0x140034585
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, r15
call fcn.140116425
mov r12b, 4
mov rdi, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
call fcn.1400227d0
shld r13, rbx, 8
shl rbx, 8
movzx esi, r12b
or rsi, rbx
mov rcx, rdi
call fcn.1400227d0
mov rax, rsi
mov rdx, r13
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x18
xor r13d, r13d
mov r12d, 0
test rdi, rdi
je 0x140034516
add rdi, rdi
je 0x140034516
mov rcx, qword [0x1401ece28]
xor r12d, r12d
xor edx, edx
mov r8, r14
call fcn.140116425
jmp 0x140034516
Function at 0x140046000
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400461bb
mov r12, r9
mov r14, r8
mov r15, rdx
mov r9d, r14d
mov r13, r8
shr r13, 8
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov ebp, 0xff
mov rbx, r8
and rbx, rbp
xor rbx, rax
imul rbx, rdx
mov rax, r13
and rax, rbp
xor rax, rbx
imul rax, rdx
xor edx, edx
div rcx
mov rax, qword [rdi]
mov rcx, qword [rdi + 0x20]
mov rbp, qword [rax + rdx*8]
cmp rcx, rbp
jbe 0x1400460af
mov rsi, qword [rdi + 0x10]
imul rbp, rbp, 0x18
lea r8, [rsi + rbp]
cmp qword [r8], r15
jne 0x1400460af
cmp byte [rsi + rbp + 8], r9b
jne 0x1400460af
cmp byte [r8 + 9], r13b
jne 0x1400460af
mov rdx, qword [rsi + rbp + 0x10]
mov eax, 1
jmp 0x1400461aa
shr r14, 0x10
mov qword [rax + rdx*8], rcx
mov rax, qword [rdi + 0x20]
cmp rax, qword [rdi + 0x18]
jne 0x14004617a
mov ebx, r9d
mov rdx, rax
mov esi, 1
inc rdx
jne 0x1400460dd
xor r8d, r8d
jmp 0x14004616b
add rax, rax
cmp rax, rdx
cmovbe rax, rdx
cmp rax, 4
mov ecx, 4
cmova rcx, rax
call fcn.1400467c9
mov r8, rdx
mov rcx, qword [rdi + 0x18]
mov rbp, r12
test rcx, rcx
je 0x140046125
imul rcx, rcx, 0x18
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 8
jmp 0x14004612b
and qword [rsp + 0x28], 0
lea r12, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rcx, r12
mov rdx, rax
call fcn.1400611d8
mov rdx, qword [r12 + 8]
mov r8, qword [r12 + 0x10]
cmp qword [r12], 1
je 0x140046168
mov qword [rdi + 0x10], rdx
xor esi, esi
mov ecx, 0x18
mov rax, r8
xor edx, edx
div rcx
mov qword [rdi + 0x18], rax
mov r12, rbp
mov rcx, rsi
call fcn.1400152da
mov rax, qword [rdi + 0x20]
mov r9d, ebx
mov rcx, qword [rdi + 0x10]
imul rax, rax, 0x18
mov qword [rcx + rax], r15
mov byte [rcx + rax + 8], r9b
mov byte [rcx + rax + 9], r13b
mov dword [rcx + rax + 0xa], r14d
shr r14, 0x20
mov word [rcx + rax + 0xe], r14w
mov qword [rcx + rax + 0x10], r12
inc qword [rdi + 0x20]
xor eax, eax
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero
lea r8, str.C:Users_runneradmin.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_1.4.5_srccompile.rs
mov edx, 0x39
call fcn.140117700
ud2
Function at 0x140068fc2
Capabilities:
Delete directory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
call fcn.1400b70e0
mov r8, rdx
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rax
call fcn.1400b4600
mov rsi, qword [rdi + 0x10]
mov r15, qword [rdi + 8]
cmp qword [rdi], 1
jne 0x140069007
mov rbx, r15
shrd rbx, rsi, 8
shr rsi, 8
mov rdi, rsi
mov r14d, r15d
jmp 0x140069064
mov rcx, r15
call sub.KERNEL32.dll_RemoveDirectoryW
test eax, eax
je 0x140069033
mov r14b, 4
test rsi, rsi
je 0x140069031
add rsi, rsi
je 0x140069031
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, r15
call fcn.140116425
jmp 0x140069064
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x18
xor edi, edi
mov r14d, 0
test rsi, rsi
je 0x140069064
add rsi, rsi
je 0x140069064
mov rcx, qword [0x1401ece28]
xor r14d, r14d
xor edx, edx
mov r8, r15
call fcn.140116425
shld rdi, rbx, 8
shl rbx, 8
movzx eax, r14b
or rax, rbx
