joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5240a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5240b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5240b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5240c0
xor eax, eax
ret
cmp rbx, 3
je 0x5240cc
cmp rbx, 4
jne 0x5240f9
cmp al, 0x2c
ja 0x5240e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5240f6
cmp al, 0x24
je 0x5240f6
nop dword [rax]
cmp al, 0x26
jae 0x5240f6
jmp 0x5240f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5240f6
cmp al, 0x5b
je 0x5240f6
cmp al, 0x5d
jne 0x5240f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x524132
nop dword [rax]
cmp al, 0x26
ja 0x524111
cmp al, 0x24
je 0x524151
cmp al, 0x26
je 0x524151
jmp 0x5241cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x524151
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5241c8
cmp al, 0x2f
je 0x524151
jmp 0x5241cb
cmp al, 0x3d
ja 0x524149
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x524151
nop
cmp al, 0x3d
je 0x524151
jmp 0x5241cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5241c0
cmp rbx, 2
jg 0x524187
cmp rbx, 1
je 0x524181
nop dword [rax]
cmp rbx, 2
jne 0x5241cb
cmp al, 0x2f
je 0x524172
cmp al, 0x3b
je 0x524172
cmp al, 0x2c
jne 0x524179
mov ecx, 1
jmp 0x52417e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5241aa
cmp al, 0x40
je 0x524199
cmp al, 0x2f
je 0x524199
cmp al, 0x3f
jne 0x5241a2
mov ecx, 1
nop
jmp 0x5241a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5241b9
cmp rbx, 7
jne 0x5241cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5241c8
cmp al, 0x7e
jne 0x5241cb
xor eax, eax
ret
cmp rbx, 7
jne 0x5241e1
cmp al, 0x21
je 0x5241dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5241e1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14000c336
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x8000000000000000
cmp qword [rdx], rdi
je 0x14000c363
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1403aab45]
mov edx, 4
call fcn.1402d98f4
mov qword [rsi + 8], rax
mov qword [rsi], rdi
jmp 0x14000c35c

Function at 0x14000c37d
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14000c38d
xor eax, eax
add rsp, 0x28
ret
lea rcx, [0x1403aa9c1]
mov edx, 2
call fcn.1402d98f4
mov rdx, rax
mov eax, 1
jmp 0x14000c388

Function at 0x14000c5f1
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
Function at 0x140019013
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002cb9
test rax, rax
je 0x14001903e
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140032478

Function at 0x14001925e
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002cb9
test rax, rax
je 0x14001928f
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140034753

Function at 0x1400192a0
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002cb9
test rax, rax
je 0x1400192d1
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400354a5
Function at 0x140040908
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
movabs rdi, 0x8000000000000013
lea rcx, [rsp + 0x48]
mov dword [rcx], r8d
lea rax, [rsp + 0x38]
and dword [rax], 0
mov qword [rcx + 8], rdx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x140040970
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
add rdi, 6
jmp 0x140040978
call sub.KERNEL32.dll_GetLastError
mov dword [rsi + 8], eax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x140058e6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r13, qword [rsp + 0x90]
movabs rax, 0x1ffffffffffffff8
test r9, rax
je 0x140058f04
mov r14, r9
mov r15, r9
shr r15, 3
and r14, 0xfffffffffffffff8
lea rdx, [rbx + r14]
imul r12, r15, 0xe
lea r8, [rbx + r12]
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov r9, r15
