joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140155da0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov rdi, qword [rdx]
mov rbx, qword [rdx + 8]
movzx ebp, word [rdx + 0x10]
mov rax, qword [0x1403ce1a0]
cmp rax, 3
jne 0x140155ec8
cmp rbx, 0x17f
ja 0x140155eda
lea rcx, [rsp + 0x68]
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x140155e19
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x140155e2c
inc rdx
cmp rcx, rdx
jne 0x140155e00
mov rdx, r8
test rax, rax
jne 0x140155e36
jmp 0x140155e92
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.14003bb90
test rax, rax
jne 0x140155e36
jmp 0x140155e92
mov eax, 1
test rax, rax
je 0x140155e92
cmp rdx, rbx
jne 0x140155e92
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140155ea6
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140155eb9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140155ebc
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1402abbd0
cmp rbx, 0x17f
jbe 0x140155dd7
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9d, ebp
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
jmp 0x1402abc30
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140030030
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x1402abc90
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x1402abd1f
mov rcx, qword [0x1403ce198]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1402abcef
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1402abd02
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x1402abd1f
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14015dd40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r14, rcx
lea rcx, [rbp - 0x30]
call fcn.14014ec10
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x14015dd93
mov rbx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015de0c
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rsi
jmp 0x14015de01
mov rdx, qword [rbp - 0x30]
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x14015ddf9
lea rax, [rdx - 1]
mov qword [rbp - 0x18], rax
mov rcx, qword [rdx - 1]
mov qword [rbp - 0x10], rdx
mov rax, qword [rdx + 7]
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 7]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x14015dde7
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x14015ddd8
mov r8, qword [r8 - 8]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [r14 + 8], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [r14 + 8], 0
test rbx, rbx
je 0x14015de01
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
Function at 0x140160150
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov ecx, 0x10
mov edx, 8
call fcn.1400235d0
mov rsi, rax
test rax, rax
je 0x140160237
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140160640]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rsi
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140160229
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rbp - 0x10], rsi
call qword [rax]
mov rsi, qword [rbp - 0x10]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x140160203
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x1401601f4
mov r8, qword [r8 - 8]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rsi
mov ecx, 0x10
mov edx, 8
call fcn.1402a5fb0
ud2
Function at 0x140160a50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1402a4b70
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xfb0], rcx
mov qword [rbp + 0xfb8], rdx
lea rdi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea r13, [0x140156bc0]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xfc0]
mov qword [rbp + 0xfe0], rbx
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x140160c55
mov r14, qword [sym.imp.kernel32.dll_SleepEx]
mov r15d, 0xffffffff
lea rbx, [rbp + 0xfc0]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x140160b20
cmp dword [rbp + 0xfec], 0
jne 0x140160c5a
mov eax, dword [rbp + 0xff0]
test rax, rax
je 0x140160c5a
cmp eax, 0x1000
ja 0x140160ca5
xor edi, edi
nop
cmp rdi, rax
ja 0x140160c8a
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffb0
mov r12, rax
mov r8, rax
sub r8, rdi
cmp r8, r15
cmovae r8, r15
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov r9, rbx
call qword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x140160c55
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x140160bd0
cmp dword [rbp + 0xfec], 0
jne 0x140160c5a
mov eax, dword [rbp + 0xff0]
add rdi, rax
mov rax, r12
cmp rdi, r12
jne 0x140160b60
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov rcx, qword [rbp + 0xfe0]
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rbx
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x140160b20
call sub.kernel32.dll_GetLastError
mov rdi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfe0]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rdi
mov qword [rbp + 0xfe0], rax
mov rdx, rax
call fcn.1402a67e0
jmp 0x140160cc0
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov qword [rbp + 0xfe0], rax
