joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401344d0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140134500
xor eax, eax
jmp 0x1401345c3
mov rbp, rbx
cmp word [rax], si
je 0x140134525
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14013450c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140134508
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140132ccc
movsxd r14, eax
test eax, eax
jne 0x140134563
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401344f9
mov rcx, r14
call fcn.14012e6ec
mov rdi, rax
test rax, rax
jne 0x14013457c
xor ecx, ecx
call fcn.14012c86c
jmp 0x140134558
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140132ccc
test eax, eax
jne 0x1401345ad
mov rcx, rdi
call fcn.14012c86c
jmp 0x1401345b7
xor ecx, ecx
call fcn.14012c86c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401345e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140134667
mov rsi, rbx
cmp word [rax], bp
je 0x140134626
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140134610
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14013460c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14012e6ec
mov rdi, rax
test rax, rax
je 0x140134654
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140116d20
mov rbp, rdi
xor ecx, ecx
call fcn.14012c86c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14013b2ec
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14011e730
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14013b376
cmp byte [rbp - 0x21], r15b
je 0x14013b371
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14013b3ac
call fcn.14012cbe8
test eax, eax
jne 0x14013b398
cmp byte [rbp - 0x21], r15b
je 0x14013b390
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14013b3ac
cmp byte [rbp - 0x21], r15b
je 0x14013b3a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140127050
test eax, eax
jne 0x14013b44c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14011e730
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14013b3eb
cmp byte [rbp - 0x21], r15b
je 0x14013b420
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14013b420
call fcn.14012cbe8
test eax, eax
jne 0x14013b40c
cmp byte [rbp - 0x21], r15b
je 0x14013b405
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14013b420
cmp byte [rbp - 0x21], r15b
je 0x14013b41d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140127050
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14013b44c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14013b44f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14013b45d
mov rcx, rdi
call fcn.14012c86c
cmp byte [rbp + 0x3f], r15b
je 0x14013b46c
mov rcx, qword [rbp + 0x27]
call fcn.14012c86c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800041cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180005e59
pop r15
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180005e7d
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
mov rax, 0x60
mov rbx, qword gs:[rax]
mov rax, 0x18
mov rbx, qword [rbx + rax]
mov rax, 0x20
mov rbx, qword [rbx + rax]
mov r12, rbx
mov rdx, qword [rbx + 0x40]
cmp byte [rdx + 0x28], 0x4b
je 0x18000424d
cmp byte [rdx + 0x28], 0x6b
je 0x18000424d
jmp 0x180004293
cmp byte [rdx + 0x30], 0x45
je 0x18000425b
cmp byte [rdx + 0x30], 0x65
je 0x18000425b
jmp 0x180004293
cmp byte [rdx + 0x32], 0x4c
je 0x180004269
cmp byte [rdx + 0x32], 0x6c
je 0x180004269
jmp 0x180004293
cmp byte [rdx + 0x36], 0x32
je 0x180004271
jmp 0x180004293
cmp byte [rdx + 0x3c], 0x4c
je 0x18000427f
cmp byte [rdx + 0x3c], 0x6c
je 0x18000427f
jmp 0x180004293
cmp byte [rdx + 0x3e], 0x4c
je 0x18000428d
cmp byte [rdx + 0x3c], 0x6c
je 0x18000428d
jmp 0x180004293
mov rbx, qword [rbx + 0x20]
jmp 0x18000429b
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x18000423b
mov qword [rbp - 8], rbx
xor r8, r8
mov r8d, dword [rbx + 0x3c]
mov rdx, r8
add rdx, rbx
mov r8d, dword [rdx + 0x88]
add r8, rbx
xor rsi, rsi
mov esi, dword [r8 + 0x20]
add rsi, rbx
xor rcx, rcx
movabs r9, 0x17f7294a554669b
