joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f03f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x1400f0514
cmp r8d, 0xff
jne 0x1400f0451
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x1400f043b
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x116b40]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.1400cce20
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.1400cce20
cmp r8d, 0xfb
jne 0x1400f0463
lea r9, str.WILL
jmp 0x1400f04a1
cmp r8d, 0xfc
jne 0x1400f0475
lea r9, str.WONT
jmp 0x1400f04a1
cmp r8d, 0xfd
jne 0x1400f0487
lea r9, [0x140117564]
jmp 0x1400f04a1
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x1400f04fd
cmp r10d, 0x27
jg 0x1400f04d4
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x117160]
test r8, r8
jne 0x1400f04e4
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.1400cce20
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x1400f04bb
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.1400cce20
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.1400cce20
add rsp, 0x38
ret

Function at 0x1400f0860
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400f08bf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400ccca0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1400f03f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f0a70
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400f0c18
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400f0ad5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400f0ad5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400f0ad5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400f0b0c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400f0b62
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400f0b62
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400f0b62
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400f0b62
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400f0b62
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400f0520
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400f0bc4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400ccca0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400f08f0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400f0c10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400ccca0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f2380
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14014a080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400f2415
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400f2476
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400ccca0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140106160
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400f2531
sub ecx, 1
je 0x1400f25a4
sub ecx, 1
je 0x1400f24e0
cmp ecx, 1
je 0x1400f24c3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140122590]
call fcn.1400ccca0
jmp 0x1400f25a4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400f20b0
test eax, eax
je 0x1400f25a4
jmp 0x1400f244a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400f25a4
sub rax, rsi
cmp rax, rbp
jae 0x1400f25a4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400cce20
jmp 0x1400f25a4
cmp r8d, 4
jle 0x1400f25a4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400f25a4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400ccbc0
mov esi, eax
test eax, eax
je 0x1400f2583
mov edx, 5
mov rcx, rbx
call fcn.1400f3070
mov eax, esi
jmp 0x1400f244a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400db4a0
mov rcx, r14
call fcn.1400db780
test eax, eax
je 0x1400f2448
mov edx, 5
mov rcx, rbx
call fcn.1400f3070
mov eax, Ordinal_45
jmp 0x1400f244a
Function at 0x140105340
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140105382
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1401053c9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140105422
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1401053e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140105463
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14011a66b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14011a66c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140105430
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14010547c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401054b6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401054bb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140105504
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140105504
dec r8
sub rdx, 1
jne 0x1401054ea
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140105cc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140105594
mov ebx, eax
test eax, eax
jne 0x140105cf8
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140105d5b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140105d52
test al, 0x10
je 0x140105d52
bt eax, 0xa
jae 0x140105d4b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140105d6c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140105d47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140105d47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140105d52
and dword [rsp + 0x3c], 0
jmp 0x140105d57
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401070f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140107142
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140107142
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140107142
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140107142
cmp dword [rcx + 0x84], 0xe
jbe 0x140107142
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140107144
xor al, al
add rsp, 0x28
ret
Function at 0x1400864d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140086560
cmp r11, r10
ja 0x1400865d6
cmp r10, rdx
ja 0x1400865e8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140086562
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140086540
jmp 0x1400865c4
ja 0x14008656a
mov r11, r10
cmp rax, r8
jne 0x140086504
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400865a0
mov rdi, r8
sub ecx, edx
jns 0x1400865bb
jmp 0x1400865c6
cmp r8, rsi
je 0x1400865f7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400865c6
xor al, 1
cmp rdi, rsi
jne 0x140086580
jmp 0x1400865c6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400818d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140080b50
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140084070
int3

Function at 0x14008bf20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140273038]
test ecx, ecx
je 0x14008bf39
dec ecx
add rsp, 0x28
jmp fcn.1401c0bbc
lea rcx, [0x140273020]
call fcn.14016c7a0
mov ecx, eax
jmp 0x14008bf30

Function at 0x14008bf49
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14008bf6a
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401c0bb4
mov rcx, rax
call fcn.14016c7a0
mov ecx, eax
jmp 0x14008bf5d

Function at 0x140098b89
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x140098bf3
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140098ba5
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140098ba5
and ebp, 0x7fffffff
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14009b16b
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.1400af583
test rbx, rbx
je 0x14009b1a4
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14009b1be
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14009b1b6
Function at 0x14009b1be
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14009b1e4
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14009b1ce
mov qword [rcx], rax
ret
Function at 0x1400c0e8e
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x14039f0f0]
test r14, r14
jne 0x1400c0fbd
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400c0ef5
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400c0ef5
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400c0ef5
mov r15, rax
xor ebx, ebx
jmp 0x1400c0f76
lea rcx, str.ntdll.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400c0fd1
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400c0fd1
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400c0fd1
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400c0fd1
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400c0fd1
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.1400bd1a6
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x14039f0f0], r14
je 0x1400c0fbd
mov rdi, rax
cmp qword [r14], 0
je 0x1400c0fad
mov rcx, qword [r14 + 0x10]
call fcn.1401c0f54
mov edx, 8
mov rcx, r14
call fcn.1400322f0
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8__root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.9_src_thread_parker_windows_mod.rs
lea r8, [0x1402bd458]
mov edx, 0x5b
call fcn.1400c0fea
int3

