joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140007ba2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140007baa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140007bbb
jmp 0x140007bd2
xor r10d, r10d
jmp 0x140007c5d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140007bd2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140007be9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140007c09
add r11, r8
jmp 0x140007d39
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140007cd2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140007c80
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140007cef
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x140007d00
jmp 0x140007d1b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x140007d1b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140007d35
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x140052080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140052116
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
enter 0x6644, 0xf
out dx, eax
or eax, 0x18e61c
Function at 0x14006c800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov rsi, qword [rdi + 0x28]
cmp rsi, 0x7fff
jbe 0x14006c867
lea rcx, [rdx + 0x18]
mov r9, qword [rdx]
mov rax, qword [rdx + 8]
mov r8, qword [rdx + 0x10]
mov rdx, rax
call qword [r9 + 0x20]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14006c860
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
call qword [rax + 0x20]
xor eax, eax
jmp 0x14006c979
lea r15, [rcx + 8]
movzx ebp, word [rcx + 0x30]
mov r14, qword [rcx + 0x28]
movzx ebx, byte [rcx + 0x32]
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
cmp rsi, qword [rdi + 0x18]
jne 0x14006c8a0
lea rcx, [rdi + 0x18]
call fcn.140007370
mov rcx, qword [rdi + 0x20]
imul rax, rsi, 0x68
mov qword [rcx + rax], 0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + rax + 0x18], xmm0
movups xmmword [rcx + rax + 0x28], xmm1
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax + 0x38], rdx
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rcx + rax + 0x40], xmm0
movups xmmword [rcx + rax + 0x50], xmm1
mov word [rcx + rax + 0x60], bp
lea rcx, [rsi + 1]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rdi + 0x48]
mov r8, qword [rdi + 0x50]
xor edx, edx
mov r9d, esi
nop dword [rax + rax]
mov r10, r14
mov r14d, 0
cmp r10, r8
jae 0x14006c900
movzx r11d, word [rcx + r10*4]
cmp r11w, 0xffff
je 0x14006c93c
inc rdx
movzx r14d, word [rcx + r10*4 + 2]
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
inc r10
mov ebp, r14d
mov r9d, r11d
mov r14, r10
jmp 0x14006c900
xor bl, 1
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
cmp rdx, 0x80
setb cl
test cl, bl
jne 0x14006c965
cmp qword [rdi], 0
jne 0x14006c965
mov qword [rdi], 1
mov rdx, qword [rdi + 0x28]
cmp rsi, rdx
jae 0x14006c986
mov rcx, qword [rdi + 0x20]
add rax, rcx
add rax, 0x18
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fhttp_1.1.0_srcheadermap.rssize_overflows_MAX_SIZETryFlatten_polled_after_completionC:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_futures_util_0.3.31_src_future_try_future_try_flatten.rs
mov rcx, rsi
call fcn.1401d162f
int3
Function at 0x140074a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074a90
test al, 1
je 0x140074b53
test al, 2
jne 0x140074b6b
test al, 8
jne 0x140074aca
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
call fcn.1400748a0
jmp 0x140074ae8
test al, 0x10
je 0x140074ae8
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x140074bf5
mov rcx, qword [rsi + 0x90]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x98]
test rax, rax
je 0x140074b1f
mov r8, qword [rsi + 0xa0]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [r8 + 0x28]
mov qword [rsp + 0x20], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140074b83
jne 0x140074b49
mov rcx, rsi
call fcn.1400747a0
nop
add rsp, 0x90
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140290708]
mov edx, 0x23
call fcn.1401d1740
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140290748]
mov edx, 0x25
call fcn.1401d1740
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rax, [fcn.140047120]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, str.current:___sub:___a__
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140290790]
lea rcx, [rsp + 0x30]
call fcn.1401d16a0
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_taskcore.rsX
lea rcx, [rsp + 0x30]
call fcn.1401d16a0
int3
Function at 0x1400955a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [r8]
mov r15, qword [r8 + 8]
movabs r14, 0x8000000000000008
cmp rbx, r15
je 0x140095686
mov r13, r8
lea rbp, [rbx + 0x30]
mov qword [r8], rbp
mov r12, qword [r8 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rbx
call fcn.140090210
mov rax, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0xc0], xmm0
and al, 0xc0
add byte [rax], al
add byte [rdi], cl
adc byte [rsp + 0x48], al
Function at 0x14009ad30
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r14, rcx
mov rsi, qword [rcx]
movzx eax, byte [rsi + 0x81]
mov ebx, 0xc
cmp al, 2
je 0x14009ad77
test al, 1
je 0x14009ad77
mov rax, qword [rsi + 0x2b0]
mov rax, qword [rax + 0x168]
lea rax, [rax + rax*2]
lea rbx, [rax*2 + 0xc]
mov rdi, qword [r14 + 8]
mov rax, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x40]
sub rax, rdx
cmp rax, rbx
jb 0x14009ada3
test rbx, rbx
je 0x14009ae24
mov rax, qword [rdi + 0x38]
cmp rbx, 8
jae 0x14009adcc
mov rcx, rbx
jmp 0x14009ae09
lea rcx, [rdi + 0x30]
mov qword [rsp + 0x20], 4
mov r9d, 4
mov r8, rbx
call fcn.1401dbca0
mov rdx, qword [rdi + 0x40]
mov rax, qword [rdi + 0x38]
cmp rbx, 8
jb 0x14009ad9e
mov r8, rbx
and r8, 0xfffffffffffffff8
mov ecx, ebx
and ecx, 7
lea r9, [rax + rdx*4]
add r9, 0x10
add rdx, r8
xor r10d, r10d
movaps xmm0, xmmword [0x1401e0950]
nop dword [rax]
movups xmmword [r9 + r10*4 - 0x10], xmm0
movups xmmword [r9 + r10*4], xmm0
add r10, 8
cmp r8, r10
jne 0x14009adf0
cmp rbx, r8
je 0x14009ae24
mov r8, rdx
nop dword [rax]
lea rdx, [r8 + 1]
mov dword [rax + r8*4], 0x80000000
mov r8, rdx
dec rcx
jne 0x14009ae10
mov qword [rdi + 0x40], rdx
call fcn.14009a7b0
lock inc qword [rax]
jle 0x14009bc00
mov rbx, rax
mov r15, qword [rdi + 0x28]
mov r11, qword [rdi + 0x58]
mov rax, r11
shl rax, 4
mov rcx, qword [rdi + 0x130]
lea r8, [rcx + rcx*4]
mov r9, qword [rdi + 0x40]
add r9, r15
add r9, qword [rdi + 0x70]
add r9, qword [rdi + 0x88]
add r9, qword [rdi + 0xa8]
add r9, qword [rdi + 0xc0]
movzx ecx, byte [rsi + 0x2b8]
mov r10d, 4
shl r10, cl
add r9, qword [rdi + 0xd0]
mov qword [rsp + 0x38], rdx
add rax, rdx
add rax, 0x24
lea rax, [rax + r8*4]
add rax, qword [rdi + 0xe8]
add rax, qword [rdi + 0x148]
lea rax, [rax + r9*4]
add rax, r10
cmp rax, qword [rsi + 0x2c0]
mov qword [rsp + 0x30], rbx
jbe 0x14009af2d
cmp dword [rsi + 0x40], 1
jne 0x14009af21

Function at 0x14009bd50
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, rcx
mov rsi, qword [rcx + 8]
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x40], 0
mov rdi, qword [rsi + 0x50]
mov rbx, qword [rsi + 0x58]
mov qword [rsi + 0x58], 0
test rbx, rbx
jne 0x14009bdc9
lea rbp, [rsi + 0x118]
mov rdi, qword [rsi + 0x130]
test rdi, rdi
je 0x14009be92
mov rbx, qword [rbp]
movdqa xmm0, xmmword [rbx]
pmovmskb r15d, xmm0
not r15d
lea r14, [rbx + 0x10]
jmp 0x14009bdef
add rdi, 0x10
dec rbx
je 0x14009bd8c
