joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033b86
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.14005fdad
mov al, byte [rbx]
cmp al, 0x14
jne 0x140033be8
lea rbx, [rsp + 0x38]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.14005fb3b
cmp qword [rbx], 0
je 0x140033c28
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x140033c0d
mov cl, byte [rsp + 0x39]
movzx edx, word [rsp + 0x3a]
mov r8d, dword [rsp + 0x4c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x3c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r15, [rsp + 0x3a]
mov rax, qword [r15 + 0x16]
movups xmm0, xmmword [r15 + 6]
lea rdi, [rsp + 0xb0]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x20]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r12, [rsp + 0x8a]
lea r14, [rsp + 0x38]
mov rax, qword [rsp + 0xc0]
cmp rax, qword [rsp + 0xb8]
jae 0x140033d27
mov rcx, r14
mov rdx, rdi
call fcn.140038950
movzx eax, word [rsp + 0x38]
cmp ax, 0xf
je 0x140033d42
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0xe]
movups xmmword [rsp + 0x6e], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x58]
mov word [rsp + 0x88], ax
movups xmm0, xmmword [rsp + 0x6e]
movups xmmword [r12 + 0xe], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r12], xmm0
mov qword [rsp + 0xa8], rcx
mov rdx, qword [rsp + 0x30]
cmp rdx, qword [rsp + 0x28]
jne 0x140033ceb
mov rcx, rbx
call fcn.14003f373
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
imul rcx, rdx, 0x28
mov r8, qword [rsp + 0xa8]
mov qword [rax + rcx + 0x20], r8
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movups xmmword [rax + rcx + 0x10], xmm1
movups xmmword [rax + rcx], xmm0
inc rdx
mov qword [rsp + 0x30], rdx
jmp 0x140033c65
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x140033c14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x76], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x66], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rcx, [rsp + 0x20]
call fcn.140030d18
jmp 0x140033c14
Function at 0x140081080
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x140081100
jmp 0x1400810ef
jae 0x1400811a4
cmp r8, 0x201
jae 0x140081100
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x140081147
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x140081127
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14006ef30
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x14008116b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400811ff
mov r8d, ebx
cmp rbp, r8
jne 0x1400810e0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14008121f
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x1400810ef
jmp 0x140081100
cmp r12, r8
jb 0x140081239
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140084160
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rdi, qword [rsp + 0x28]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
test rsi, rsi
je 0x1400811e8
mov rcx, qword [0x1401a4140]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.KERNEL32.dll_HeapFree
mov rax, rdi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rax
mov byte [rdi + 0x18], 2
test rsi, rsi
jne 0x1400811d5
jmp 0x1400811e8
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140008d60
jmp 0x14008124e
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.14000be50
ud2
Function at 0x1400839e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140083a41
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140083a41
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140083a41
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140083a41
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140083a7e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140083a6c
xor eax, eax
jmp 0x140083a79
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x140083a79

Function at 0x140083a90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140083af1
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140083af1
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140083af1
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140083af1
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140083b2e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140083b1c
xor eax, eax
jmp 0x140083b29
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x140083b29

Function at 0x140083b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
mov r9d, 2
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140083b76
cdqe
jmp 0x140083b84
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140083b8c
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140083b9d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140083bb0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140083be4
xor eax, eax
jmp 0x140083bf1
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x140083c00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x140083c7a
mov rcx, qword [rcx]
cmp rax, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140083c5b
cdqe
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x140083c73
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140083c6b
xor eax, eax
jmp 0x140083c73
shl rax, 0x20
or rax, 2
add rsp, 0x28
pop rdi
pop rsi
ret
lea r8, str.library_std_srcio_readbuf.rs
mov rcx, rsi
call fcn.14000bdd0
ud2

Function at 0x140083d20
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x140083d71
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140083d87
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x140083da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x140083e1d
mov rcx, qword [rcx]
mov rcx, qword [rcx]
cmp rax, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140083dfe
cdqe
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x140083e16
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140083e0e
xor eax, eax
jmp 0x140083e16
shl rax, 0x20
or rax, 2
add rsp, 0x28
pop rdi
pop rsi
ret
lea r8, str.library_std_srcio_readbuf.rs
mov rcx, rsi
call fcn.14000bdd0
ud2

