joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e80e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1401e816a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401e8160
cmp r11, r10
ja 0x1401e81e6
cmp r10, rdx
ja 0x1401e81f8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1401e8162
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401e8140
jmp 0x1401e81c7
ja 0x1401e816a
mov r11, r10
cmp rax, r8
jne 0x1401e8107
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1401e81cb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401e81a0
mov r8, r10
sub ecx, r9d
jns 0x1401e81be
jmp 0x1401e81cd
cmp r10, rdx
je 0x1401e81da
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401e81cd
xor al, 1
cmp r8, rdx
jne 0x1401e8180
jmp 0x1401e81cd
xor eax, eax
jmp 0x1401e81cd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1401f7230
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401f7870
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401f7800
int3

Function at 0x1401eb4b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401eb4fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401eb4fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401eb4fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401eb4fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1401eb4fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401eb4fc
xor al, al
add rsp, 0x28
ret
Function at 0x1401f5410
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, [0x14028acad]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401f5471
mov rdi, rax
lea rdx, [0x14028acce]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401f5471
mov rsi, rax
lea rdx, [0x14028acdc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401f5471
mov rdi, rax
xor ebx, ebx
jmp 0x1401f54f7
lea rcx, [0x14028ac68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401f556b
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401f556b
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401f556b
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401f556b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1401f556b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x14030a0c1]
mov ecx, 0x18
mov edx, 8
call fcn.140039d90
test rax, rax
je 0x1401f5570
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x14030a120], rcx
je 0x1401f555f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x1401f5548
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.140039da0
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1401f5140
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.1401f7060
ud2
Function at 0x1401f6030
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1401dacd0
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1401f60b9
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1401f60ec
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401f6100
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1401f6120
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140039da0
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401f6120
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140039da0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005440]
mov dword [rax], 1
mov rax, qword [0x140005450]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x1400053c0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001db0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002a82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400093c8]
test eax, eax
je 0x140002b1a
lea rax, [0x1400093a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400093d0]
mov qword [rbp - 8], rax
jmp 0x140002afe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002af2
cmp qword [rbp - 0x10], 0
je 0x140002af2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002ab8
lea rax, [0x1400093a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002b1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002c20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002c48
mov eax, 0
jmp 0x140002c96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002c71
mov eax, 0
jmp 0x140002c96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002c91
mov eax, 0
jmp 0x140002c96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140002c9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002d1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002d11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002d11
mov rax, qword [rbp - 8]
jmp 0x140002d2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002ce4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x5a7180
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x5a71c2
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x5a7193
nop
ret

Function at 0x140003980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400039ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400039ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400039ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400039ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400039cc
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1405179a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1405179b0]
mov dword [rax], 1
mov rax, qword [0x1405179c0]
mov dword [rax], 1
mov rax, qword [0x140517940]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140517990]
mov dword [0x14054400c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140517a70]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140517a50]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1405178f0]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140010891
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1401536bc
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
call sym.core::ptr::drop_in_place_alloc::boxed::Box_std::sys::thread_local::os::Value_usize___::h7e97fe99a60def90
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1401536bc

Function at 0x1400108c5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp rdx, 1
je 0x14001095e
mov esi, ecx
test r8, r8
je 0x1400108f5
mov rax, qword [r8]
and qword [r8], 0
test rax, rax
je 0x1400108f5
mov rbx, qword [r8 + 8]
mov r14, qword [r8 + 0x10]
jmp 0x140010914
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov edx, 0x10
mov rcx, rdi
call sub.bcryptprimitives.dll_ProcessPrng
mov rbx, qword [rdi]
mov r14, qword [rdi + 8]
mov ecx, 0x18
mov edx, 8
call fcn.140017763
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call fcn.1401536bc
test rbx, rbx
je 0x140010960
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call sym.__rust_dealloc
jmp 0x140010960
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001096d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp rdx, 1
je 0x1400109e6
mov esi, ecx
test r8, r8
je 0x140010993
mov rax, qword [r8]
and qword [r8], 0
test rax, rax
je 0x140010993
mov rbx, qword [r8 + 8]
jmp 0x1400109a6
mov ebx, 1
lock xadd qword [0x140156010], rbx
test rbx, rbx
je 0x1400109f3
mov ecx, 0x10
mov edx, 8
call fcn.140017763
mov rdi, rax
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call fcn.1401536bc
test rbx, rbx
je 0x1400109e8
lea rcx, [rsp + 0x20]
mov qword [rcx], rbx
call sym.core::ptr::drop_in_place_alloc::boxed::Box_std::sys::thread_local::os::Value_usize___::h7e97fe99a60def90
jmp 0x1400109e8
xor edi, edi
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, [0x1404771f0]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_srcutilpool.rsC:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_srcutilprefilter_byteset.rs
call sym.core::panicking::panic_fmt::ha3b6c343273f2b7f
int3
Function at 0x140010a26
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, dword [rcx + 0x18]
test edi, edi
je 0x140010a5f
dec edi
mov ecx, edi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140010a4c
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, edi
mov rdx, rax
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::thread_local::os::Storage_T_::try_initialize::ha5715611231696c7
call sym.std::sys::thread_local::key::windows::LazyKey::init::hb0cf5420da7d30f0
mov edi, eax
jmp 0x140010a38