mov rdx, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140072d4e
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
mov r15d, 0xffffffff
mov rdi, rbx
cmp rbx, rsi
jae 0x140072d8e
lea rcx, [r14 + rdi]
mov rbx, rsi
sub rbx, rdi
cmp rbx, r15
cmovae rbx, r15
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
add rbx, rdi
test al, al
jne 0x140072d67
cmp rdi, rsi
setb al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400b4250
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x1401ec080]
test rcx, rcx
jne 0x1400b4271
call fcn.1400b4330
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1400b42c3
mov ecx, 0x18
mov edx, 8
call fcn.140001330
test rax, rax
je 0x1400b4314
mov rbx, rax
mov rax, qword [0x14018a460]
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
mov rcx, qword [0x1401ec080]
test rcx, rcx
jne 0x1400b42bb
call fcn.1400b4330
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [0x1401ec080]
test rcx, rcx
jne 0x1400b42d7
call fcn.1400b4330
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov rdx, qword [rax + 0x10]
cmp rdx, qword [rax + 8]
je 0x1400b4306
mov rax, qword [rbx]
shl rdx, 4
mov qword [rax + rdx], rdi
mov qword [rax + rdx + 8], rsi
add qword [rbx + 0x10], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.14011a760
mov rdx, qword [rbx + 0x10]
jmp 0x1400b42e9
mov ecx, 0x18
mov edx, 8
call fcn.140117470
ud2

Function at 0x1400b4330
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rsi, [0x1401ecf10]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov qword [rbp - 0x10], rsi
mov rdi, qword [0x1401ec080]
test rdi, rdi
jne 0x1400b43cf
mov rdi, qword [0x1401ec088]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400b43e3
mov esi, eax
test rdi, rdi
je 0x1400b43bf
mov ecx, 0x18
mov edx, 8
call fcn.140001330
test rax, rax
je 0x1400b4436
mov rcx, rax
mov qword [rax], rdi
mov qword [rax + 8], 0
mov dword [rax + 0x10], esi
mov rax, qword [0x1401ece68]
nop dword [rax + rax]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x1401ece68], rcx
jne 0x1400b43b0
mov edi, esi
mov rax, rdi
xchg qword [0x1401ec080], rax
test esi, esi
je 0x1400b43fd
mov rcx, qword [rbp - 0x10]
call fcn.140116461
mov rax, rdi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXES
lea r8, [0x14014f0c0]
mov edx, 0x2e
call fcn.140117700
jmp 0x1400b4434
lea rax, str.assertion_failed:_key___0library_std_src_syswindows_thread_local_key.rslibrary_std_srcpanicking.rs
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 0
lea rax, str.FileNotFoundIo
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
lea rcx, [rbp - 0x40]
call fcn.1400ace90
ud2
mov ecx, 0x18
mov edx, 8
call fcn.140117470
ud2
Function at 0x1400b74e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov dword [rsp + 0x34], 0
mov edx, 0xffffffff
cmp r9, rdx
mov r8d, 0xffffffff
cmovb r8d, r9d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, rax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x1400b7534
mov eax, dword [rsp + 0x34]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400b7565
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov ecx, eax
call fcn.1400ae7a0
cmp al, 8
jne 0x1400b754e
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400b7565
shl rdi, 0x20
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400b8850
Capabilities:
Create directory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400b4600
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
cmp qword [rsp + 0x20], 1
jne 0x1400b8891
mov rbx, r15
shrd rbx, rdi, 8
shr rdi, 8
mov rsi, rdi
mov r14d, r15d
jmp 0x1400b88f0
mov rcx, r15
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x1400b88bf