mov rcx, rax
call fcn.1402a6550
ud2
Function at 0x140160d60
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x140160da2
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.14014c0d0]
mov qword [rbp - 0x28], rax
lea rax, [0x140376e30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x60], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str._n7_
lea rcx, [rbp - 0x60]
call fcn.1402a6480
ud2

Function at 0x140166ca0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x140166cc1
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov qword [rcx], 0
cmp r8, 1
je 0x140166cf7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140166cf2
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140166cf7
call fcn.140160d60
mov r8d, dword [0x1403ce748]
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + r8*8]
mov qword [rcx + 0x40], 1
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rdx
add rsp, 0x38
ret

Function at 0x140167200
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.14014ec10
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1401672a6
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
mov r8, qword [rbp + 0x50]
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.14014ec10
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1401672b3
mov qword [rbp - 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140167350]
lea r9, [rbp - 0x30]
mov r14, qword [rbp - 0x18]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x1401672c4
mov rax, qword [rbp - 0x30]
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rbx, rbx
jne 0x1401672e1
jmp 0x1401672f3
mov qword [rsi + 8], rcx
mov qword [rsi], 1
jmp 0x14016730c
mov qword [rsi + 8], rbx
mov qword [rsi], 1
mov r14, qword [rbp - 0x18]
jmp 0x1401672f3
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
je 0x1401672f3
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp - 0x10], 0
je 0x14016730c
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140167870
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x14016789b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x1403ce1a0]
cmp rax, 3
jne 0x140167a1b
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140167913
cmp word [rbx], 0
je 0x140167989
mov ecx, dword [rbx + 0x14]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov edx, dword [rbx + 0x18]
movups xmm0, xmmword [rbx + 4]
mov r8d, 0x1c
mov bp, 0x17
jmp 0x1401679a1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x14016792d
mov edi, eax
cmp eax, 0x2726
jne 0x140167a0a
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x140167a02
mov r14, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x1401678e8
call sub.kernel32.dll_GetLastError
mov edi, eax
mov rcx, r14
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x140167a0a
movzx eax, word [rbx + 6]
rol ax, 8
mov ecx, dword [rbx + 2]
xorps xmm0, xmm0
mov r8d, 0x10
mov bp, 2
mov word [rsp + 0x30], bp
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ecx
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1401679db
mov qword [rsi + 8], r14
mov qword [rsi], 0
jmp 0x140167890
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, r14
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x140167890
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rsi + 8], rdi
jmp 0x140167889
call fcn.1402abbd0
jmp 0x1401678ac
Function at 0x14016a53a
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, rcx
mov eax, dword [0x1403ce748]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x140]
test rax, rax
je 0x14016a57b
cmp eax, 1
je 0x14016a5a8
xor esi, esi
jmp 0x14016a744
mov eax, dword [0x1403ce748]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 0xd8]
lea rdx, [0x14016a75b]
mov rcx, rsi
call fcn.140146190
mov byte [rsi + 0x68], 1
test rbx, rbx
je 0x14016a672
lea rax, [rsp + 0x60]
mov ecx, 0xd
mov rdi, rax
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 0
cmp dword [rax], 1
jne 0x14016a668
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0x88]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov r9, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov ebx, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xbc]
mov r11b, byte [rsp + 0xc0]
mov al, byte [rsp + 0xc1]
mov byte [rsp + 0x27], al
mov r10b, byte [rsp + 0xc2]
mov eax, dword [rsp + 0xc3]
mov dword [rsp + 0x28], eax
mov al, byte [rsp + 0xc7]
mov byte [rsp + 0x2c], al
jmp 0x14016a6a4
lea rcx, [rsp + 0x60]
call fcn.14016e3ca
call fcn.14016ab57
mov rbx, rax
shr rbx, 0x20
test eax, eax
mov edx, 1
cmovne edx, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov r9d, 2
mov r10b, 2
xor r11d, r11d
xor r13d, r13d
xor ebp, ebp
xor r15d, r15d
mov eax, dword [0x1403ce748]
mov rcx, qword gs:[0x58]
mov r12, qword [rcx + rax*8]
lea rax, [r12 + 0xd8]
lea r8, [rsp + 0x60]
mov ecx, 0xd
mov rsi, rax
mov rdi, r8
rep movsq qword [rdi], qword [rsi]
mov qword [rax], 1
mov qword [rax + 8], r15
