joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021c80
Capabilities:
Delete registry key
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140021d5b
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400140a0
cmp qword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x30]
mov r8d, 0x10000
mov rcx, rbx
cmovae rdx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdx, qword [rsp + 0x48]
mov rdi, rax
cmp rdx, 0x10
jb 0x140021d24
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d1f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021e25
call fcn.140027fdc
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
test rdi, rdi
je 0x140021d52
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call fcn.14001f4c0
cmp qword [rax + 0x18], 0x10
jb 0x140021d7a
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
mov r9d, 0xf023f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140021dbe
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140062ca8]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140021df7
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021df2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021e1f
call fcn.140027fdc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140021e30
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027f90
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.14002e928
int3
call fcn.14002e928
int3
Function at 0x140021e30
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x1620]
mov eax, 0x1720
call fcn.140028c70
sub rsp, rax
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x1610], rax
xor edx, edx
lea rcx, [rbp + 0x610]
mov r8d, 0x1000
call fcn.14002a8b0
mov r8d, 0x800
lea rdx, [rbp + 0x610]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x410
call fcn.14002a8b0
mov edx, 0x49
lea rcx, [rsp + 0x50]
call fcn.1400144f0
cmp qword [rax + 0x18], 8
jb 0x140021eae
mov rax, qword [rax]
lea r9, [rbp + 0x610]
mov r8, rax
mov edx, 0x208
lea rcx, [rbp + 0x200]
call fcn.140021ac0
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140021f0b
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021f06
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002202f
call fcn.140027fdc
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x200
call fcn.14002a8b0
mov edx, 0x4a
lea rcx, [rsp + 0x50]
call fcn.1400144f0
cmp qword [rax + 0x18], 8
jb 0x140021f35
mov rax, qword [rax]
mov r8d, 0x100
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140021f8a
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021f85
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022029
call fcn.140027fdc
xor ecx, ecx
lea rdx, [rbp + 0x200]
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp - 0x10], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp + 0x20], ecx
mov word [rbp - 0x30], cx
lea rcx, [rbp]
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x34], 1
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1610]
xor rcx, rsp
call fcn.140027f90
add rsp, 0x1720
pop rbp
ret
call fcn.14002e928
int3
call fcn.14002e928
int3
Function at 0x140023470
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x1a8], rax
xor r15d, r15d
mov edi, r15d
call fcn.140021980
mov r14d, eax
cmp eax, 0xffffffff
jne 0x1400234b4
xor eax, eax
jmp 0x1400236b3
mov edx, 0x1e
mov qword [rsp + 0x2d8], rsi
lea rcx, [rbp + 0x188]
call fcn.1400144f0
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140023667
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002365e
mov qword [rsp + 0x2d0], rbx
nop dword [rax]
lea rcx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140023520
cmp qword [rbp + 0x1a0], 8
lea r10, [rbp + 0x188]
mov r11, qword [rbp + 0x198]
lea rcx, [rsp + 0x6c]
cmovae r10, qword [rbp + 0x188]
mov r9, r11
cmp rax, r11
cmovb r9, rax
test r9, r9
je 0x1400235a4
movzx edx, word [r10]
movzx r8d, word [rsp + 0x6c]
cmp dx, r8w
jb 0x14002363f
lea rbx, [rsp + 0x6c]
sub r10, rbx
cmp dx, r8w
ja 0x14002363f
cmp r9, 1
je 0x1400235a4
movzx edx, word [r10 + rcx + 2]
add rcx, 2
dec r9
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x14002357c
jmp 0x14002363f
