joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400682ba
Capabilities:
Encode data using xor

Disassembly:
lea edx, [rsp - 0x7d]
mov qword [rsp + 0x38], rdx
pushfq
jl 0x1400682eb
xor byte [rax - 0x77], cl
pop rsp
movsd dword [rdi], dword [rsi]
ror byte [rax - 0x77], 1
jl 0x1400682f5
and byte [rdx - 0x7fffffff], bh
mov qword [r15], rsp
call fcn.140030f80
invalid
adc ecx, dword [rax - 0x75]
add byte [rbx - 0x3d7cafc0], cl
or dword [rsi - 0x7cff23f8], edi
mov esi, 0x8300dc08
cmovge esi, eax
jmp 0x140068304
mov rsp, r14
and al, 0xb0
add byte [rax], al
add byte [rax + 0x47], cl
leave
je 0x140068381
sbb byte [r13 + 0x490f74c0], r8b
mov edx, dword [rsp + 0x90]
test qword [rbx - 0x74b7f98c], rbp
adc cl, bl
or qword [rcx], 0xfffffffffffffff8
jmp 0x140068333
fld xword [rsi]
or byte [r9 - 0x7d], r8b
sar bl, 0x49
mov edx, dword [rbp - 0x30]
add rdx, 5
mov rbp, qword [rcx]
mov dword [rsp + 0x28], eax
lea ax, [rsp + 0x60]
mov qword [rbp + 0x7dc35cbd], rax
int 0x24
jo 0x140068359
call qword [rbp + 0x4f]
mov qword [r13 + 8], 0x155d43
push rbp
mov qword [r13 + 8], 0x155d43
movsxd r8, dword [rax + rax*2 + 0x60]
mov rdx, qword [rsp + 0x70]
lea rcx, [r13 + 0x60]
call fcn.140042af0
jne 0x14006839f
invalid
jo 0x140068365
ud0
adc eax, 0x8e248c8b
add byte [rax], al
cli
test rcx, rcx
je 0x1400683a2
xor eax, eax
fdivr dword [r12 + 0x98]
add byte [rdi], cl
xchg esp, eax
out 0x48, eax
loopne 0x1400683ba
sbb bh, cl
stc
sub edi, dword [rax + 0xee04]
mov eax, 0xee04
add rdx, r9
sbb ecx, dword [rax - 0x77]
ret 0xc148
add al, 0x31
sal bh, cl
test byte [rax - 0x77], 0xf0
sub rax, rdx
test al, 0x89
js 0x140068411
in eax, dx
invalid
outsb dx, byte [rsi]
mov eax, dword [rcx]
mov bl, pe_nt_image_headers64
mov bh, 0xeb
add eax, dword [rbp - 0x78]
pop rsp
jmp 0x14006841d
xchg r12, rax
jge 0x140068429
test ebx, ebx
cmp eax, 0x758d491c
invalid
xor esp, ecx
nop dword [rax + rax]
xchg cl, sil
xor edx, edx
push rsp
cmpsw word [rsi], word [rdi]
cld
test dword [rbx - 0x22c6fec6], eax
jl 0x140068418
movsxd rdx, ebx
fsub qword [rbx - 0x31]
test dword [rbx], eax
and r8b, r13b
sar byte [rsi + 0x68], 1
dec dword [rcx + 0x2a]
xor esp, dword [rax]
mov byte [rax + 0x18], bl
add dword [r14 + 0x20458b49], ecx
loopne 0x140068452
bswap ecx
mov dword [rax], ecx
xlatb
mov ecx, dword [rcx + rdi*2 + 0x8788]
test rcx, rcx
je 0x140068490
mov rax, qword [rcx]
test byte [rax + 0x5c], 2
je 0x140068490
mov r9d, dword [r12 + 0x80]
mov rsi, qword [r9]
and ah, al
stosd dword [rdi], eax
add al, 0
add bh, bh
push rax
xor byte [rcx], al
sti
add ebx, edi
sbb al, 0x4d
invalid
Function at 0x14006db90
Capabilities:
Encode data using xor