call fcn.140058e6d
mov rbx, rax
lea rdx, [rdi + r14]
lea r8, [rdi + r12]
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov r9, r15
call fcn.140058e6d
mov rdi, rax
add r14, rsi
add r12, rsi
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov rdx, r14
mov r8, r12
mov r9, r15
call fcn.140058e6d
mov rsi, rax
mov rcx, qword [r13]
movzx edx, word [rbx]
movzx r8d, word [rdi]
call fcn.140058f59
mov ebp, eax
mov rcx, qword [r13]
movzx edx, word [rbx]
movzx r8d, word [rsi]
call fcn.140058f59
cmp bpl, al
jne 0x140058f45
mov rcx, qword [r13]
movzx edx, word [rdi]
movzx r8d, word [rsi]
call fcn.140058f59
xor bpl, al
cmovne rdi, rsi
mov rbx, rdi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400591ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rdx, r8
mov r8, r9
call fcn.1400590ee
add r14, 8
lea rdx, [rdi + 8]
mov rcx, r14
mov r8, rsi
call fcn.1400590ee
mov edx, 8
mov rcx, rdi
mov r8, rbx
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14005923d
Function at 0x14005923d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x48], r9
mov r9, rcx
mov r10, rdx
shr r10, 1
mov rax, rdx
and rax, 0xfffffffffffffffe
add rcx, rax
mov qword [rsp + 0x28], rcx
lea rdi, [r9 + rax - 2]
mov qword [rsp + 0x20], r9
lea r13, [r9 + rdx*2 - 2]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r8
lea rax, [r8 + rdx*2]
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x40], rax
neg r10
mov qword [rsp + 0x50], r10
xor r14d, r14d
mov r12, qword [rsp + 0x48]
cmp qword [rsp + 0x50], r14
je 0x140059340
mov rsi, r13
mov r13, qword [rsp + 0x28]
movzx ebp, word [r13]
mov rbx, qword [rsp + 0x20]
movzx r15d, word [rbx]
mov rcx, r12
mov edx, ebp
mov r8d, r15d
call fcn.140058f59
test al, al
cmovne r15d, ebp
mov rdx, qword [rsp + 0x30]
mov word [rdx], r15w
movzx ecx, al
xor al, 1
lea r13, [r13 + rcx*2]
mov qword [rsp + 0x28], r13
mov r13, rsi
movzx eax, al
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x20], rbx
add rdx, 2
mov qword [rsp + 0x30], rdx
movzx ebp, word [rsi]
movzx r15d, word [rdi]
mov rcx, r12
mov edx, ebp
mov r8d, r15d
call fcn.140058f59
test al, al
cmovne ebp, r15d
mov rcx, qword [rsp + 0x40]
mov word [rcx + r14*2], bp
movzx eax, al
add eax, eax
lea r13, [rax + rsi]
add r13, 0xfffffffffffffffe
sub rdi, rax
dec r14
jmp 0x1400592a0
add rdi, 2
test byte [rsp + 0x38], 1
jne 0x140059357
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x20]
jmp 0x140059389
xor eax, eax
xor ecx, ecx
mov r9, qword [rsp + 0x20]
cmp r9, rdi
setae al
setb cl
mov r8, qword [rsp + 0x28]
mov rdx, r8
cmovb rdx, r9
movzx edx, word [rdx]
mov r10, qword [rsp + 0x30]
mov word [r10], dx
lea r9, [r9 + rcx*2]
lea r8, [r8 + rax*2]
cmp r9, rdi
jne 0x1400593a8
add r13, 2
cmp r8, r13
jne 0x1400593a8
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14006f660
int3

Function at 0x14006438f
Capabilities:
Create directory

Disassembly:
test cl, cl
je 0x14006439e
mov rcx, rdx
mov rdx, r8
jmp fcn.14011e480
mov rcx, rdx
mov rdx, r8
jmp fcn.14011e3c0
Function at 0x1400643d3
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r13, rcx
mov r12, qword [rdx + 0x18]
test r12, r12
je 0x1400644ea
mov r14, rdx
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x1400644ea
mov r15, r9
mov rbx, r8
lea r9, [rsp + 0x30]
and qword [r9], 0
lea rcx, [0x1402ea940]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
movabs rdi, 0x8000000000000000
test eax, eax
js 0x140064502
mov qword [rsp + 0x28], r13
mov r8, 0xffffffffffffffff
mov r13, qword [rsp + 0x30]
cmp word [r13 + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140064446
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r13