cmp r11, rax
jb 0x14002363f
ja 0x14002363f
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002363f
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140023636
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x180]
mov r9d, 4
mov dword [rbp + 0x180], 4
lea r8, [rbp + 0x184]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002362b
cmp dword [rbp + 0x184], r14d
cmove edi, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140023510
mov rbx, qword [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1a0]
mov rsi, qword [rsp + 0x2d8]
cmp rdx, 8
jb 0x1400236b1
mov rcx, qword [rbp + 0x188]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236ac
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400236d7
call fcn.140027fdc
mov eax, edi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rsp
call fcn.140027f90
mov rdi, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop r15
pop r14
pop rbp
ret
call fcn.14002e928
int3
Function at 0x140025a30
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140025c26
mov edx, 9
lea rcx, [rsp + 0x30]
call fcn.1400140a0
cmp qword [rax + 0x18], 0x10
jb 0x140025a91
mov rax, qword [rax]
mov r8d, 0xf01ff
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdx, qword [rsp + 0x48]
mov rdi, rax
cmp rdx, 0x10
jb 0x140025ae3
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025ade
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025c4d
call fcn.140027fdc
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
test rdi, rdi
je 0x140025c1d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x140025c14
lea rax, [rsp + 0x50]
mov r9d, 0x24
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140025c14
cmp dword [rsp + 0x5c], 2
mov qword [rsp + 0xa0], rbx
mov ebx, dword [rsp + 0x6c]
jne 0x140025bef
mov qword [rsp + 0xa8], r14
mov r14d, 0x2710
nop word [rax + rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x70]
shr edx, 3
cmp edx, 0x3e8
jae 0x140025b8b
mov edx, 0x3e8
jmp 0x140025b92
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x50]
mov r9d, 0x24
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140025be7
cmp dword [rsp + 0x6c], ebx
jbe 0x140025bd2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x6c]
mov esi, eax
jmp 0x140025be0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, dword [rsp + 0x70]
ja 0x140025be7
cmp dword [rsp + 0x5c], 2
je 0x140025b70
mov r14, qword [rsp + 0xa8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x5c], 4
mov rbx, qword [rsp + 0xa0]
jne 0x140025c26
mov al, 1
jmp 0x140025c28
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027f90
lea r11, [rsp + 0x90]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14002e928
int3

Function at 0x14003eea8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003ec98
Function at 0x140048f7c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140049003
mov rsi, rbx
cmp word [rax], bp
je 0x140048fc2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140048fac
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140048fa8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140043dac
mov rdi, rax
test rax, rax
je 0x140048ff0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002a200
mov rbp, rdi
xor ecx, ecx
call fcn.140042d4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180005bf0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h65a337ae2866fb01
mov rcx, rax
add rsp, 0x28
jmp sym.std::sys::pal::windows::fs::unlink::hfc5d336a03295743

Function at 0x180006c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [0x1800c4160]
xor edx, edx
jmp sym.std::sys::thread_local::os_local::Key_T_::get::hd708a37458e1e37f

Function at 0x180009500
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x180009542
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x18000954a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18000955b
jmp 0x180009572
xor r10d, r10d
jmp 0x1800095fd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x180009572
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x180009589
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1800095a9
add r11, r8
jmp 0x1800096db
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x180009672
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180009620
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x180009690
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1800096a2
jmp 0x1800096bd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1800096bd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1800096d7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x180009820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x180009851
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x180009866
add rax, 8
jmp 0x18000990e
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h070178b97b9ab656
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x180009848
je 0x18000990c
test rdi, rdi
je 0x180009882
movups xmm6, xmmword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
jne 0x18000989e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x18010c548]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x180009935
mov r14, rax
mov rdi, rax
mov qword [rax], rsi
movups xmmword [rax + 8], xmm6
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x18000991d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x180009929
dec ecx
add r14, 8
mov rdx, rdi
call fcn.1800a5f74
test rbx, rbx
je 0x180009907
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call sym.__rust_dealloc
mov rax, r14
jmp 0x18000990e
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h070178b97b9ab656
mov ecx, eax
jmp 0x1800098d2
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h070178b97b9ab656
mov ecx, eax
jmp 0x1800098e3
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::hc1ad400b257a9133
int3

Function at 0x18000b3c0
Capabilities:
Hash data with crc32

Disassembly:
shl r8, 4
xor r9d, r9d
nop word [rax + rax]
cmp r8, r9
je 0x18000b3ef
mov eax, dword [rdx + r9]
add r9, 0x10
test rax, rax
je 0x18000b3d0
mov rdx, qword [rdx + r9 - 8]
mov r8, rax
jmp sym.__zip::crc32::Crc32Reader_R__as_std::io::Read_::read::h94efd373dbb16d46
mov edx, 1
xor eax, eax
mov r8, rax
jmp sym.__zip::crc32::Crc32Reader_R__as_std::io::Read_::read::h94efd373dbb16d46
Function at 0x18000bba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call sym.__bzip2::read::BzDecoder_R__as_std::io::Read_::read::h1d5270f72e2018f4
mov rcx, rax
mov eax, 1
test rcx, rcx
jne 0x18000bc68
test rdx, rdx
je 0x18000bbe9
cmp rdx, rbx
ja 0x18000bc8e
mov eax, dword [rsi + 0x50]
not eax
test dl, 1
jne 0x18000bbf7
mov rcx, rdi
cmp rdx, 1
jne 0x18000bc1a
jmp 0x18000bc5e
mov eax, dword [rsi + 0x54]
cmp eax, dword [rsi + 0x50]
jne 0x18000bc70
add rsi, 0x50
jmp 0x18000bc64
lea rcx, [rdi + 1]
movzx r8d, byte [rdi]
xor r8b, al
movzx r8d, r8b
lea r9, [0x1800e4b08]
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, 1
je 0x18000bc5e
add rdi, rdx
lea r8, [0x1800e4b08]
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
movzx r9d, byte [rcx + 1]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
add rcx, 2
cmp rcx, rdi
jne 0x18000bc30
add rsi, 0x50
not eax
mov dword [rsi], eax
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rdx, [0x1800e4f6b]
mov r8d, 0x10
mov cl, 0x27
call sym.std::io::error::Error::new::ha58a84d82014382b
mov rdx, rax
mov eax, 1
jmp 0x18000bc68
lea r8, [0x1800e4f80]
mov rcx, rdx
mov rdx, rbx
call sym.core::slice::index::slice_end_index_len_fail::h95608344cc4e85cc
int3
Function at 0x18000bcb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x18000bd23
mov rbx, r8
mov rdi, rdx
cmp r8, r14
mov r8, r14
cmovb r8, rbx
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax + 0x18]
mov rcx, rax
mov eax, 1
test rcx, rcx
jne 0x18000bdc8
sub r14, rdx
jb 0x18000bdd2
mov qword [rsi + 0x10], r14
test rdx, rdx
je 0x18000bd23
cmp rdx, rbx
ja 0x18000be09
mov eax, dword [rsi + 0x18]
not eax
test dl, 1
jne 0x18000bd54
mov rcx, rdi
cmp rdx, 1
jne 0x18000bd77
jmp 0x18000bdbe
mov eax, dword [rsi + 0x1c]
cmp eax, dword [rsi + 0x18]
jne 0x18000bd36
add rsi, 0x18
xor edx, edx
jmp 0x18000bdc4
lea rdx, [0x1800e4f6b]
mov r8d, 0x10
mov cl, 0x27