Function at 0x1400c118c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140273068]
test ecx, ecx
je 0x1400c11a5
dec ecx
add rsp, 0x28
jmp fcn.1401c0bbc
lea rcx, [0x140273050]
call fcn.14016c7a0
mov ecx, eax
jmp 0x1400c119c
Function at 0x1400c1431
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140194900
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call fcn.140194900
mov rdi, qword [rbx]
mov r14, qword [rbx + 8]
mov rbx, qword [r15]
mov r15, qword [r15 + 8]
cmp r14, r15
jne 0x1400c14d2
mov al, byte [rsp + 0x58]
cmp al, byte [rsp + 0x98]
jne 0x1400c14d2
cmp byte [rsp + 0x59], 2
jne 0x1400c14d2
cmp byte [rsp + 0x99], 2
jne 0x1400c14d2
cmp byte [rsp + 0x30], 3
setb al
cmp byte [rsp + 0x70], 3
setb cl
xor cl, al
jne 0x1400c14d2
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9, r14
call fcn.14016bbc7
mov ecx, eax
mov al, 1
test cl, cl
jne 0x1400c1725
mov al, byte [rsp + 0x30]
cmp al, 6
je 0x1400c1501
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0xef], rcx
movups xmm0, xmmword [rsp + 0x31]
movups xmm1, xmmword [rsp + 0x41]
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
mov dl, byte [rsp + 0x5a]
mov r8b, byte [rsp + 0x58]
mov r9b, byte [rsp + 0x59]
mov cl, byte [rsp + 0x70]
cmp cl, 6
je 0x1400c1545
mov r10, qword [rsp + 0x90]
mov qword [rsp + 0xbf], r10
movups xmm0, xmmword [rsp + 0x71]
movups xmm1, xmmword [rsp + 0x81]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov r10b, byte [rsp + 0x9a]
movzx r11d, word [rsp + 0x98]
lea rsi, [rsp + 0x1a8]
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov dword [rsi + 8], esi
Function at 0x1400c32c4
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x38], rcx
mov rbp, qword [rcx]
mov eax, 0xffffffff
xorps xmm6, xmm6
lea rsi, [0x140194a10]
lea r14, [rsp + 0x40]
lea r15, [0x14027a434]

Function at 0x1400c40c5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402730b8]
test ecx, ecx
je 0x1400c40de
dec ecx
add rsp, 0x28
jmp fcn.1401c0bbc
lea rcx, [0x1402730a0]
call fcn.14016c7a0
mov ecx, eax
jmp 0x1400c40d5
Function at 0x1400c4b4f
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.1400c6ba0
test rax, rax
je 0x1400c4b87
mov edx, 4
mov rcx, rax
call fcn.1400322f0
jmp 0x1400c4be9
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x90]
mov rcx, rbx
call fcn.1400c4067
mov rax, qword [rbx]
movups xmm0, xmmword [rbx + 8]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, qword [rbx + 0x28]
mov qword [rsp + 0x40], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
jmp fcn.1400c412d
Function at 0x1400cd87e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402730f8]
test ecx, ecx
je 0x1400cd897
dec ecx
add rsp, 0x28
jmp fcn.1401c0bbc
lea rcx, [0x1402730e0]
call fcn.14016c7a0
mov ecx, eax
jmp 0x1400cd88e
Function at 0x1400d7aef
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov rbx, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x1400d7b63
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x1400d7b32
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400d7ce5
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi + 8]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x1400d7bd0
add rax, r12
cmp qword [rax + 0x10], r8
jne 0x1400d7bd0
mov r14, qword [rax + 8]
xor edx, edx
cmp r8, rdx
je 0x1400d7cd0
mov r9b, byte [r14 + rdx*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x1400d7bd0
mov r9b, byte [r14 + rdx*8 + 5]
cmp r9b, byte [r15 + rdx*8 + 5]
jne 0x1400d7bd0
mov r9d, dword [r14 + rdx*8]
lea r10, [rdx + 1]
cmp r9d, dword [r15 + rdx*8]
mov rdx, r10
je 0x1400d7b9e
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
movabs r14, 0x8000000000000008
lea r13, [rsp + 0x38]
mov rcx, r13
mov rdx, r15
mov rbx, r11
call fcn.1400d7d0d
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, rbx
mov rbx, r14
mov r8, r13
call fcn.1400d7698
mov rdx, qword [rbp]
mov ebp, dword [rbp + 8]
cmp rdx, r14
jne 0x1400d7c7d
mov rdx, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1400d7cfd
movzx edi, word [rsi + 0x20]
mov rsi, qword [rsi + 8]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.1400d75af
mov r14, qword [rsp + 0x28]
mov rax, qword [r14 + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [r14]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], ebp
mov word [rsi + r12 + 0x1c], di
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], ebp
mov qword [rax], rbx
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x5c]
lea rax, [rsp + 0xd4]
mov ecx, 0x1d
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov rdi, qword [rsp + 0x30]
mov qword [rdi], rdx
mov dword [rdi + 8], ebp
add rdi, 0xc
mov ecx, 0x1d
mov rsi, rax
rep movsd dword [rdi], dword [rsi]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rbx]
mov rdx, r15
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400d75af
mov eax, dword [rax + 0x18]
mov dword [rcx + 8], eax
movabs rax, 0x8000000000000008
mov qword [rcx], rax
jmp 0x1400d7cb2
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zerothere_is_no_such_thing_as_a_release_load
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov edx, 0x39
call fcn.140080ec0
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov rcx, rdi
call fcn.14007ffe0
int3