call fcn.140118130
mov rcx, r13
call sub.ole32.dll_CoTaskMemFree
mov rdx, qword [rbp]
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
cmp rdx, rdi
je 0x1400644e3
lea r13, [rsp + 0x48]
mov r8, qword [r13 + 0x18]
mov qword [r13], rdx
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], rcx
mov qword [r13 + 0x18], r8
mov rdx, qword [r14 + 0x10]
lea rbp, [rsp + 0x30]
mov rcx, rbp
mov r8, r12
call fcn.140064626
mov rcx, r13
mov rdx, rbp
call fcn.1400643a9
mov rdx, qword [r14]
lea r14, [rsp + 0x30]
mov rcx, r14
mov r8, rsi
call fcn.140064626
mov rcx, r13
mov rdx, r14
call fcn.1400643a9
mov rdx, qword [r13]
mov rax, qword [r13 + 8]
mov rcx, qword [r13 + 0x10]
cmp rdx, rdi
jne 0x140064524
mov r13, qword [rsp + 0x28]
jmp 0x140064507
mov qword [r13 + 8], 2
movabs rax, 0x8000000000000000
mov qword [r13], rax
jmp 0x140064513
mov eax, 1
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], rcx
mov qword [r13], rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r9, [rsp + 0x48]
mov r8, qword [r9 + 0x18]
mov qword [r9], rdx
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], r8
xor esi, esi
xor r13d, r13d
xor ebp, ebp
xor edi, edi
xor eax, eax
xor r14d, r14d
test r14b, r14b
jne 0x14006460b
mov r12, rax
mov r14b, 1
mov r8, r15
sub r8, rdi
jb 0x140064606
lea rdx, [rbx + rdi]
cmp r8, 0xf
ja 0x140064583
xor r9d, r9d
cmp r8, r9
je 0x1400645bd
cmp byte [rdx + r9], 0x2f
je 0x140064593
inc r9
jmp 0x140064572
mov cl, 0x2f
call fcn.14006f400
cmp rax, 1
jne 0x1400645bd
mov r9, rdx
lea rsi, [r9 + rdi]
inc rsi
add r9, rdi
mov rdi, rsi
cmp r9, r15
jae 0x140064556
cmp byte [rbx + r9], 0x2f
mov rdi, rsi
jne 0x140064556
xor r14d, r14d
mov r13, rsi
mov rdi, rsi
mov rax, rsi
jmp 0x1400645cc
mov rsi, r15
mov bpl, 1
mov rdi, r15
mov rax, r12
mov r9, r15
sub r9, r12
je 0x14006454a
add r12, rbx
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, r12
mov r8, r9
call fcn.140064626
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.1400643a9
mov rdi, rsi
mov rax, r13
mov r14d, ebp
jmp 0x14006454a
mov bpl, 1
jmp 0x1400645c6
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
jmp 0x140064513
Function at 0x14006f0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14006f170
cmp r10, r11
jb 0x14006f1e7
cmp r10, rdx
ja 0x14006f1f9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14006f172
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14006f150
jmp 0x14006f1d4
ja 0x14006f17a
mov r11, r10
cmp rax, r8
jne 0x14006f11e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14006f1b0
mov rdi, r8
sub ecx, edx
jns 0x14006f1cb
jmp 0x14006f1d6
cmp r8, rsi
je 0x14006f208
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14006f1d6
xor al, 1
cmp rdi, rsi
jne 0x14006f190
jmp 0x14006f1d6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1402da880
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1402da4a0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1402da8f0
int3
Function at 0x14007395e
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x1402f0698]
mov ebx, 0xff
lea rsi, str.C:Userspc1.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x140073a8e
mov r14d, 4
sub r14, 1
jb 0x140073983
cmp r9, 0xf
jbe 0x140073abb
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.140073fa1
mov r9, rdx
mov ecx, ebp
jmp 0x140073993
xor edx, edx
cmp r9, rdx
je 0x140073aac
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140073a90
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Userspc1.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
mov ecx, reloc.WS2_32.dll_ntohs
mov rdx, r9
call fcn.1402da430
int3
Function at 0x140084539
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14008455f