Disassembly:
push r15
jb 0x14006dbea
push r12
push rsi
push rdi
push rbp
pop rsp
sub rsp, 0x28
mov r13, r9
pop qword [rbp - 0x2876b73b]
mov rbx, rcx
mov r15, qword [rcx + rdx + 0x960090]
mov r14, qword [rdx + rax*2 + 0xc1a0]
mov ecx, 0x600001
mov edx, 0x622eb0
xor dword [r15], r8d
adc eax, 0x34fd0822
mov rsi, rax
mov r8d, 0x5b0
mov rcx, rax
invalid
imul esp, dword [rcx + 0x4800087e], 0xffffff89
xchg cl, ch
rol byte [rax], cl
cld
mov rcx, rbx
call 0xcc041250
mov qword [rsi + 0x98], rax
or cl, byte [rcx - 0x386c1707]
std
dec dword [rax - 0x27]
or dword [rax - 0x76820000], esp
scasb al, byte [rdi]
test al, 0
add byte [rax], al
cmp al, 0x4a
jmp 0x13dce5aa6

Function at 0x140085280
Capabilities:
Create pipe

Disassembly:
push rsi
sub esp, 0x20
test rcx, rcx
je 0x1400852c9
lodsq rax, qword [rsi]
invalid
add byte [rdi], cl
sub dword [rsp + 0x28ff24], esi
test eax, 0x8948d789
invalid

Function at 0x140090f90
Capabilities:
Encode data using xor

Disassembly:
xchg byte [r15], bl
push rsi
push rsi
push rdi
push rbp
xchg ebp, eax
sub rsp, 0x68
mov qword [rax - 0x763976bb], r14
ror dword [rax - 0x6b], cl
insd dword [rdi], dx
mov r15, qword [rdi + rcx*8 + 0xdf]
inc qword [0x14012a05d]
xor rax, rsp
and al, 0x60
lea rbp, [rdx]
and al, 0x30
fisttp dword [rbx + 0x498b4945]
movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x30], rax
mov qword [rcx - 0x38b7bfdc], rdx
invalid
Function at 0x140001d30
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14002d738], rbx
je 0x140001d97
cmp rax, rbx
jne 0x140001d8a
mov ebx, 1
mov esi, ebx
jmp 0x140001d9c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001d6f
mov ebx, 1
mov eax, dword [0x14002d740]
cmp eax, ebx
jne 0x140001db4
mov edi, 0x1f
mov ecx, edi
call fcn.1400c0000
jmp 0x140001e2a
mov eax, dword [0x14002d740]
test eax, eax
jne 0x140001e1f
mov dword [0x14002d740], ebx
lea r15, [0x14001f718]
lea rdi, [0x14001f700]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140001e11
test eax, eax
jne 0x140001e15
cmp qword [rdi], r14
je 0x140001e06
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x14001f658]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140001dde
test eax, eax
je 0x140001e25
mov eax, 0xff
jmp 0x140001f8a
mov dword [0x14002cff0], ebx
mov edi, 0x1f
mov eax, dword [0x14002d740]
cmp eax, ebx
jne 0x140001e51
lea rdx, [0x14001f6f8]
lea rcx, [0x14001f668]
call sub.msvcrt.dll__initterm
mov dword [0x14002d740], 2
test esi, esi
jne 0x140001e5f
mov rax, r14
xchg qword [0x14002d738], rax
cmp qword [0x14002d758], r14
je 0x140001e9c
lea rcx, [0x14002d758]
call fcn.140002440
test eax, eax
je 0x140001e9c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14002d758]
mov r9, qword [0x14001f658]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140001eb5
mov eax, 0xff
jmp 0x140001f8a
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140001f3b
test ax, ax
je 0x140001ed0
test edx, edx
jne 0x140001f3b
sub ax, bx
cmp ax, di
ja 0x140001ee6
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140001ed0
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140005e98
mov dword [0x14002cfec], eax
cmp dword [0x14002d010], r14d
jne 0x140001f24
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14002cff0], r14d
jne 0x140001f39
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14002cfec]
jmp 0x140001f8a
cmp ax, 0x22
jne 0x140001f4f
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140001ebe
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400024d4
add rsp, 0x28
jmp 0x140001d30
Function at 0x1400018a0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400018f2
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000198b
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140001981
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001900
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.e_31m
call fcn.140001690
mov rcx, rax
lea rdx, str._Error_
call fcn.140001690
mov rcx, rax
lea rdx, str.e_0m
call fcn.140001690
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x14000198b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400019c0
add rsp, 0x270
pop rbx
ret