Function at 0x140010a68
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, dword [rcx + 0x18]
test edi, edi
je 0x140010aa1
dec edi
mov ecx, edi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140010a8e
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, edi
mov rdx, rax
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::thread_local::os::Storage_T_::try_initialize::h6c216e5cb237768c
call sym.std::sys::thread_local::key::windows::LazyKey::init::hb0cf5420da7d30f0
mov edi, eax
jmp 0x140010a7a
Function at 0x14003d72a
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r14, r8
mov rsi, rdx
mov rbx, rcx
movabs rcx, 0x100000001b3
mov r15, qword [rdx + 8]
mov r8, qword [r8 + 8]
mov r9, qword [r14 + 0x10]
lea rdx, [r9*8]
movabs rax, 0xcbf29ce484222325
mov r10, r8
test rdx, rdx
je 0x14003d7a2
movzx r11d, byte [r10 + 4]
xor rax, r11
imul rax, rcx
movzx r11d, byte [r10 + 5]
xor r11, rax
mov eax, dword [r10]
add r10, 8
imul r11, rcx
xor rax, r11
imul rax, rcx
add rdx, 0xfffffffffffffff8
jmp 0x14003d771
mov rcx, qword [r15 + 0x10]
test rcx, rcx
je 0x14003d8c4
xor edx, edx
div rcx
mov rdi, rdx
mov r13, qword [r15 + 8]
mov r12, rdx
shl r12, 5
movzx eax, word [r13 + r12 + 0x1c]
cmp ax, word [r15 + 0x20]
jne 0x14003d7fc
add r13, r12
mov rcx, qword [r13 + 8]
mov rdx, qword [r13 + 0x10]
call sym.___A__as_core::slice::cmp::SlicePartialEq_B__::equal::h25ee9b1f846843a3
test al, al
je 0x14003d7fc
mov eax, dword [r13 + 0x18]
mov dword [rbx + 8], eax
movabs rax, 0x8000000000000008
mov qword [rbx], rax
jmp 0x14003d8a5
mov rsi, qword [rsi]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call sym.__alloc::vec::Vec_T_A__as_core::clone::Clone_::clone::hdfb4a18eb4fa1cec
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0xa0]
mov rdx, rsi
call sym.regex_automata::nfa::thompson::builder::Builder::add_sparse::h85f960619decdb87
movabs rsi, 0x8000000000000008
mov rax, qword [rsp + 0x20]
mov ebp, dword [rsp + 0x28]
cmp rax, rsi
jne 0x14003d88f
movzx eax, word [r15 + 0x20]
mov word [rsp + 0x3c], ax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ebp
mov rdx, qword [r15 + 0x10]
cmp rdx, rdi
jbe 0x14003d8d2
mov rdi, qword [r15 + 8]
lea rcx, [rdi + r12]
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h3b6c92bc1e31393c
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + r12 + 0x10], xmm1
movups xmmword [rdi + r12], xmm0
mov dword [rbx + 8], ebp
mov qword [rbx], rsi
jmp 0x14003d8ad
lea rsi, [rsp + 0x2c]
lea rdi, [rbx + 0xc]
mov ecx, 0x1d
rep movsd dword [rdi], dword [rsi]
mov qword [rbx], rax
mov dword [rbx + 8], ebp
mov rcx, r14
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h3b6c92bc1e31393c
mov rax, rbx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_src_nfa_thompsonmap.rsX_G_
call sym.core::panicking::panic_const::panic_const_rem_by_zero::h1ae03c333c2fc735
jmp 0x14003d8e1
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_src_nfa_thompsonmap.rsX_G_
mov rcx, rdi
call sym.core::panicking::panic_bounds_check::h89dd6d9d6cc5b8cb
ud2
Function at 0x14009e4f2
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rsp + 0x20]
and qword [rdi], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x14009e52f
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14009e54e
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h0b3c5de801d331aa
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14009e87a
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1401536bc
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
call sym._ZN4core3ptr246drop_in_place_LT_alloc..boxed..Box_LT_std..sys..thread_local..os..Value_LT_alloc..rc..Rc_LT_core..cell..UnsafeC
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1401536bc