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14009bdc0
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
call fcn.140006c60
jmp 0x14009bdc0
Function at 0x1400a32f0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rdi, r8
mov r13, rcx
mov r14, qword [r9 + 0x10]
mov rbx, qword [r9 + 0x20]
cmp rbx, r14
jae 0x1400a339e
mov rax, qword [r9 + 8]
movzx eax, byte [rax + rbx]
movzx r15d, al
mov eax, dword [r9]
mov r8d, dword [r9 + 4]
mov rcx, qword [rdx + 0x298]
or rcx, qword [rdx + 0x2a8]
mov r10, qword [rdx + 0x290]
or r10, qword [rdx + 0x2a0]
or r10, rcx
je 0x1400a33b2
lea r10, [rdx + 0x290]
mov r11d, r15d
shr r11d, 3
and r11d, 0xfffffff0
mov esi, 1
xor r12d, r12d
mov ecx, r15d
shld r12, rsi, cl
shl rsi, cl
xor ecx, ecx
test r15b, 0x40
cmovne r12, rsi
cmovne rsi, rcx
and r12, qword [r10 + r11 + 8]
and rsi, qword [r10 + r11]
or rsi, r12
je 0x1400a33b2
mov rsi, r15
shl rsi, 0x20
or rsi, 4
jmp 0x1400a3685
mov eax, dword [r9]
mov r8d, dword [r9 + 4]
mov r10b, 2
movzx ecx, r10b
test eax, eax
jne 0x1400a33c3
jmp 0x1400a33d0
movzx r10d, byte [rdx + r15 + 0x90]
movzx ecx, r10b
test eax, eax
je 0x1400a33d0
cmp eax, 1
jne 0x1400a3618
add rcx, 6
mov r11, qword [rdi + 0x40]
cmp rcx, r11
jae 0x1400a365c
movzx r11d, byte [rdx + 0x81]
mov r15d, r8d
cmp r11b, 2
je 0x1400a366b
test r11b, 1
je 0x1400a366b
mov r11, qword [rdx + 0x2b0]
cmp qword [r11 + 0x168], r15
jbe 0x1400a38e1
lea r11, [r15 + r15*2]
lea rcx, [rcx + r11*2]
add rcx, 0xc
or al, 0x4c
mov ebx, dword [rdi + 0x40]
mov rcx, qword [rdx + 0x2b8]
and ecx, 0x3f
mov r11d, 1
shl r11, cl
cmp rcx, 0x1b
jae 0x1400a3e61
or r11d, 0x40000000
test r11d, r11d
jns 0x1400a33ee
Function at 0x1400c40d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x628
movdqa xmmword [rsp + 0x610], xmm11
movdqa xmmword [rsp + 0x600], xmm10
movdqa xmmword [rsp + 0x5f0], xmm9
movdqa xmmword [rsp + 0x5e0], xmm8
movdqa xmmword [rsp + 0x5d0], xmm7
movaps xmmword [rsp + 0x5c0], xmm6
mov r14, rcx
cmp r9, 0x7fffffff
jbe 0x1400c4189
movabs rax, 0x8000000000000003
mov qword [r14], rax
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], 0x7fffffff
mov r15, rdx
movzx eax, byte [rdx + 0x13]
cmp al, 2
je 0x1400c41a3
test al, 1
je 0x1400c41a3
cmp byte [r15 + 0x15], 2
jne 0x1400c473f
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x30], r8
cmp qword [r15 + 0x28], 0
jne 0x1400c6ec6
mov qword [r15 + 0x28], 0xffffffffffffffff
mov dword [r15 + 0x88], 0
mov rsi, qword [r15 + 0x48]
mov rdi, qword [r15 + 0x50]
mov qword [r15 + 0x50], 0
test rdi, rdi
je 0x1400c4222
add rsi, 0x10
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400c41f9
add rsi, 0x20
dec rdi
je 0x1400c4222
mov eax, dword [rsi - 0x10]
cmp eax, 7
je 0x1400c420b
cmp eax, 6
je 0x1400c420b
cmp eax, 2
jne 0x1400c41f0
cmp qword [rsi - 8], 0
je 0x1400c41f0
mov r8, qword [rsi]
mov rcx, qword [0x1402a52c8]
xor edx, edx
call rbx
jmp 0x1400c41f0
mov qword [rsp + 0x38], r14
mov qword [r15 + 0x68], 0
mov rdi, qword [r15 + 0x78]
mov rbx, qword [r15 + 0x80]
mov qword [rsp + 0x60], r15
jl 0x1400c4262
invalid
mov qword [r15 + 0x80], 0
test rbx, rbx
je 0x1400c42cb
xor r12d, r12d
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400c4268
inc r12
cmp r12, rbx
je 0x1400c42cb
lea rbp, [r12 + r12*2]
mov r15, qword [rdi + rbp*8 + 8]
mov r14, qword [rdi + rbp*8 + 0x10]
test r14, r14
je 0x1400c42b0
mov rsi, r15
jmp 0x1400c4289
add rsi, 0x10
dec r14
je 0x1400c42b0
mov rax, qword [rsi]
test rax, rax
je 0x1400c4280
lock dec qword [rax]
jne 0x1400c4280
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140006c60
mov ebp, 0xebfff429
invalid
lea rax, [rdi + rbp*8]
cmp qword [rax], 0
je 0x1400c4260
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, r15
call r13
invalid
jmp 0x1400c4260
mov rbp, qword [rsp + 0x60]
mov qword [rbp + 0x90], 0
movabs rax, 0x8000000000000007
mov qword [r14], rax
jmp fcn.1400c4141

Function at 0x1400ceaa0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [rdx + 0x48]
cmp byte [rax + 0x182], 1
jne 0x1400ceb3f
cmp byte [rax + 0x183], 0
je 0x1400ceb3f
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
mov r10, qword [rax + 0x138]
movaps xmm6, xmmword [rsp + 0x60]
Function at 0x1400e35c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, r8
mov rdi, rdx
mov rbx, rcx
cmp r9, 8
jb 0x1400e363a
shr r9, 3
mov r14, r9
shl r14, 7
lea rdx, [rbx + r14]
imul r15, r9, 0xe0
lea r8, [rbx + r15]
mov rcx, rbx
mov rsi, r12
mov r12, r9
call fcn.1400e35c0
mov rbx, rax
lea rdx, [rdi + r14]
lea r8, [rdi + r15]
mov rcx, rdi
mov r9, r12
call fcn.1400e35c0
mov rdi, rax
add r14, rsi
add r15, rsi
mov rcx, rsi
mov rdx, r14
mov r8, r15
mov r9, r12
call fcn.1400e35c0
mov r12, rax
mov qword [rsp + 0x38], rdi
mov rbp, qword [rbx + 8]
mov rsi, qword [rbx + 0x10]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov r13, rsi
sub r13, r8
mov qword [rsp + 0x48], r8
cmovb r8, rsi
mov rcx, rbp
mov qword [rsp + 0x50], rdx
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne r13, rax
movzx r15d, byte [rbx + 0x18]
movzx ecx, byte [rdi + 0x18]
mov eax, r15d
mov byte [rsp + 0x2f], cl
sub al, cl
xor r14d, r14d
cmp al, 0xff
sete r14b
xor eax, eax
test r13, r13
sets al
cmovne r14d, eax
mov rdx, qword [r12 + 8]
mov r13, qword [r12 + 0x10]
mov rdi, r12
mov r12, rsi
sub r12, r13
cmovae rsi, r13
mov rcx, rbp
mov qword [rsp + 0x30], rdx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne r12, rax
mov qword [rsp + 0x40], rdi
movzx ebp, byte [rdi + 0x18]
sub r15b, bpl
xor eax, eax
cmp r15b, 0xff
sete al
xor ecx, ecx
test r12, r12
sets cl
cmovne eax, ecx
cmp r14b, al
jne 0x1400e3740
mov rax, qword [rsp + 0x48]
mov rsi, rax
sub rsi, r13
cmovb r13, rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne rsi, rax
movzx ecx, byte [rsp + 0x2f]
sub cl, bpl
xor eax, eax
cmp cl, 0xff
sete al
xor ecx, ecx
test rsi, rsi
sets cl
cmovne eax, ecx
xor r14b, al
mov rbx, qword [rsp + 0x38]
cmovne rbx, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400f0f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
mov r12, r8
mov r14, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.1400ed680
invalid
invalid
inc dword [rbx - 0x7af08408]
jg 0x1400f0f76
add byte [rax], al
mov rdi, qword [r14]
lea rbp, [rdi + 0xa0]
mov rax, qword [rdi + 0xb0]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdi + 0xa0]
movaps xmmword [rsp + 0x50], xmm0
mov r15, qword [r12 + 0x10]
test r15, r15
je 0x1400f104b
lea r13, [r15 - 1]
mov qword [r12 + 0x10], r13
mov rax, qword [r12 + 8]
mov eax, dword [rsp + 8]
lea rcx, str.assertion_failed:_self.char____
lea r8, [0x1402258c8]
lea eax, [0x1402258c8]
Function at 0x1400f79f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov r13, qword [rdx + 0x10]
lea r12, [rax + 0xa0]
mov rbx, qword [rax + 0xa0]
cmp rbx, r13
jne 0x1400f7a88
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x58], xmm0
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x40], xmm0
test rbx, rbx
js 0x1400f8364
mov r14, qword [r14 + 8]
je 0x1400f7deb
movzx eax, byte [0x1402a5340]
xor ecx, ecx
mov rdx, rbx
call fcn.1401af7e0
mov rdi, rax
test rax, rax
jne 0x1400f7df0
mov ecx, 1
mov rdx, rbx
call fcn.1401d11bf
mov dword [rsp + 0x80], r8d
lea rbp, [rax + 0xa8]
mov rcx, qword [rax + 0xa8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0x38], rax
movabs rdi, 0x2a00000000001
jmp 0x1400f7ae0

Function at 0x1400fd630
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x21