mov r14b, 4
test rdi, rdi
je 0x1400b88bd
add rdi, rdi
je 0x1400b88bd
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, r15
call fcn.140116425
jmp 0x1400b88f0
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x18
xor esi, esi
mov r14d, 0
test rdi, rdi
je 0x1400b88f0
add rdi, rdi
je 0x1400b88f0
mov rcx, qword [0x1401ece28]
xor r14d, r14d
xor edx, edx
mov r8, r15
call fcn.140116425
shld rsi, rbx, 8
shl rbx, 8
movzx eax, r14b
or rax, rbx
mov rdx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400b9420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r14b, 4
test rdx, rdx
je 0x1400b9549
mov rsi, rdx
mov rdi, rcx
lea r12, [rbp - 0x20]
lea r13, [0x1400b96b4]
lea r15, str.failed_to_write_whole_bufferadvancing_IoSlice_beyond_its_length_rustc_53cb7b09b00cbea8754ffb78e7e3cb521cb8af4blibrary_std_src_syswindowsio.rs_rustc_53cb7b09b00cbea8754ffb78e7e3cb521cb8af4blibrary_std_srciomod.rs
jmp 0x1400b948a
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, rbx
call fcn.140116425
test rsi, rsi
je 0x1400b9549
mov rcx, r12
mov edx, 0xfffffff5
mov r8, rdi
mov r9, rsi
call fcn.1400ae280
cmp dword [rbp - 0x20], 1
jne case.default.0x1400b94b2
movzx ebx, byte [rbp - 0x18]
movzx eax, bl
movsxd rax, dword [r13 + rax*4]
add rax, r13
jmp rax
movzx eax, byte [rbp - 0x17]
cmp al, 0xf
je 0x1400b950b
jmp 0x1400b957c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400b9569
mov rax, rsi
sub rax, rcx
jb 0x1400b960d
add rdi, rcx
mov rsi, rax
jmp 0x1400b9481
mov ecx, dword [rbp - 0x14]
call fcn.1400ae7a0
cmp al, 0xf
je 0x1400b950b
jmp 0x1400b957c
cmp bl, 3
jne 0x1400b9481
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rax + 8]
call qword [rax]
mov rbx, qword [rbp - 8]
mov rax, qword [rbx + 8]
cmp qword [rax + 8], 0
je 0x1400b9470
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
call fcn.1400013c0
jmp 0x1400b9470
xor r15d, r15d
xor esi, esi
movzx eax, r14b
or rax, r15
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rsi, r15
shr rsi, 8
shl r15, 0x38
or r15, 0xe
mov bl, 2
jmp 0x1400b9597
movzx eax, byte [rbp - 9]
shl eax, 0x10
movzx ecx, word [rbp - 0xb]
or ecx, eax
shl rcx, 0x20
mov esi, dword [rbp - 0xf]
or rsi, rcx
mov r15, qword [rbp - 0x17]
shld rsi, r15, 8
shl r15, 8
movzx eax, bl
movabs rcx, 0xffffffff00000000
and rcx, r15
or rcx, rax
movabs rax, 0x600000000
xor rax, rcx
jne 0x1400b9605
cmp bl, 3
jne 0x1400b954e
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rbp - 8], rsi
call qword [rax]
mov rsi, qword [rbp - 8]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x1400b95ef
mov rcx, qword [rsi]
mov rdx, qword [rax + 0x10]
call fcn.1400013c0
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, rsi
call fcn.140116425
jmp 0x1400b954e
mov r14d, ebx
jmp 0x1400b954e
lea r8, [0x14014e880]
mov rdx, rsi
call fcn.140117cb0
ud2
Function at 0x1400bd620
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp edx, 1
mov eax, 0x17
mov edi, 2
cmove edi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400bd675
mov qword [rsi + 8], rbx
mov qword [rsi], 0
jmp 0x1400bd70e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x1400bd688
cmp eax, 0x2726
jne 0x1400bd6f7
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400bd6f2
mov rbx, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x1400bd665
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.140116617
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400bd7e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r10d, r10d
cmp qword [rdx], 1
jne 0x1400bd85c
mov r8, rdx
mov eax, 0x3e8
mul qword [rdx + 8]
mov r10d, 0xffffffff
jo 0x1400bd85c