Function at 0x140084010
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140084036
xor eax, eax
jmp 0x140084043
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x140084090
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x1400840c9
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400840df
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x1400840f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140084123
cdqe
jmp 0x140084131
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140084139
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14008414a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140088910
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1078
call fcn.1400e65d0
sub rsp, rax
movaps xmmword [rsp + 0x1060], xmm6
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x34], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x34]
mov qword [rsp + 0x58], r13
lea rbp, [0x14008e930]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x140088aa5
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x60]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x1400889a3
cmp dword [rsp + 0x38], 0
jne 0x140088aaa
mov r15d, dword [rsp + 0x3c]
test r15, r15
je 0x140088aaa
cmp r15d, 0x1000
ja 0x140088aea
xor r12d, r12d
nop word cs:[rax + rax]
cmp r12, r15
ja 0x140088ad6
lea rdx, [rsp + r12]
add rdx, 0x60
mov r8d, r15d
sub r8d, r12d
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x140088aa5
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x140088a40
cmp dword [rsp + 0x38], 0
jne 0x140088aaa
mov eax, dword [rsp + 0x3c]
add r12, rax
cmp r12, r15
jne 0x1400889f0
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r14
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x1400889a3
call sub.KERNEL32.dll_GetLastError
mov rcx, rdi
call fcn.1400e686c
mov rcx, rsi
call fcn.1400e686c
movaps xmm6, xmmword [rsp + 0x1060]
add rsp, 0x1078
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14000bed0
jmp 0x140088afe
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14000be50
ud2
Function at 0x14008c230
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14011e2f8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x14008c29a
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14008c2a9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14008c2e0
cmp eax, 0x103
je 0x14008c2ea
test eax, eax
js 0x14008c2c6
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008c2e0
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140083030
mov rcx, rax
call fcn.140067f40
mov ecx, 7
int 0x29
ud2

Function at 0x14008c350
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008c3a4
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14008c43a
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x14008c3b7
cmp eax, 0x2739
jne 0x14008c405
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008c400
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x14008c41a
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x14008c43a
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14008c43a
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008ea30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14008eb35
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14008ea68
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14008eb1e
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14008eb00
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x14008eabd
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x14008ead9
jmp 0x14008eace
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
je 0x14008ead4
cmp eax, 0x6d
jne 0x14008eaf0
mov byte [rsi + 1], 0
jmp 0x14008eae4
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14008eae6
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14006f1a0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x14008ea75
mov r8d, 0x10
mov rcx, rbx
call fcn.14006f1a0
mov rax, qword [rbx + 8]
jmp 0x14008ea68
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14006a590
ud2
Function at 0x140092f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140094d90
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x140092ff5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14008ba60
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x140093003
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x140093023
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x140093014
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.1400686e0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x140093014
mov rcx, qword [0x1401a4140]
xor edx, edx
mov r8, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree

Function at 0x140093c50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140093c86
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140081ba0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.140008cd0
ud2
Function at 0x1400943a0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14015c1f8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.1400893a0
test rax, rax
je 0x14009445e
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400944b0]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140094451
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x14009442c
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140089430
mov rcx, qword [0x1401a4140]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400041b0
ud2
Function at 0x140094610
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140094695
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400946d6
cmp dword [rsp + 0x2c], 0
je 0x1400946ba
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400946fe
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1401a4178]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401a4178], rsi
jne 0x140094670
mov byte [0x1401a4170], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400946cc
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14009474a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400946bf
mov edi, dword [rsp + 0x28]
jmp 0x1400946cc
mov edi, dword [rsi + 0x18]
jmp 0x1400946ca
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x14011ec08]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.14006a510
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.called__Option::unwrap____on_a__None__value_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_srccollections_btree_navigate.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140008cd0
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.called__Option::unwrap____on_a__None__value_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_srccollections_btree_navigate.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14006a5e0
ud2