jae 0x1400fd9b8
mov r13, r9
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov r14d, dword [rsp + 0x120]
lea rax, [rsi - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r9

Function at 0x14010cf20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rdx]
movzx eax, byte [rax + 0x24]
cmp al, 2
je 0x14010cf48
test al, 1
je 0x14010d1f8
movzx eax, byte [rdi + 0x30]
test eax, eax
je 0x14010cfc0
cmp eax, 1
jne 0x14010d06d
movzx eax, byte [0x1402a5340]
mov edx, 0x50
xor ecx, ecx
call fcn.1401af7e0
test rax, rax
je 0x14010d210
movaps xmm0, xmmword [0x1401e0b70]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401e0b80]
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [0x1401e0b90]
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1401e0ba0]
movups xmmword [rax + 0x30], xmm0
movdqa xmm0, xmmword [0x1401e0bb0]
movdqu xmmword [rax + 0x40], xmm0
mov qword [rsp + 0x30], 0xa
mov ecx, 0xa
jmp 0x14010d107
movzx eax, byte [0x1402a5340]
mov edx, 0x238
xor ecx, ecx
call fcn.1401af7e0
test rax, rax
je 0x14010d21f
xor ecx, ecx
lea rdx, [0x14023d8e8]
movdqa xmm0, xmmword [0x1401e0950]
nop dword [rax]
movzx eax, byte [0x1402a5340]
lea rcx, str.assertion_failed:_self.flags__.unicode__
lea r8, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_syntax_0.8.5_srchir_translate.rs
mov edx, 0x28
call fcn.1401d1740
mov ecx, 4
mov edx, 0x50
call fcn.1401d11bf
mov ecx, 4
mov edx, 0x238
call fcn.1401d11bf
Function at 0x140113d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
cmp r9, 8
jb 0x140113e0b
mov rbx, r9
shr rbx, 3
and r9, 0xfffffffffffffff8
lea rdx, [rcx + r9]
mov r14, rbx
shl r14, 4
sub r14, rbx
sub r14, rbx
lea r8, [rcx + r14]
mov r15, r9
mov r9, rbx
call fcn.140113d90
mov r12, rax
lea rdx, [rdi + r15]
lea r8, [rdi + r14]
mov rcx, rdi
mov r9, rbx
call fcn.140113d90
mov rdi, rax
add r15, rsi
add r14, rsi
mov rcx, rsi
mov rdx, r15
mov r8, r14
mov r9, rbx
call fcn.140113d90
mov rsi, rax
mov rcx, r12
movzx r11d, byte [rcx]
movzx ebx, byte [rcx + 1]
movzx edx, byte [rdi]
movzx r8d, byte [rdi + 1]
xor r9d, r9d
cmp bl, r8b
setb r9b
xor eax, eax
cmp r11b, dl
setb al
cmove eax, r9d
movzx r9d, byte [rsi]
movzx r10d, byte [rsi + 1]
xor ebp, ebp
cmp bl, r10b
setb bpl
xor ebx, ebx
cmp r11b, r9b
setb bl
cmove ebx, ebp
cmp al, bl
jne 0x140113e72
xor ecx, ecx
cmp r8b, r10b
setb cl
xor r8d, r8d
cmp dl, r9b
setb r8b
cmove r8d, ecx
xor al, r8b
cmovne rdi, rsi
mov rcx, rdi
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140114240
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r10, rdx
mov qword [rsp + 0x50], rcx
movabs rax, 0x3fffffffffffffff
add rax, rdx
mov rcx, rax
or rcx, rdx
shr rcx, 0x20
je 0x1401142a7
xor edx, edx
div r10
mov qword [rsp + 0x58], rax
mov rax, r10
cmp r10, 0x1001
jae 0x1401142bd
xor edx, edx
div r10d
mov qword [rsp + 0x58], rax
mov rax, r10

Function at 0x140114930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x38], r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x21
jae 0x1401149ae
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x110]
lea rcx, [rsi - 0x10]
mov qword [rsp + 0x58], rcx
lea rcx, [rsi - 8]
mov qword [rsp + 0x60], rcx
Function at 0x14011d7d0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x98]
mov r8d, 0xb
mov rdx, rax
call fcn.14011d4b0
cld
invalid
inc edi
and al, 0x5c
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x3c], 0
mov rbx, qword [rsp + 0xa0]
lea r12, [rsp + 0x3c]

Function at 0x14011f280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x14011f2c0
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x14011f3e2
mov qword [rsp + 0x28], rdx
cmp byte [rdx + 0x1a], 0
jne 0x14011f418
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1