movabs rax, 0x3fe3fcddab1ffeac
add r9, rax
inc rcx
xor rax, rax
mov eax, dword [rsi + rcx*4]
add rax, rbx
cmp qword [rax], r9
jne 0x1800042da
xor rsi, rsi
mov esi, dword [r8 + 0x24]
add rsi, rbx
mov cx, word [rsi + rcx*2]
xor rsi, rsi
Function at 0x18000420c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180005e59
pop r15
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180005e7d
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
mov rax, 0x60
mov rbx, qword gs:[rax]
mov rax, 0x18
mov rbx, qword [rbx + rax]
mov rax, 0x20
mov rbx, qword [rbx + rax]
mov r12, rbx
mov rdx, qword [rbx + 0x40]
cmp byte [rdx + 0x28], 0x4b
je 0x18000424d
cmp byte [rdx + 0x28], 0x6b
je 0x18000424d
jmp 0x180004293
cmp byte [rdx + 0x30], 0x45
je 0x18000425b
cmp byte [rdx + 0x30], 0x65
je 0x18000425b
jmp 0x180004293
cmp byte [rdx + 0x32], 0x4c
je 0x180004269
cmp byte [rdx + 0x32], 0x6c
je 0x180004269
jmp 0x180004293
cmp byte [rdx + 0x36], 0x32
je 0x180004271
jmp 0x180004293
cmp byte [rdx + 0x3c], 0x4c
je 0x18000427f
cmp byte [rdx + 0x3c], 0x6c
je 0x18000427f
jmp 0x180004293
cmp byte [rdx + 0x3e], 0x4c
je 0x18000428d
cmp byte [rdx + 0x3c], 0x6c
je 0x18000428d
jmp 0x180004293
mov rbx, qword [rbx + 0x20]
jmp 0x18000429b
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x18000423b
mov qword [rbp - 8], rbx
xor r8, r8
mov r8d, dword [rbx + 0x3c]
mov rdx, r8
add rdx, rbx
mov r8d, dword [rdx + 0x88]
add r8, rbx
xor rsi, rsi
mov esi, dword [r8 + 0x20]
add rsi, rbx
xor rcx, rcx
movabs r9, 0x17f7294a554669b
movabs rax, 0x3fe3fcddab1ffeac
add r9, rax
inc rcx
xor rax, rax
mov eax, dword [rsi + rcx*4]
add rax, rbx
cmp qword [rax], r9
jne 0x1800042da
xor rsi, rsi
mov esi, dword [r8 + 0x24]
add rsi, rbx
mov cx, word [rsi + rcx*2]
xor rsi, rsi

Function at 0x1800049e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, 3
add al, 0x61
mov byte [r14 + 3], al
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180004293
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18000425b
inc rcx
test rcx, rcx
je 0x180004dfa
pop rcx
mov al, 4
add al, 0x42
mov byte [r14 + 4], al
mov al, 0x59
add al, 0x10
mov byte [r14 + 5], al
mov al, 0x32
add al, 0x3a
mov byte [r14 + 6], al
mov al, 0xf
add al, 0x56
mov byte [r14 + 7], al
mov byte [r14 + 8], 0
mov rcx, r15
mov rdx, r14
sub rsp, 0x20
lea rax, [0x180004a39]
push rax
jmp r13
add rsp, 0x20
add rsp, 0x200
mov qword [rbp - 0x20], rax
mov rdi, r12
mov al, 0x3f
add al, 0x17
mov byte [rdi], al
mov al, 0x30
add al, 0x39
mov byte [rdi + 1], al
mov al, 0x66
add al, 0xc
mov byte [rdi + 2], al
mov al, 0x4e
add al, 0x26
mov byte [rdi + 3], al
mov al, 0x20
add al, 0x55
mov byte [rdi + 4], al
mov al, 0x5b
add al, 6
mov byte [rdi + 5], al
mov al, 0x23
add al, 0x49
mov byte [rdi + 6], al
mov al, 0x1a
add al, 0x36
mov byte [rdi + 7], al
mov al, 0x28
add al, 0x4a
mov byte [rdi + 8], al
mov al, 0x1a
add al, 0x55
mov byte [rdi + 9], al
mov al, 0x3c
add al, 0x38
mov byte [rdi + 0xa], al
mov al, 0x13
add al, 0x52
mov byte [rdi + 0xb], al
mov al, 0x55
add al, 0xe
mov byte [rdi + 0xc], al
mov al, 1
add al, 0x73
mov byte [rdi + 0xd], al
mov byte [rdi + 0xe], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
lea rax, [0x180004e86]
push rax
jmp r13
Function at 0x180004fc0
Capabilities:
Parse pe header

Disassembly:
add al, 0x1a
mov byte [rdi + 0xb], al
mov byte [rdi + 0xc], 0
mov rcx, qword [rbp - 0x80]
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xd0], rax
add rsp, 0x100
mov rcx, 0
mov rdx, 0xf4240
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
mov rax, qword [rbp - 0xd0]
call rax
add rsp, 0x20
mov r14, rax
mov rdi, r14
add rdi, 0x2710
mov al, 0x20
add al, 0x2f
mov byte [rdi], al
mov byte [rdi + 1], 0
mov al, 0xb
add al, 0x57
mov byte [rdi + 2], al
mov byte [rdi + 3], 0
mov al, 0xc
add al, 0x5e
mov byte [rdi + 4], al
mov byte [rdi + 5], 0
mov al, 0xc
add al, 0x59
mov byte [rdi + 6], al
mov byte [rdi + 7], 0
mov al, 0xa
add al, 0x59
mov byte [rdi + 8], al
mov byte [rdi + 9], 0
mov al, 0x2c
add al, 0x48
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], 0