Function at 0x140002288
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022d4
xor al, al
add rsp, 0x28
ret
Function at 0x140006d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14029b128]
test ecx, ecx
je 0x140006d2d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140006d46
cmp qword [rax + 8], 0
je 0x140006d46
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029b110]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x140006d1c
mov ecx, dword [0x14029b128]
test ecx, ecx
je 0x140006ded
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140006e0a
mov rsi, rax
test rax, rax
jne 0x140006dd3
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140006d98
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140006e22
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140006e22
mov rsi, rax
lea rax, [0x14029b110]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14029b128]
test ecx, ecx
je 0x140006e12
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rax, [rsi + 0x10]
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029b110]
call fcn.140242d30
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140006d65
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029b110]
call fcn.140242d30
mov ecx, eax
jmp 0x140006dcb
mov ecx, 8
mov edx, 0x18
call fcn.1400a81e0
int3
Function at 0x140012660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x140013110
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x120
mov rcx, qword [rcx]
mov rax, qword [rcx]
mov qword [rcx], 0
test rax, rax
je 0x140013372
mov rsi, qword [rax]
lea rax, [0x14029d645]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
movabs rdx, 0xb400e39b3628f72f
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x20]
call fcn.14002f9f0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x90], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1402abc2f]
nop word cs:[rax + rax]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x28], r8
add rcx, 8
cmp rcx, 0x70
jb 0x1400131b0
movzx eax, byte [rax + 0x78]
xor al, 0x96
mov byte [rsp + 0x98], al
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xc0], xmm2
movaps xmmword [rsp + 0xd0], xmm3
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x100], xmm0
mov rax, qword [rsp + 0x89]
mov qword [rsp + 0x109], rax
mov eax, dword [rsp + 0x91]
mov dword [rsp + 0x111], eax
movzx eax, word [rsp + 0x95]
mov word [rsp + 0x115], ax
movzx eax, byte [rsp + 0x97]
mov byte [rsp + 0x117], al
movzx eax, byte [rsp + 0x98]
mov byte [rsp + 0x118], al
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400132ab
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140013363
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x79
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140013363
movups xmm0, xmmword [rsp + 0x109]
movups xmmword [rax + 0x69], xmm0
movaps xmm0, xmmword [rsp + 0x100]
movups xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0xe0]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movaps xmm3, xmmword [rsp + 0xd0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsi], 0x79
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x79
shl rcx, 1
test rcx, rcx
jne 0x14001334b
add rsp, 0x120
pop rsi
ret
mov rcx, qword [0x1403ac160]
xor edx, edx
call fcn.14029804c
nop
add rsp, 0x120
pop rsi
ret
mov ecx, 1
mov edx, 0x79
call fcn.1400a81e0
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._j6_
mov edx, 0x2b
call fcn.1400abba0
int3
Function at 0x1400223b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x140022446
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14029c2f0]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14029c300]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010f060
test rdi, rdi
je 0x1400224c6
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400224df
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400225d7
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140022658
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x1400225e4
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x1400224a0
add r8, rcx
cmp r9, 8
jae 0x1400225ed
jmp 0x140022658
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010f060
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140022658
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140022658
mov r8, rcx
cmp r9, 8
jb 0x140022658
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400225f0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14002cc90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x590
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14002cca0
test al, 1
je 0x14002cd50
test al, 2
jne 0x14002cd68
test al, 8
jne 0x14002cce1
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
call fcn.14002c6e0
jmp 0x14002ccff
test al, 0x10
je 0x14002ccff
mov rax, qword [rsi + 0x580]
test rax, rax
je 0x14002cdec
mov rcx, qword [rsi + 0x588]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402832e0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14002cd80
jne 0x14002cd46
mov rcx, rsi
add rsp, 0x590
pop rsi
jmp fcn.14002ca50
nop
add rsp, 0x590
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14036d3f8]
mov edx, 0x23
call fcn.1400abba0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14036d438]
mov edx, 0x25
call fcn.1400abba0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400aaf80]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x14036d480]
lea rcx, [rsp + 0x50]
call fcn.1400aae40
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str._home_hj_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x50]
call fcn.1400aae40
int3
Function at 0x14002ce30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x590
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14002ce40
test al, 1
je 0x14002cef0
test al, 2
jne 0x14002cf08
test al, 8
jne 0x14002ce81
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
call fcn.14002c6e0
jmp 0x14002ce9f
test al, 0x10
je 0x14002ce9f
mov rax, qword [rsi + 0x580]
test rax, rax
je 0x14002cf8c
mov rcx, qword [rsi + 0x588]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140281870
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14002cf20
jne 0x14002cee6
mov rcx, rsi
add rsp, 0x590
pop rsi
jmp fcn.14002cbd0
nop
add rsp, 0x590
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14036d3f8]
mov edx, 0x23
call fcn.1400abba0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14036d438]
mov edx, 0x25
call fcn.1400abba0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400aaf80]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x14036d480]
lea rcx, [rsp + 0x50]
call fcn.1400aae40
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str._home_hj_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x50]
call fcn.1400aae40
int3