lea rsi, [r12 + 0xe0]
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbp
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], r13
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x40], r9
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x50], ebx
mov dword [rsi + 0x54], edx
mov byte [rsi + 0x58], r11b
mov al, byte [rsp + 0x27]
mov byte [rsi + 0x59], al
mov byte [rsi + 0x5a], r10b
mov eax, dword [rsp + 0x28]
mov dword [rsi + 0x5b], eax
mov al, byte [rsp + 0x2c]
mov byte [rsi + 0x5f], al
mov rcx, r8
call fcn.14016e3ca
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016a9af
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, dword [rdx + 2]
movzx eax, word [rdx + 6]
shl rax, 0x20
or rax, r8
cmp word [rdx], 0
je 0x14016aa20
movzx r8d, word [rdx + 0x1c]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
shr rax, 0x10
rol r8w, 8
mov dword [rcx + 8], eax
mov rax, qword [rdx + 8]
mov qword [rcx + 0xc], rax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x14], eax
xorps xmm0, xmm0
movups xmmword [rcx + 0x1c], xmm0
movups xmmword [rcx + 0x2c], xmm0
movups xmmword [rcx + 0x3c], xmm0
movups xmmword [rcx + 0x4c], xmm0
movups xmmword [rcx + 0x5c], xmm0
movups xmmword [rcx + 0x6c], xmm0
mov dword [rcx + 0x7c], 0
mov word [rcx], 0x17
mov dword [rcx + 0x18], r10d
mov edx, 0x1c
mov eax, r9d
jmp 0x14016aa5d
mov r8, rax
shr r8, 0x20
rol r8w, 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x70], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
mov word [rcx], 2
mov qword [rcx + 8], 0
mov edx, 0x10
mov word [rcx + 2], r8w
mov dword [rcx + 4], eax
mov dword [rcx + 0x80], edx
ret

Function at 0x140170200
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x140170249
movzx eax, dl
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140170236
xor eax, eax
jmp 0x140170244
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.26.0_srciopoll_evented.rs
mov edx, 0x2b
call fcn.1402a6560
ud2
Function at 0x140170538
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0xe0]
lea rsi, [rsp + 0x42]
mov rbp, qword [rdx + 0x20]
mov rcx, qword [rdx]
mov qword [rsp + 0x48], rcx
mov rdi, qword [rdx + 8]
mov ecx, 0x7fffffff
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x58], rcx
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x50], rdi
mov rcx, rbx
mov rdx, rbp
mov r8, qword [rsp + 0x68]
mov r9b, 1
call fcn.14016fdc1
mov r12b, byte [rsp + 0x41]
cmp r12b, 3
je 0x1401706fa
mov r13, qword [rsp + 0x38]
cmp r12b, 2
je 0x140170708
mov r15b, byte [rsp + 0x40]
movzx eax, word [rsi + 4]
mov word [rsp + 0x2c], ax
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
cmp rdi, 0xffffffffffffffff
je 0x14017074f
mov rcx, rdi
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x14017071a
mov rdi, rbp
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r14, rax
shl r14, 0x20
or r14, 2
mov ecx, eax
call fcn.140147190
cmp al, 0xd
jne 0x140170672
cmp qword [rsp + 0x48], 0
je 0x140170672
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
lock inc qword [rdx]
jle 0x140170769
add rcx, 0x10
mov r8, qword [rax]
mov r9b, byte [rax + 0x18]
call fcn.1400783c3
test rax, rax
je 0x140170672
mov rbp, rax
mov rcx, r14
call fcn.140076b79
mov eax, ebp
and eax, 3
lea rcx, [0x140170770]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
mov r14, rbp
jmp rax
mov eax, r14d
and eax, 3
lea rcx, [0x140170770]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov al, byte [r14 + 0x10]
jmp 0x1401706a0
mov al, byte [r14 + 0xf]
jmp 0x1401706a0
mov rcx, r14
shr rcx, 0x20
call fcn.140147190
cmp al, 0xd
je 0x1401706b5
jmp 0x14017072e
mov rax, r14
shr rax, 0x20
cmp eax, 0xd
jne 0x14017072e
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x41], r12b
movzx eax, word [rsp + 0x2c]
mov word [rsi + 4], ax
mov eax, dword [rsp + 0x28]
mov dword [rsi], eax
mov rbp, rdi
mov rcx, rdi
mov rdx, rbx
call fcn.14016bef6
lea rcx, [rsp + 0x70]
call fcn.14016dd64
mov rdi, qword [rsp + 0x50]
jmp 0x14017058f
mov rax, qword [rsp + 0x30]
mov qword [rax], 2
jmp 0x14017073e
mov rax, qword [rsp + 0x30]
mov qword [rax], 1
mov qword [rax + 8], r13
jmp 0x14017073e
cdqe
mov rcx, qword [rsp + 0x30]
mov qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14017073e
mov rax, qword [rsp + 0x30]
mov qword [rax], 1
mov qword [rax + 8], r14
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.26.0_srciopoll_evented.rs
mov edx, 0x2b
call fcn.1402a6560
ud2
ud2

Function at 0x1401711dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp qword [rcx], 0
je 0x1401711f2
add rcx, 8
xor r8d, r8d
xor r9d, r9d
jmp fcn.140170fe3
add rcx, 8
xor r8d, r8d
jmp fcn.140170841
Function at 0x140171a5d
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140171a64
test al, 1
je 0x140171a83
test al, 2
jne 0x140171a98
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14037ad50]
mov edx, 0x23
jmp 0x140171aab
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14037ad90]
mov edx, 0x25
call fcn.1402a6560
ud2