mov al, 7
add al, 0x45
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], 0
mov al, 0x4c
add al, 0x19
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], 0
mov al, 0x59
add al, 0x15
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], 0
mov al, 0x19
add al, 0x4e
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], 0
mov al, 0x2d
add al, 0x47
mov byte [rdi + 0x14], al
mov byte [rdi + 0x15], 0
mov al, 0x59
add al, 0xf
mov byte [rdi + 0x16], al
mov byte [rdi + 0x17], 0
mov byte [rdi + 0x18], 0
mov byte [rdi + 0x19], 0
mov byte [rdi + 0x1a], 0
mov byte [rdi + 0x1b], 0
mov qword [rbp - 0xf0], rdi
add rdi, 0x64
mov al, 0x3c
add al, 6
mov byte [rdi], al
mov byte [rdi + 1], 0
mov al, 0x4f
add al, 0x1d
mov byte [rdi + 2], al
mov byte [rdi + 3], 0
mov al, 0x40
add al, 0x2f
mov byte [rdi + 4], al
mov byte [rdi + 5], 0
mov al, 0x3c
add al, 0x27
mov byte [rdi + 6], al
mov byte [rdi + 7], 0
mov al, 0x66
add al, 5
mov byte [rdi + 8], al
mov byte [rdi + 9], 0
mov al, 0x28
add al, 0x24
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], 0
mov al, 0x2a
add al, 0x3b
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], 0
mov al, 0x6c
add al, 2
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], 0
mov al, 0x61
add al, 6
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], 0
mov al, 0x63
add al, 0x11
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], 0
mov al, 0x42
add al, 0x26
mov byte [rdi + 0x14], al
mov byte [rdi + 0x15], 0
mov byte [rdi + 0x16], 0
mov byte [rdi + 0x17], 0
mov byte [rdi + 0x18], 0
mov byte [rdi + 0x19], 0
mov qword [rbp - 0xf8], rdi
add rdi, 0x64
mov al, 0x36
add al, 0xd
mov byte [rdi], al
mov byte [rdi + 1], 0
mov al, 0x39
add al, 0x2f
mov byte [rdi + 2], al
mov byte [rdi + 3], 0
mov al, 1
add al, 0x60
mov byte [rdi + 4], al
mov byte [rdi + 5], 0
mov al, 0x53
add al, 0x16
mov byte [rdi + 6], al
mov byte [rdi + 7], 0
mov al, 0x66
add al, 8
mov byte [rdi + 8], al
mov byte [rdi + 9], 0
mov al, 0xd
add al, 0x5c
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], 0

Function at 0x180005638
Capabilities:
Parse pe header

Disassembly:
call rax
add rsp, 0x20
mov qword [rbp - 0x98], rax
Function at 0x180005914
Capabilities:
Parse pe header

Disassembly:
add al, 0x4e
mov byte [rdi + 8], al
mov al, 0x19
add al, 0x5a
pop rdx
mov byte [rdi + 9], al
mov al, 0x3e
add al, 0x27
mov byte [rdi + 0xa], al
mov al, 0x2c
add al, 0x15
mov byte [rdi + 0xb], al
mov al, 0xe
add al, 0x5e
mov byte [rdi + 0xc], al
mov al, 0x47
add al, 0x20
mov byte [rdi + 0xd], al
mov al, 0x30
add al, 0x3f
mov byte [rdi + 0xe], al
mov al, 0x55
add al, 0x1d
mov byte [rdi + 0xf], al
mov al, 0x23
add al, 0x46
mov byte [rdi + 0x10], al
mov al, 0x62
add al, 0x12
mov byte [rdi + 0x11], al
mov al, 0x3a
add al, 0x2e
mov byte [rdi + 0x12], al
mov al, 0x60
add al, 0xd
mov byte [rdi + 0x13], al
mov al, 2
add al, 0x4e
mov byte [rdi + 0x14], al
mov al, 0x6a
add al, 8
mov byte [rdi + 0x15], al
mov al, 0x4b
add al, 0x24
mov byte [rdi + 0x16], al
mov al, 0x4b
add al, 0x2b
mov byte [rdi + 0x17], al
mov al, 0x28
add al, 0x41
mov byte [rdi + 0x18], al
mov al, 0x1f
add al, 0x45
mov byte [rdi + 0x19], al
mov al, 8
add al, 0x5d
mov byte [rdi + 0x1a], al
mov al, 0x44
add al, 0x2e
mov byte [rdi + 0x1b], al
mov byte [rdi + 0x1c], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
invalid
Function at 0x14000ef90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000f020
cmp r10, r11
jb 0x14000f096
cmp r10, rdx
ja 0x14000f0aa
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000f022
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000f000
jmp 0x14000f084
ja 0x14000f02a
mov r11, r10
cmp rax, r8
jne 0x14000efc4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000f060
mov rdi, r8
sub ecx, edx
jns 0x14000f07b
jmp 0x14000f086
cmp r8, rsi
je 0x14000f0bb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000f086
xor al, 1
cmp rdi, rsi
jne 0x14000f040
jmp 0x14000f086
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400bd460