mov r8d, dword [r8 + 0x10]
mov r9d, r8d
imul rdx, r9, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x1400bd85c
imul rdx, r9, 0x431bde83
shr rdx, 0x32
imul edx, edx, 0xf4240
mov r9, rax
inc r9
sete r11b
cmp r8d, edx
setne dl
cmove r9, rax
mov eax, 0xffffffff
cmp r9, rax
mov r10d, 0xffffffff
cmovae r9d, r10d
test dl, r11b
jne 0x1400bd85c
mov r10d, r9d
test r9d, r9d
je 0x1400bd8aa
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400bd887
mov al, 4
jmp 0x1400bd896
call sub.WS2_32.dll_WSAGetLastError
mov ecx, eax
shl rcx, 0x18
xor edx, edx
xor eax, eax
shld rdx, rcx, 8
shl rcx, 8
movzx eax, al
or rax, rcx
add rsp, 0x38
ret
lea rdx, str.cannot_set_a_0_duration_timeoutconnection_timed_out
mov eax, 0xb02
jmp 0x1400bd8a5
Function at 0x1400bd8c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r10d, r10d
cmp qword [rdx], 1
jne 0x1400bd93c
mov r8, rdx
mov eax, 0x3e8
mul qword [rdx + 8]
mov r10d, 0xffffffff
jo 0x1400bd93c
mov r8d, dword [r8 + 0x10]
mov r9d, r8d
imul rdx, r9, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x1400bd93c
imul rdx, r9, 0x431bde83
shr rdx, 0x32
imul edx, edx, 0xf4240
mov r9, rax
inc r9
sete r11b
cmp r8d, edx
setne dl
cmove r9, rax
mov eax, 0xffffffff
cmp r9, rax
mov r10d, 0xffffffff
cmovae r9d, r10d
test dl, r11b
jne 0x1400bd93c
mov r10d, r9d
test r9d, r9d
je 0x1400bd98a
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400bd967
mov al, 4
jmp 0x1400bd976
call sub.WS2_32.dll_WSAGetLastError
mov ecx, eax
shl rcx, 0x18
xor edx, edx
xor eax, eax
shld rdx, rcx, 8
shl rcx, 8
movzx eax, al
or rax, rcx
add rsp, 0x38
ret
lea rdx, str.cannot_set_a_0_duration_timeoutconnection_timed_out
mov eax, 0xb02
jmp 0x1400bd985

Function at 0x1400bd9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x1400bd9de
cdqe
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400bda0e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x1400bd9f2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400bda0e
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
add rsp, 0x20
pop rsi
ret

Function at 0x1400bda20
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, r9d
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x1400bda59
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400bda73
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x1400bda80
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov ecx, 0xffffffff
cmp r9, rcx
mov r8d, 0xffffffff
cmovb r8d, r9d
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, rax
call sub.WS2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x1400bdad6
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400bdaf0
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov eax, 1
mov qword [rsi], rax
add rsp, 0x40
pop rsi
ret
Function at 0x1400bdb00
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x1400bdb2d
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
shl rcx, 0x18
xor eax, eax
jmp 0x1400bdb2f
mov al, 4
mov rdx, rax
shld rdx, rcx, 8
shl rcx, 8
movzx eax, al
or rax, rcx
add rsp, 0x28
ret

Function at 0x1400c2cd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, reloc.WS2_32.dll_recv
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400c2d33
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x1401ed058]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0xe0], 1
movups xmmword [rax + 0xe8], xmm0
add rsp, 0x90
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [rbp - 8], rax
mov qword [rbp], 0
lea rax, [rbp - 8]
mov qword [rbp - 0x30], rax
lea rax, [0x1400b4780]
mov qword [rbp - 0x28], rax