Function at 0x14009e8ae
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1d0
cmp rdx, 1
je 0x14009e96f
mov esi, ecx
test r8, r8
je 0x14009e8d5
mov rbx, qword [r8]
and qword [r8], 0
test rbx, rbx
jne 0x14009e926
lea rdi, [rsp + 0x70]
mov rcx, rdi
call sym.rand_core::SeedableRng::from_rng::h337ef21df2c5a48a
cmp qword [rdi], 0
jne 0x14009e97f
lea rdi, [rsp + 0x70]
movaps xmm0, xmmword [rdi + 0x10]
movaps xmm1, xmmword [rdi + 0x20]
movaps xmm2, xmmword [rdi + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
mov r8d, 0x10000
mov rcx, rdi
call sym.rand::rngs::adapter::reseeding::ReseedingRng_R_Rsdr_::new::h475efb9f27e63ec8
mov rcx, rdi
call sym.alloc::rc::Rc_T_::new::h3438ac6416fab5cc
mov rbx, rax
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], esi
mov ecx, 0x10
mov edx, 8
call fcn.14009ec92
mov rdi, rax
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call fcn.1401536bc
test rbx, rbx
je 0x14009e971
lea rcx, [rsp + 0x70]
mov qword [rcx], rbx
call sym._ZN4core3ptr246drop_in_place_LT_alloc..boxed..Box_LT_std..sys..thread_local..os..Value_LT_alloc..rc..Rc_LT_core..cell..UnsafeC
jmp 0x14009e971
xor edi, edi
mov rax, rdi
add rsp, 0x1d0
pop rbx
pop rdi
pop rsi
ret
movups xmm0, xmmword [rsp + 0x78]
lea rax, [rsp + 0x20]
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
lea rax, [0x1404d78c0]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov eax, 1
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea r8, [sym.__rand_core::error::Error_as_core::fmt::Display_::fmt::h8c28f0cccc683c8c]
mov qword [rdx + 8], r8
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
lea rdx, str.0xM_
call sym.core::panicking::panic_fmt::ha3b6c343273f2b7f
ud2
Function at 0x14009e9fc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, dword [rcx + 0x18]
test edi, edi
je 0x14009ea35
dec edi
mov ecx, edi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14009ea22
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, edi
mov rdx, rax
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::thread_local::os::Storage_T_::try_initialize::h0799dfb36e4fd717
call sym.std::sys::thread_local::key::windows::LazyKey::init::hb0cf5420da7d30f0
mov edi, eax
jmp 0x14009ea0e

Function at 0x14009f0a5
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x14009f0c4
cmp qword [rcx + 0x40], 0
js 0x14009f0c4
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp sym.__rand_chacha::chacha::ChaCha12Core_as_rand_core::block::BlockRngCore_::generate::hfdf59d68cfb7b70e
xor r8d, r8d
jmp sym.rand::rngs::adapter::reseeding::ReseedingCore_R_Rsdr_::reseed_and_generate::hf50d0ff0ccc81ec6

Function at 0x14009f16b
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call sym.rand::rngs::adapter::reseeding::ReseedingCore_R_Rsdr_::reseed::he6a8e4e3244b62bc
test rax, rax
je 0x14009f196
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call sym._ZN4core3ptr118drop_in_place_LT_alloc..boxed..Box_LT_dyn_u20_core..error..Error_u2b_core..marker..Send_u2b_core..marker..Sync_
mov qword [rdi + 0x40], rbx
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp sym.__rand_chacha::chacha::ChaCha12Core_as_rand_core::block::BlockRngCore_::generate::hfdf59d68cfb7b70e