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140084549
mov qword [rcx], rax
ret
Function at 0x14008de07
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14008dd00
test rbx, rbx
je 0x14008de40
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140084539
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b35f0
Function at 0x1400b3c1a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
movaps xmmword [rsp + 0x6d0], xmm6
mov rsi, rdx
mov r13, rcx
cmp qword [rdx], 0
je 0x1400b3c51
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov r8, rsi
call fcn.1401702aa
call fcn.1400749be
call fcn.1401822b0
test rax, rax
je 0x1400b483c
mov r14, rax
mov ecx, 0x18
mov edx, 8
call fcn.140074b47
mov rbx, rax
mov edi, 1
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r14
mov ecx, 0x20
mov edx, 8
call fcn.140074b47
mov r14, rax
mov qword [rax], rdi
lea rax, [0x1402f4d48]
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rdi
lea rax, [0x1402f4d70]
mov qword [r14 + 0x18], rax
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e0], r14
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x1400b3ce2
mov rcx, rbx
mov edx, reloc.WS2_32.dll_listen
call fcn.140075c54
test eax, eax
jne 0x1400b3d16
mov r8, qword [rsi + 0x38]
test r8, r8
je 0x1400b3cfc
mov rcx, rbx
mov edx, 7
call fcn.140075c54
test eax, eax
jne 0x1400b3d16
mov r8, qword [rsi + 0x40]
test r8, r8
je 0x1400b3d40
mov rcx, rbx
mov edx, 6
call fcn.140075c54
test eax, eax
je 0x1400b3d40
mov rcx, r13
call fcn.1400b4dcc
lea rcx, [rsp + 0x1d8]
call fcn.1400b6051
mov rcx, rsi
call fcn.14013afcc
mov rcx, rsi
call fcn.1400b0fda
jmp 0x1400b477d
mov edi, 8
mov ecx, 0x98
mov edx, 8
call fcn.1400b0c8d
mov ecx, 1
mov qword [rax], rcx
mov qword [rax + 8], rcx
and word [rax + 0x10], 0
and qword [rax + 0x18], 0
mov qword [rax + 0x20], rdi
xorps xmm6, xmm6
and qword [rax + 0x38], 0
movups xmmword [rax + 0x28], xmm6
mov qword [rax + 0x40], rdi
movups xmmword [rax + 0x48], xmm6
movabs rdx, 0x8000000000000000
mov qword [rax + 0x60], rdx
mov qword [rax + 0x68], rdi
mov qword [rax + 0x80], rcx
mov qword [rax + 0x88], rcx
mov byte [rax + 0x90], 0
lock inc qword [rax]
jle 0x1400b488f
lea rdx, [rsp + 0x150]
movups xmm0, xmmword [rsi + 0x48]
mov rcx, qword [rsi + 0x58]
movups xmmword [rdx - 0x18], xmm6
and qword [rdx - 8], 0
mov qword [rdx], rbx
mov qword [rdx + 8], r14
lea rbp, [rsp + 0x160]
mov qword [rbp], rax
lea r14, [rsp + 0x168]
mov qword [r14], rax
lea rbx, [rsp + 0x170]
movups xmmword [rbx], xmm0
lea rdi, [rsp + 0x178]
mov qword [rdi + 8], rcx
and qword [rdi - 0x50], 0
movups xmm0, xmmword [rsi + 0x20]
mov qword [rdi - 0x48], 8
mov byte [rdi + 0x20], 0
movups xmmword [rdi + 0x10], xmm0
mov rax, qword [rsi + 0x60]
lea rcx, [rsp + 0x2b0]
mov qword [rcx], rax
call fcn.1400b10a9
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x1e8]
mov qword [rcx], rax
mov dword [rcx + 8], 1
lea rcx, [rsp + 0x2b0]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r15, [rsp + 0x80]
lea r12, [rsp + 0x128]
lea rcx, [0x1402f4b34]
lea r8, str.C:Userspc1.cargo_registry_srcindex.crates.io_6f17d22bba15001fcurl_0.4.43_srcmulti.rs
mov edx, 0x20
call fcn.1402da510
Function at 0x1400bb76d
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
lea rdx, [0x1403a6358]
mov r8d, 1
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400bb7a5
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call fcn.1400cab12
nop
add rsp, 0x28
ret
Function at 0x1400c8be1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
mov qword [rsp + 0x50], r8
mov rdi, rdx
test r9b, r9b
mov qword [rsp + 0x30], rcx
je 0x1400c8c34
lea r14, [rcx + 0xd80]
lea r9, [0x140342fa0]
xor esi, esi