call sym.std::io::error::Error::new::ha58a84d82014382b
mov rdx, rax
mov eax, 1
jmp 0x18000bdc8
lea rcx, [rdi + 1]
movzx r8d, byte [rdi]
xor r8b, al
movzx r8d, r8b
lea r9, [0x1800e4b08]
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, 1
je 0x18000bdbe
add rdi, rdx
lea r8, [0x1800e4b08]
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
movzx r9d, byte [rcx + 1]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
add rcx, 2
cmp rcx, rdi
jne 0x18000bd90
add rsi, 0x18
not eax
mov dword [rsi], eax
xor eax, eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._rustc_051478957371ee0084a7c0913941d2a8c4757bb9library_std_srciomod.rs
lea rcx, [rsp + 0x28]
call sym.core::panicking::panic_fmt::hea0842badfe2c6e8
lea r8, [0x1800e4f80]
mov rcx, rdx
mov rdx, rbx
call sym.core::slice::index::slice_end_index_len_fail::h95608344cc4e85cc
int3
Function at 0x18000be20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call sym.__flate2::deflate::read::DeflateDecoder_R__as_std::io::Read_::read::h4382376586d22129
mov rcx, rax
mov eax, 1
test rcx, rcx
jne 0x18000befb
test rdx, rdx
je 0x18000be6f
cmp rdx, rbx
ja 0x18000bf21
mov eax, dword [rsi + 0xa0]
not eax
test dl, 1
jne 0x18000be8a
mov rcx, rdi
cmp rdx, 1
jne 0x18000bead
jmp 0x18000beee
mov eax, dword [rsi + 0xa4]
cmp eax, dword [rsi + 0xa0]
jne 0x18000bf03
add rsi, 0xa0
jmp 0x18000bef7
lea rcx, [rdi + 1]
movzx r8d, byte [rdi]
xor r8b, al
movzx r8d, r8b
lea r9, [0x1800e4b08]
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, 1
je 0x18000beee
add rdi, rdx
lea r8, [0x1800e4b08]
nop word [rax + rax]
movzx r9d, byte [rcx]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
movzx r9d, byte [rcx + 1]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
add rcx, 2
cmp rcx, rdi
jne 0x18000bec0
add rsi, 0xa0
not eax
mov dword [rsi], eax
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rdx, [0x1800e4f6b]
mov r8d, 0x10
mov cl, 0x27
call sym.std::io::error::Error::new::ha58a84d82014382b
mov rdx, rax
mov eax, 1
jmp 0x18000befb
lea r8, [0x1800e4f80]
mov rcx, rdx
mov rdx, rbx
call sym.core::slice::index::slice_end_index_len_fail::h95608344cc4e85cc
int3
Function at 0x18000dd30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rdx]
mov r15, qword [rdx + 8]
mov rcx, qword [rdx + 0x18]
mov r8, r15
sub r8, rcx
add rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsi + 0x18], r15
mov r12, qword [rsi + 0x10]
mov r14, r15
sub r14, r12
add rbx, r12
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call sym.__flate2::deflate::read::DeflateDecoder_R__as_std::io::Read_::read::h4382376586d22129
test rax, rax
jne 0x18000de49
test rdx, rdx
je 0x18000ddaf
cmp r14, rdx
jb 0x18000de9f
mov eax, dword [rdi + 0xa0]
not eax
test dl, 1
jne 0x18000ddca
mov rcx, rbx
cmp rdx, 1
jne 0x18000dded
jmp 0x18000de2e
mov eax, dword [rdi + 0xa4]
cmp eax, dword [rdi + 0xa0]
jne 0x18000de5a
add rdi, 0xa0
jmp 0x18000de37
lea rcx, [rbx + 1]
movzx r8d, byte [rbx]
xor r8b, al
movzx r8d, r8b
lea r9, [0x1800e4b08]
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, 1
je 0x18000de2e
add rbx, rdx
lea r8, [0x1800e4b08]
nop word [rax + rax]
movzx r9d, byte [rcx]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
movzx r9d, byte [rcx + 1]
xor r9b, al
movzx r9d, r9b
shr eax, 8
xor eax, dword [r8 + r9*4]
add rcx, 2
cmp rcx, rbx
jne 0x18000de00
add rdi, 0xa0
not eax
mov dword [rdi], eax
add r12, rdx
jb 0x18000de7b
cmp r12, r15
ja 0x18000de87
mov qword [rsi + 0x10], r12
xor edx, edx
mov rax, rdx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rdx, [0x1800e4f6b]
mov r8d, 0x10
mov cl, 0x27
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.std::io::error::Error::new::ha58a84d82014382b
lea rcx, [0x1800e5a70]
call sym.core::num::overflow_panic::add::he501403ff62aaeef
lea rcx, str.assertion_failed:_filled___self.buf.init_rustc_051478957371ee0084a7c0913941d2a8c4757bb9librarycore_srcio_borrowed_buf.rs
lea r8, [0x1800e5a58]
mov edx, 0x29
call sym.core::panicking::panic::hcc9d6b0d58f19a30
lea r8, [0x1800e4f80]
mov rcx, rdx
mov rdx, r14
call sym.core::slice::index::slice_end_index_len_fail::h95608344cc4e85cc
int3