joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b030
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001b072
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001b07a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001b08b
jmp 0x14001b0a2
xor r10d, r10d
jmp 0x14001b12d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001b0a2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001b0b9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001b0d9
add r11, r8
jmp 0x14001b20b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001b1a2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001b150
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14001b1c0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001b1d2
jmp 0x14001b1ed
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001b1ed
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001b207
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001b560
Capabilities:
Copy file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rcx, r8
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r9, rdx
mov rcx, rdi
mov rdx, rsi
mov r8, rax
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::fs::copy::h3d031dc0e79f6fe3

Function at 0x14001b590
Capabilities:
Copy file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r9, rdx
mov rcx, rdi
mov rdx, rbx
mov r8, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::fs::copy::h3d031dc0e79f6fe3
Function at 0x14001b5d0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rcx, r8
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r9, rdx
mov rcx, rdi
mov rdx, rsi
mov r8, rax
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::fs::rename::h504e90c93ae1e463

Function at 0x14001b600
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r9, rdx
mov rcx, rdi
mov rdx, rbx
mov r8, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::fs::rename::h504e90c93ae1e463

Function at 0x14001c070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, sym.std::sys::thread_local::os::destroy_value::h398e2730c4ae8db2
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h3721b47659b96df8

Function at 0x14001c080
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1402fb86c
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402fb86c
Function at 0x14001c360
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001c3a2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001c3aa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001c3bb
jmp 0x14001c3d2
xor r10d, r10d
jmp 0x14001c45d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001c3d2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001c3e9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001c409
add r11, r8
jmp 0x14001c53b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001c4d2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001c480
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14001c4f0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001c502
jmp 0x14001c51d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001c51d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001c537
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140025e10
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, r8d
mov rdi, rdx
mov rax, qword [rcx + 0xd8]
mov rdx, qword [rcx + 0xe0]
mov rcx, rax
call qword [rdx + 0xb8]
test rax, rax
je 0x140025e4c
mov rcx, rax
mov rdx, rdi
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::net::tcp::TcpStream::set_read_timeout::hbf6c7fa39d90b1a3
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400306b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x14003077f
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140030772
je 0x140030770
test rdi, rdi
je 0x1400306f9
movups xmm6, xmmword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
jne 0x140030715
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140030799
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.1402fb86c
test rdi, rdi
je 0x14003076b
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x140030772
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400306dd
jmp 0x140030772
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x1400380e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [str.PD_]