mov r8d, 0x90
mov rcx, r14
xor edx, edx
call fcn.1400ca05a
cmp rdx, rsi
je 0x1400c8c9f
mov byte [rax + rsi], 8
inc rsi
jmp 0x1400c8c26
mov word [rcx + 0x200], 1
xor r14d, r14d
mov byte [rsp + 0x20], r14b
mov r8d, 0x120
mov r9d, reloc.WS2_32.dll_ntohs
xor edx, edx
call fcn.1400c9629
mov byte [rsp + 0x20], r14b
mov edx, 1
mov r8d, 0x20
mov r9d, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x30]
call fcn.1400c9629
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + 0xe9d]
cmp r14, 0x1d
je 0x1400c9071
cmp byte [rax], 0
jne 0x1400c9077
inc r14
dec rax
jmp 0x1400c8c84
lea r9, [0x140342fb8]
mov edx, 0x90
mov r8d, 0x100
mov rcx, r14
call fcn.1400ca05a
xor ecx, ecx
cmp rdx, rcx
je 0x1400c8cc9
mov byte [rax + rcx], 9
inc rcx
jmp 0x1400c8cbb
lea r9, [0x140342fd0]
mov edx, 0x100
mov r8d, 0x118
mov rcx, r14
call fcn.1400ca05a
xor ecx, ecx
cmp rdx, rcx
je 0x1400c8cf3
mov byte [rax + rcx], 7
inc rcx
jmp 0x1400c8ce5
lea r9, [0x140342fe8]
mov edx, 0x118
mov r8d, 0x120
mov rcx, r14
call fcn.1400ca05a
xor ecx, ecx
mov r8, qword [rsp + 0x30]
cmp rdx, rcx
je 0x1400c8d22
mov byte [rax + rcx], 8
inc rcx
jmp 0x1400c8d14
lea rcx, [r8 + 0xea0]
lea r8, [0x140343000]
mov edx, 0x20
call fcn.1400ca080
xor ecx, ecx
cmp rdx, rcx
je 0x1400c8d4a
mov byte [rax + rcx], 5
inc rcx
jmp 0x1400c8d3c
mov bl, 1
mov byte [rsp + 0x20], bl
mov r8d, 0x120
mov r9d, reloc.WS2_32.dll_ntohs
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
xor edx, edx
call fcn.1400c9629
mov byte [rsp + 0x20], bl
mov edx, 1
mov r8d, 0x20
mov r9d, reloc.WS2_32.dll_ntohs
mov rcx, rsi
call fcn.1400c9629
mov rcx, rdi
mov edx, 1
mov r8d, 2
call fcn.1400c8b5c
mov r14d, 0x1d
mov eax, 0x11e
sub rax, r14
mov qword [rsp + 0x68], rax
lea rax, [rcx + 0xebd]
xor esi, esi
cmp rsi, 0x1d
je 0x1400c90a0
cmp byte [rax], 0
jne 0x1400c90a5
inc rsi
dec rax
jmp 0x1400c908d
mov esi, 0x1d
mov r12d, 0x1e
sub r12, rsi
lea rbx, [rsp + 0x1c8]
mov r8d, 0x140
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x88]
mov r8d, 0x140
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r13, qword [rsp + 0x68]
lea rax, [r12 + r13]
mov qword [rsp + 0x78], rax
lea r9, [0x140343018]
mov r8d, 0x140
mov rcx, r13
mov rdx, rbx
call fcn.14010b52f
mov rbp, rax
mov r15, rdx
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0xd80]
Function at 0x1400cb457
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x20]
lea rcx, [rax - 2]
cmp rcx, 2
jae 0x1400cb48a
mov edx, 1
mov rcx, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400cb57d
test rax, rax
jne 0x1400cb572
cmp qword [rsi], 0
je 0x1400cb4a5
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
jmp 0x1400cb4a7
xor edx, edx
lea rdi, [rsi + 0x20]
mov rcx, rsi
call fcn.1400cb59c
lea rdx, [rsp + 0x58]
and dword [rdx], 0
mov r14, qword [rbx]
lea rax, [r14 + 8]
mov qword [rdx + 8], 1
lea r8, [rsp + 0x40]
and dword [r8], 0
lea rbx, [rsp + 0x44]
and dword [rbx], 0
mov rcx, qword [r14]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
and qword [rsp + 0x30], 0
mov r8d, 1
mov r9, rbx
call sub.WS2_32.dll_WSARecv
mov r8d, dword [rbx]
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov edx, eax
call fcn.1400cc52d
mov rax, qword [rbx]
test rax, rax
je 0x1400cb533
cmp eax, 1
jne 0x1400cb54c
cmp byte [rsi + 0x78], 0
je 0x1400cb533
mov rcx, rdi
call fcn.1400cb5e6
mov qword [rsi + 0x20], 2
jmp 0x1400cb565
mov rcx, rdi
call fcn.1400cb5e6
mov qword [rdi], 1
lock inc qword [r14 + 0xe0]
jmp 0x1400cb572
mov rbx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1400cb5e6
mov qword [rsi + 0x20], 3
mov qword [rsi + 0x28], rbx
mov edx, 1
mov rcx, rsi
call fcn.1400cb57d
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret