joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c08c
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push r13
push r12
push rsp
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r14, rdx
mov rsi, rcx
lea r15, [rsp + 0x58]
jl 0x14004c0c9
pop rax
mov rcx, r15
mov rdx, r8
ret 0x894d
enter 0xffffffffffff86e8, 0xffffffffffffffff
invalid
dec dword [rbp + rcx*4 + 0x64]
lea esp, [rsp + 0x38]
mov dword [r12], 0x800
lea rdi, [rsp + 0x3c]
and dword [rdi], 0
mov ecx, 0x800
xor edx, edx
shr al, cl
invalid
mov cl, 1
invalid
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
push rbx
or byte [rax - 0x7d], cl
invalid
adc byte [rax], al
mov r14, qword [r14]
mov esi, dword [rsi]
mov r15, qword [r15 + 8]
mov r13, qword [sym.imp.advapi32.dll_RegQueryValueExW]
sub eax, 0x14f03c
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
mov r9, rdi
stc
call r13
cmp eax, 0xea
jne case.0x14003f5ca.156
invalid
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call fcn.14001525c
mov rdx, qword [rsp + 0x48]
and al, 0x48
jmp 0x14004c0f4
test eax, eax
jne case.0x140040ebd.146
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
and al, 0x50
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14004c16e
movabs rax, 0xde00000002
jmp 0x14004c151
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
add byte [rax + 0x48068948], al
lea ecx, [rsp + 0x40]
call fcn.14000154e
jmp 0x14004c182
invalid
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
adc dword [rsi], eax
mov byte [rsi + 0x18], al
lea rcx, [rsp + 0x58]
call fcn.140001573
mov rax, rsi
mov eax, esi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop rsp
pop r13
pop r14
pop r15
pop rdi
ret
Function at 0x1400525f9
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x160]
mov rdx, qword [rdx + 0x178]
lea r8, [0x1401a8410]
mov rcx, rbx
call fcn.14004fe5d
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140068b00
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.140068b00
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140068b00
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.140068b00
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.140068b17
lea rcx, [rdi + 0x1f0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140052733
test eax, eax
je 0x14005274a
cmp eax, 0x90317
je 0x1400527c4
cmp eax, 0x90321
jne 0x1400527cc
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140051bc6
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x1400527da
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x210], rbp
mov byte [rsi + 1], 0
jmp 0x1400527c8
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x168]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x140]
and qword [rdi + 0x150], 0
mov rcx, rbx
call fcn.14004f694
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.1400659d0
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140051bc6
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x1400527da
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x1400527da
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400527f3
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x60]
mov rdx, qword [rdx + 0x78]
lea r8, [0x1401a8410]
mov rcx, rbx
call fcn.14004fe5d
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140068b00
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.140068b00
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140068b00
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.140068b00
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.140068b17
lea rcx, [rdi + 0xf0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140052924
test eax, eax
je 0x14005293b
cmp eax, 0x90317
je 0x1400529a3
cmp eax, 0x90321
jne 0x1400529ab
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140051b70
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x1400529b9
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x110], rbp
mov byte [rsi + 1], 0
jmp 0x1400529a7
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x68]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x40]
and qword [rdi + 0x50], 0
mov rcx, rbx
call fcn.14004f694
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.1400659d0
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140051b70
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x1400529b9
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x1400529b9
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400529d2
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x140052b73
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rbx, [r14 + r8]
add rdx, rbx
lea rdi, [rcx + 0x180]
cmp qword [rcx + 0x190], rdx
jae 0x140052a21
mov rcx, rdi
xor r8d, r8d
call fcn.1400c0652
lea r9, [0x1401a8498]
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004fe73
lea rcx, [0x1401a84b0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.140067308
lea r8, [0x1401a84c8]
mov rcx, rdi
mov rdx, r14
call fcn.14004fe5d
mov r9, rdx
lea r15, [rsp + 0x78]
mov rcx, r15
mov edx, 7
mov r8, rax
call fcn.140068b00
lea r9, [0x1401a84e0]
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004fe73
mov r9, rdx
lea r14, [rsp + 0x88]
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140068b00
lea r8, [0x1401a84f8]
mov rcx, rdi
mov rdx, rbx
call fcn.14004f6c0
mov r9, rdx
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov edx, 6
mov r8, rax
call fcn.140068b00
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140068b00
movups xmm0, xmmword [r15]
movaps xmmword [r12 - 0x30], xmm0
movups xmm0, xmmword [r14]
movaps xmmword [r12 - 0x20], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r12 - 0x10], xmm0
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rbx
call fcn.140068b17
lea rcx, [rsi + 0x1f0]
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x140052b44
shl rax, 0x20
or rax, 2
jmp 0x140052b62
mov edx, dword [rsp + 0x40]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.1400b6846
and qword [rsi + 0x198], 0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, [0x1401a8480]
mov edx, 0x3e
call fcn.1401999a0
int3
Function at 0x140052b8c
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x140052d2d
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rbx, [r14 + r8]
add rdx, rbx
lea rdi, [rcx + 0x80]
cmp qword [rcx + 0x90], rdx
jae 0x140052bdb
mov rcx, rdi
xor r8d, r8d
call fcn.1400c0652
lea r9, [0x1401a8498]
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004fe73
lea rcx, [0x1401a84b0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.140067308
lea r8, [0x1401a84c8]
mov rcx, rdi
mov rdx, r14
call fcn.14004fe5d
mov r9, rdx
lea r15, [rsp + 0x78]
mov rcx, r15
mov edx, 7
mov r8, rax
call fcn.140068b00
lea r9, [0x1401a84e0]
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.14004fe73
mov r9, rdx
lea r14, [rsp + 0x88]
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140068b00
lea r8, [0x1401a84f8]
mov rcx, rdi
mov rdx, rbx
call fcn.14004f6c0
mov r9, rdx
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov edx, 6
mov r8, rax
call fcn.140068b00
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140068b00
movups xmm0, xmmword [r15]
movaps xmmword [r12 - 0x30], xmm0
movups xmm0, xmmword [r14]
movaps xmmword [r12 - 0x20], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r12 - 0x10], xmm0
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rbx
call fcn.140068b17
lea rcx, [rsi + 0xf0]
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x140052cfe
shl rax, 0x20
or rax, 2
jmp 0x140052d1c
mov edx, dword [rsp + 0x40]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.1400b6846
and qword [rsi + 0x98], 0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, [0x1401a8480]
mov edx, 0x3e
call fcn.1401999a0
int3
Function at 0x14006845f
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
mov byte [rsp + 0x4f], dl
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x18], rax
je 0x1400684d5
mov ecx, dword [rsi + 0x28]
mov dword [rsp + 0x90], ecx
mov rcx, qword [rsi + 0x20]
mov qword [rsp + 0x98], rcx
cmp qword [rsi + 0x30], rax
je 0x14006850c
mov rax, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x40]
add rdx, rax
lea rcx, [rsp + 0xb8]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x4f]
mov qword [rcx + 0x10], rax
xor edx, edx
call fcn.140067605
mov dword [rsp + 0xa0], eax
mov rdx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
lea r8, [rdx + rax*8]
lea rsi, [rsp + 0xb8]
mov rcx, rsi
call fcn.1400677d9
mov eax, dword [rsi + 0x10]
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov rax, qword [rsi + 8]
cmp byte [rsp + 0x4f], 1
mov qword [rcx + 8], rax
mov r8d, 2
sbb r8d, 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x1401ac76b]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x14006858e
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov edi, 1
jmp 0x1400685b2
movaps xmm6, xmmword [rsp + 0x50]
mov ecx, 0x20
call fcn.140067cfb
mov rsi, rax
mov eax, 1
mov qword [rsi], rax
mov qword [rsi + 8], rax
movups xmmword [rsi + 0x10], xmm6
xor edi, edi
lea rcx, [rsp + 0xb8]
call fcn.14004e85e
mov rax, rdi
mov rdx, rsi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rdi
pop rsi
ret

Function at 0x14006dc53
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14006dc79
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14006dc63
mov qword [rcx], rax
ret
Function at 0x14007d420
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor eax, eax
test rbx, rbx
setne al
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
call fcn.14006a9ab
test rbx, rbx
je 0x14007d461
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14006dc53
add rdi, 8
mov rcx, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14007d666
Function at 0x1400a030f
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.1400a01f5
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x1400ac351
jmp 0x14016b960
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14016b998
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1400a071e
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400a9620
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 4
jmp 0x1400a975b
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r9d
mov dword [rsp + 0x20], 4
mov r9, rax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a9781
xor eax, eax
jmp 0x1400a9786
call fcn.140029b08
nop
add rsp, 0x38
ret

Function at 0x1400a0723
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1400a9637
mov r9, rdx
mov rcx, qword [rcx]
mov edx, 0xffff
mov r8d, 0x1001
jmp 0x1400a975b

Function at 0x1400a072a
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1400a960a
mov r9, rdx
mov rcx, qword [rcx]
mov edx, 0xffff
mov r8d, 0x1002
jmp 0x1400a975b

Function at 0x1400a5bd4
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400a5bdb
test al, 1
je 0x1400a5bfa
test al, 2
jne 0x1400a5c12
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401e6ef0]
mov edx, 0x23
call fcn.1401999a0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401e6f30]
mov edx, 0x25
call fcn.1401999a0
int3

Function at 0x1400a90fc
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsi + 0x20]
add rsp, 0x50
pop rsi
ret

Function at 0x1400a959a
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x1400a95bb
add rsp, 0x28
jmp fcn.140029b08
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400a95c2
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1400a95e8
xor eax, eax
jmp 0x1400a95ed
call fcn.140029b08
nop
add rsp, 0x28
ret

Function at 0x1400a95f3
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 8
jmp 0x1400a975b
Function at 0x1400a975b
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400a9620
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 4
jmp 0x1400a975b
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r9d
mov dword [rsp + 0x20], 4
mov r9, rax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a9781
xor eax, eax
jmp 0x1400a9786
call fcn.140029b08
nop
add rsp, 0x38
ret

Function at 0x1400adc88
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x1402a50d8]
test r14, r14
jne 0x1400addc9
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400adcf2
mov rbx, rax
lea rdx, [0x1401e91b6]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400adcf2
mov rdi, rax
lea rdx, [0x1401e91c4]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400adcf2
mov r15, rax
xor ebx, ebx
jmp 0x1400add7b
lea rcx, [0x1401e9150]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400adde0
mov rdi, rax
lea rdx, [0x1401e915a]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400adde0
mov r14, rax
lea rdx, [0x1401e916d]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400adde0
mov rbx, rax
lea rdx, [0x1401e9181]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400adde0
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400adde0
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.140067cfb
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1402a50d8], r14
je 0x1400addc9
mov rdi, rax
cmp qword [r14], 0
je 0x1400addb3
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, r14
call fcn.1400151e0
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x1401e92b0]
mov edx, 0x5b
call fcn.1401958cf
int3
Function at 0x140102aa1
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov r13, qword [rdx + 8]
mov r8, qword [r8 + 8]
mov r9, qword [r14 + 0x10]
lea rcx, [r9*8]
movabs rax, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
mov r10, r8
test rcx, rcx
je 0x140102b19
movzx r11d, byte [r10 + 4]
xor rax, r11
imul rax, rdx
movzx r11d, byte [r10 + 5]
xor r11, rax
mov eax, dword [r10]
add r10, 8
imul r11, rdx
xor rax, r11
imul rax, rdx
add rcx, 0xfffffffffffffff8
jmp 0x140102ae8
mov rcx, qword [r13 + 0x10]
test rcx, rcx
je 0x140102c2c
xor edx, edx
div rcx
mov rdi, rdx
mov r15, qword [r13 + 8]
mov rbp, rdx
shl rbp, 5
movzx eax, word [r15 + rbp + 0x1c]
cmp ax, word [r13 + 0x20]
jne 0x140102b73
mov rcx, qword [r15 + rbp + 8]
mov rdx, qword [r15 + rbp + 0x10]
call fcn.1400cbede
test al, al
je 0x140102b73
mov eax, dword [r15 + rbp + 0x18]
mov dword [rbx + 8], eax
movabs rax, 0x8000000000000008
mov qword [rbx], rax
jmp 0x140102c0d
mov rsi, qword [rsi]
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, r14
call fcn.1400cafc1
lea r12, [rsp + 0x38]
mov rcx, r12
mov rdx, rsi
mov r8, r15
call fcn.1400fdedb
mov rax, qword [r12]
movabs rsi, 0x8000000000000008
cmp rax, rsi
jne 0x140102bf4
mov rdx, qword [r13 + 0x10]
cmp rdx, rdi
jbe 0x140102c44
mov edi, dword [rsp + 0x40]
movzx r15d, word [r13 + 0x20]
mov r12, qword [r13 + 8]
lea rcx, [r12 + rbp]
call fcn.1400b6bea
mov rax, qword [r14 + 0x10]
mov qword [r12 + rbp + 0x10], rax
movups xmm0, xmmword [r14]
movups xmmword [r12 + rbp], xmm0
mov dword [r12 + rbp + 0x18], edi
mov word [r12 + rbp + 0x1c], r15w
mov dword [rbx + 8], edi
mov qword [rbx], rsi
jmp 0x140102c15
lea rsi, [rsp + 0x44]
mov edx, dword [rsi - 4]
lea rdi, [rbx + 0xc]
mov ecx, 0x1d
rep movsd dword [rdi], dword [rsi]
mov qword [rbx], rax
mov dword [rbx + 8], edx
mov rcx, r14
call fcn.1400b6bea
mov rax, rbx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero_rustc_bf8716f1cd6416266807706bcae0ecb2e51c9d4alibrarycore_src_slicemod.rs
lea r8, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompsonmap.rs
mov edx, 0x39
call fcn.1401999a0
lea r8, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompsonmap.rs
mov rcx, rdi
call fcn.140199aa0
int3
Function at 0x1401638e0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rdi, qword [rdi]
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
call fcn.1401639cf
cmp eax, 0x1edab0ed
jne 0x140163908
mov r14, qword [rdi + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov eax, dword [rax + r14 + 0x88]
test rax, rax
je 0x1401639a1
mov edi, dword [rax + r14 + 0x18]
mov ecx, dword [rax + r14 + 0x1c]
add rcx, r14
mov qword [rsp + 0x20], rcx
mov r12d, dword [rax + r14 + 0x20]
add r12, r14
mov r13d, dword [rax + r14 + 0x24]
add r13, r14
xor ebx, ebx
xor r15d, r15d
cmp r15, rdi
je 0x1401639a3
mov rbp, r15
mov ecx, dword [r12 + r15*4]
add rcx, r14
mov rdx, 0xffffffffffffffff
cmp byte [rcx + rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140163971
lea r15, [rbp + 1]
call fcn.1401639cf
cmp eax, esi
jne 0x14016395b
movzx ecx, word [r13 + rbp*2]
cmp rdi, rcx
jbe 0x1401639bf
mov rax, qword [rsp + 0x20]
mov ebx, dword [rax + rcx*4]
add rbx, r14
jmp 0x1401639a3
xor ebx, ebx
movzx eax, word [rbx + 4]
add rbx, 0x12
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x14028a180]
mov rdx, rdi
call fcn.140199aa0
int3

Function at 0x1401639cf
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x140163a0b
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x1401639ea
inc r8
jmp 0x1401639d7
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x1401639e5
ret