jmp sym.std::sys::thread_local::os::Storage_T_::get::hddaff067d53eda4d
Function at 0x140059860
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400598a2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400598aa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400598bb
jmp 0x1400598d2
xor r10d, r10d
jmp 0x14005995d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400598d2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400598e9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140059909
add r11, r8
jmp 0x140059a3b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400599d2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140059980
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400599f0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140059a02
jmp 0x140059a1d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140059a1d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140059a37
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140062ed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
cmp rax, qword [rdx + 0x20]
jne 0x140062f02
test rax, rax
je 0x140062f09
lea r8, [rax - 0x21]
cmp r8, 0xffffffffffffffe0
jb 0x140063013
cmp rax, 8
jae 0x140062f10
xor r9d, r9d
xor r8d, r8d
jmp 0x140062ff0
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp rax, 0x10
jae 0x140062f7c
xor r9d, r9d
xor r8d, r8d
mov r10, r8
mov r8d, eax
and r8d, 0x38
movzx r9d, r9b
movd xmm0, r9d
nop
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp r8, r10
jne 0x140062f30
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, r8
jne 0x140062ff0
jmp 0x140063008
mov r8d, eax
and r8d, 0x30
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
cmp r8, 0x10
je 0x140062fa7
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x10]
pxor xmm2, xmm1
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r9d, xmm0
cmp rax, r8
je 0x140063008
test al, 8
jne 0x140062f1c
nop word cs:[rax + rax]
movzx r10d, byte [rdx + r8]
xor r10b, byte [rcx + r8]
lea r11, [r8 + 1]
or r9b, r10b
mov r8, r11
cmp rax, r11
jne 0x140062ff0
test r9b, r9b
sete al
add rsp, 0x28
ret
lea r8, [0x140347040]
mov ecx, 0x20
mov edx, 0x20
call sym.core::panicking::panic_bounds_check::hf065bc95f1c7a8f7
int3
Function at 0x1400891c0
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov r11, qword [rcx + 0x10]
test r11, r11
je 0x14008944e
mov r9, qword [rcx + 8]
add r11, r9
mov r10, qword [rdx]
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx + 0x30]
mov r12, qword [rdx + 0x40]
mov r13, qword [rdx + 0x38]
mov rdi, qword [rdx + 0x18]
mov r14, qword [rdx + 0x10]
add rsi, 4
jmp 0x140089228
add r12, 4
mov qword [rdx + 0x40], r12
add rsi, 4
mov r13, rbp
cmp r9, r11
je 0x14008944e
movzx eax, byte [r9]
test al, al
js 0x140089240
inc r9
jmp 0x1400892b0
mov ecx, eax
and ecx, 0x1f
movzx ebp, byte [r9 + 1]
and ebp, 0x3f
cmp al, 0xdf
jbe 0x14008928c
movzx r8d, byte [r9 + 2]
shl ebp, 6
and r8d, 0x3f
or r8d, ebp
cmp al, 0xf0
jb 0x140089299
movzx eax, byte [r9 + 3]
and ecx, 7
shl ecx, 0x12
shl r8d, 6
and eax, 0x3f
or eax, r8d
or eax, ecx
cmp eax, 0x110000
je 0x14008944e
add r9, 4
jmp 0x1400892b0
add r9, 2
shl ecx, 6
or ecx, ebp
mov eax, ecx
jmp 0x1400892b0
add r9, 3
shl ecx, 0xc
or r8d, ecx
mov eax, r8d
nop word cs:[rax + rax]
lea ecx, [rax - 0x41]
mov r8d, eax
or r8d, 0x20
cmp ecx, 0x1a
cmovae r8d, eax
mov dword [rsp + 4], r8d
mov qword [rdx + 0x30], rsi
mov r15d, r8d
test r12, r12
je 0x1400893f0
mov qword [rsp + 0x10], r13
mov r13d, 8
sub r13, r12
xor eax, eax
cmp r13, 4
mov r8d, 4
cmovb r8, r13
mov ebp, 0
cmovae rbp, r15
setae al
shl eax, 2
lea rcx, [rax + 1]
cmp rcx, r8
jae 0x140089351
mov qword [rsp + 8], r12
mov r12, r14
mov r14, r9
mov r9, rdi
mov rdi, rbx
mov rbx, r10
mov r10, r11
movzx r11d, word [rsp + rax + 4]
lea ecx, [rax*8]
shl r11, cl
or rbp, r11
mov r11, r10
mov r10, rbx
mov rbx, rdi
mov rdi, r9
mov r9, r14
mov r14, r12
mov r12, qword [rsp + 8]
or rax, 2
cmp rax, r8
jae 0x140089367
movzx r8d, byte [rsp + rax + 4]
shl eax, 3
mov ecx, eax
shl r8, cl
or rbp, r8
lea ecx, [r12*8]
shl rbp, cl
or rbp, qword [rsp + 0x10]
mov qword [rdx + 0x38], rbp
cmp r13, 4
ja 0x140089210
xor rdi, rbp
add r10, r14
add rbx, rdi
rol r14, 0xd
rol rdi, 0x10
xor r14, r10
xor rdi, rbx
rol r10, 0x20
add rbx, r14
add r10, rdi
rol r14, 0x11
xor r14, rbx
mov qword [rdx + 0x10], r14
rol rdi, 0x15
xor rdi, r10
mov qword [rdx + 0x18], rdi
rol rbx, 0x20
mov qword [rdx + 8], rbx
xor r10, rbp
mov qword [rdx], r10
cmp r12, 8
je 0x1400893f0
add r12, 0xfffffffffffffffc
xor r15d, r15d
xor eax, eax
mov rcx, rax
or rcx, 1
cmp rcx, r12
jb 0x14008940a
jmp 0x140089429
mov r12d, 4
xor r13d, r13d
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r12
jae 0x140089429
lea rcx, [rsp + rax]
add rcx, 4
movzx r8d, word [r13 + rcx]
lea ecx, [rax*8]
shl r8, cl
or r15, r8
or rax, 2
cmp rax, r12
jae 0x140089442
add r13, rax
movzx r8d, byte [rsp + r13 + 4]
shl eax, 3
mov ecx, eax
shl r8, cl
or r15, r8
mov qword [rdx + 0x38], r15
mov rbp, r15
jmp 0x140089214
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008d800
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp rdx, 2
jb 0x14008d986
mov r9d, dword [rcx + 8]
mov r10d, dword [rcx + 0xc]
xor r11d, r11d
cmp r10d, dword [rcx + 4]
setb r11b
xor eax, eax
cmp r9d, dword [rcx]
setb al
cmove eax, r11d
mov r11d, 2
test al, al
je 0x14008d883
cmp rdx, 2
je 0x14008d889
nop word cs:[rax + rax]
mov esi, r9d
mov edi, r10d
mov r9d, dword [rcx + r11*8]
mov r10d, dword [rcx + r11*8 + 4]
xor ebx, ebx
cmp r10d, edi
setb bl
xor edi, edi
cmp r9d, esi
setb dil
cmove edi, ebx
cmp dil, 1
jne 0x14008d889
inc r11
cmp rdx, r11
jne 0x14008d850
jmp 0x14008d8f0
cmp rdx, 2
jne 0x14008d8c0
cmp r11, rdx
je 0x14008d8f0
mov rax, rdx
or rax, 1
bsr r9, rax
xor r9d, 0x3f
add r9d, r9d
xor r9d, 0x7e
mov qword [rsp + 0x20], r8
xor r8d, r8d
call sym.core::slice::sort::unstable::quicksort::quicksort::hd2b30449ac181f17
jmp 0x14008d986
mov esi, r9d
mov edi, r10d
mov r9d, dword [rcx + r11*8]
mov r10d, dword [rcx + r11*8 + 4]
xor ebx, ebx
cmp r10d, edi
setb bl
xor edi, edi
cmp r9d, esi
setb dil
cmove edi, ebx
test dil, dil
jne 0x14008d889
inc r11
cmp rdx, r11
jne 0x14008d8c0
test al, al
je 0x14008d986
mov rax, rdx
shr rax, 1
lea r8, [rcx + rdx*8]
lea r9, [rax*8]
sub r8, r9
cmp rax, 1
jne 0x14008d918
xor r9d, r9d
jmp 0x14008d968
mov r10, rax
and r10, 0xfffffffffffffffe
lea r11, [rdx - 1]
xor r9d, r9d
movabs rsi, 0x1ffffffffffffffe
mov rdi, qword [rcx + r11*8]
mov rbx, qword [rcx + r9*8]
mov qword [rcx + r9*8], rdi
mov qword [rcx + r11*8], rbx
mov rdi, r9
xor rdi, rsi
add rdi, rax
mov rbx, qword [r8 + rdi*8]
mov r14, qword [rcx + r9*8 + 8]
mov qword [rcx + r9*8 + 8], rbx
mov qword [r8 + rdi*8], r14
add r9, 2
add r11, 0xfffffffffffffffe
cmp r10, r9
jne 0x14008d930
test dl, 2
je 0x14008d986
mov rdx, r9
not rdx
add rax, rdx
mov rdx, qword [r8 + rax*8]
mov r10, qword [rcx + r9*8]
mov qword [rcx + r9*8], rdx
mov qword [r8 + rax*8], r10
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a5630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400a5672
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400a567a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400a568b
jmp 0x1400a56a2
xor r10d, r10d
jmp 0x1400a572d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400a56a2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400a56b9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400a56d9
add r11, r8
jmp 0x1400a580b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400a57a2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400a5750
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400a57c0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400a57d2
jmp 0x1400a57ed
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400a57ed
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400a5807
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dbda0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400dbe6f
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400dbe62
je 0x1400dbe60
test rdi, rdi
je 0x1400dbde9
movups xmm6, xmmword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
jne 0x1400dbe05
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400dbe89
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.1402fb86c
test rdi, rdi
je 0x1400dbe5b
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x1400dbe62
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400dbdcd
jmp 0x1400dbe62
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x1400ec860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.PD_]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h0cdc985e10458ad3