lea rax, [0x140150868]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, [0x140150878]
lea rcx, [rbp - 0x60]
call fcn.14011a820
ud2

Function at 0x1400c2e50
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.140001330
test rax, rax
je 0x1400c2f3a
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 8], r15
add rdi, 0xfffe
and rdi, 0xffffffffffff0001
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400c2f90]
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x1400c2ed7
mov qword [r14 + 8], rax
xor eax, eax
jmp 0x1400c2f2a
mov rcx, qword [rbx]
mov qword [rbp - 8], rbx
mov rax, qword [rbx + 8]
call qword [rax]
mov rsi, qword [rbp - 8]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x1400c2eff
mov rcx, qword [rsi]
mov rdx, qword [rax + 0x10]
call fcn.1400013c0
mov rcx, qword [0x1401ece28]
xor edx, edx
mov r8, rsi
call fcn.140116425
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0
mov eax, 1
mov qword [r14], rax
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.140117470
ud2

Function at 0x1400c340d
Capabilities:
Create directory

Disassembly:
test cl, cl
je 0x1400c341c
mov rcx, rdx
mov rdx, r8
jmp fcn.1400b82b0
mov rcx, rdx
mov rdx, r8
jmp fcn.1400b8850
Function at 0x1400c3427
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov ebp, 0xffffffff
lea r12, [rsp + 0x2c]
lea r14, str.failed_to_write_whole_bufferadvancing_IoSlice_beyond_its_length_rustc_53cb7b09b00cbea8754ffb78e7e3cb521cb8af4blibrary_std_src_syswindowsio.rs_rustc_53cb7b09b00cbea8754ffb78e7e3cb521cb8af4blibrary_std_srciomod.rs
mov r15, r14
shr r15, 8
test rdi, rdi
je 0x1400c34e5
mov rcx, qword [rsi]
and dword [rsp + 0x2c], 0
cmp rdi, rbp
mov r8d, 0xffffffff
cmovb r8d, edi
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r9, r12
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x1400c34a8
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
je 0x1400c34e9
mov rax, rdi
sub rax, rcx
jb 0x1400c3524
add rbx, rcx
mov rdi, rax
jmp 0x1400c3458
call sub.KERNEL32.dll_GetLastError
mov r13d, eax
mov rcx, r13
shl rcx, 0x20
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 1
mov ecx, eax
call fcn.1400ae7a0
cmp al, 0xf
jne 0x1400c34f5
lea rcx, [rsp + 0x38]
call fcn.140001054
jmp 0x1400c3458
mov al, 4
jmp 0x1400c3501
shl r14, 0x38
or r14, 0xe
mov al, 2
jmp 0x1400c3501
shl r13, 0x18
xor r15d, r15d
mov r14, r13
xor eax, eax
shld r15, r14, 8
shl r14, 8
movzx eax, al
or rax, r14
mov rdx, r15
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x1401886f0]
mov rdx, rdi
call fcn.140117cb0
ud2
Function at 0x1400cb635
Capabilities:
Connect socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rdx + 8]
cmp qword [rdx], 1
jne 0x1400cb655
mov rax, qword [rdx + 0x10]
mov qword [rsi + 8], rdi
jmp 0x1400cb688
mov rax, qword [0x1401ecfe8]
cmp rax, 3
jne 0x1400cb6f0
mov edx, dword [rdi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400bd620
mov r14, qword [rbx + 8]
cmp qword [rbx], 1
jne 0x1400cb69d
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rax
mov qword [rsi], 1
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rdi], 1
mov eax, 0x1c
mov r8d, reloc.WS2_32.dll_recv
cmove r8d, eax
add rdi, 4
mov rcx, r14
mov rdx, rdi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x1400cb6cd
mov qword [rsi + 8], r14
and qword [rsi], 0
jmp 0x1400cb693
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
and qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, r14
call fcn.140116617
jmp 0x1400cb693
lea rax, [rsp + 0x2f]
mov byte [rax], 1
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rcx, [0x1401ecfe8]
lea r9, [0x140150440]
xor edx, edx
call fcn.14011a860
jmp 0x1400cb666