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400bd1d0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400bd250
ud2
Function at 0x140011c66
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x1400c5588]
mov ebx, 0xff
lea rsi, str.C:Usersmdool.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x140011d96
mov r14d, 4
sub r14, 1
jb 0x140011c8b
cmp r9, 0xf
jbe 0x140011dc3
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.1400122b6
mov r9, rdx
mov ecx, ebp
jmp 0x140011c9b
xor edx, edx
cmp r9, rdx
je 0x140011db4
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140011d98
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Usersmdool.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.1400bd0d0
ud2
Function at 0x14001549e
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.1400154e9
test rbx, rbx
je 0x1400154d7
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140015514
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14001550c

Function at 0x140015514
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14001553a
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140015524
mov qword [rcx], rax
ret
Function at 0x140036e7b
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x140131d50]
test r14, r14
jne 0x140036fb2
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140036ee5
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140036ee5
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140036ee5
mov r15, rax
xor ebx, ebx
jmp 0x140036f6a
lea rcx, [0x1400f2a68]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140036fc6
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140036fc6
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140036fc6
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140036fc6
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140036fc6
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.140015353
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x140131d50], r14
je 0x140036fb2
mov rdi, rax
cmp qword [r14], 0
je 0x140036fa2
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.140006780
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Usersmdool.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x1400f2b70]
mov edx, 0x5b
call fcn.1400be47a
ud2
Function at 0x140051a3c
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str.C:Usersmdool.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.140050852
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140051b1a
test eax, eax
je 0x140051b36
cmp eax, 0x90317
je 0x140051bae
cmp eax, 0x90321
jne 0x140051bb6
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400519dc
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x140051bc4
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140051bb2
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.140051bd8
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.140007c82
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400519dc
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140051bc4
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140051bc4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x140051e71
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
lea r9, str.C:Usersmdool.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.140050852
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140051f55
test eax, eax
je 0x140051f74
cmp eax, 0x90317
je 0x140051ff5
cmp eax, 0x90321
jne 0x140051ffd
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140051e11
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x14005200b
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x140051ff9
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.140051bd8
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.140007c82
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140051e11
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x14005200b
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14005200b
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret