joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073640
Capabilities:
Get keyboard layout

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm6
mov ebp, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
movabs r13, 0x8000000000000000
call sub.USER32.dll_GetForegroundWindow
xor r12d, r12d
mov rcx, rax
xor edx, edx
call sub.USER32.dll_GetWindowThreadProcessId
lea r14, [rdi + 8]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov ecx, eax
call sub.USER32.dll_GetKeyboardLayout
mov r15, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x40]
mov ecx, ebx
mov edx, ebp
mov r8, r14
call sub.USER32.dll_ToUnicodeEx
cmp eax, 0xffffffff
je 0x14007372d
test eax, eax
je 0x140073815
jle 0x14007371b
mov r8d, eax
cmp eax, 0x21
jae 0x14007389b
mov r12, r13
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
call fcn.140042270
mov r13, qword [rsp + 0xc0]
cmp r13, r12
je 0x14007371b
movups xmm0, xmmword [rsp + 0xc8]
movaps xmmword [rsp + 0x80], xmm0
xor r12d, r12d
mov ecx, dword [rdi]
test ecx, ecx
jne 0x14007381b
jmp 0x140073864
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
lea r12, [rsp + 0xc0]
lea r13, [rsp + 0x80]
nop dword [rax]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20
mov ecx, ebx
mov edx, ebp
mov r8, r12
mov r9, r13
call sub.USER32.dll_ToUnicodeEx
test eax, eax
js 0x1400737e0
mov r12b, 1
movabs r13, 0x8000000000000000
mov ecx, dword [rdi]
test ecx, ecx
je 0x140073864
cmp byte [rdi + 0x108], 0
je 0x140073864
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov edx, dword [rdi + 4]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20
lea r9, [rsp + 0x40]
mov r8, r14
call sub.USER32.dll_ToUnicodeEx
xor ebx, ebx
jmp 0x14007386e
mov dword [rdi + 4], ebp
mov byte [rdi + 0x108], r12b
mov dword [rdi], ebx
mov qword [rsi], r13
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi + 8], xmm0
movaps xmm6, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str._home_dreamingcodes_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rdev_0.5.3_src_windows_keyboard.rs
mov edx, 0x20
mov rcx, r8
mov r8, rax
call fcn.140046bf0
int3
Function at 0x140084000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x1401d0168]
test ecx, ecx
je 0x140084145
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14008402e
lea rcx, [0x1401d0150]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2

Function at 0x140084a90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140084aa0
test al, 1
je 0x140084b43
test al, 2
jne 0x140084b5b
test al, 8
jne 0x140084adb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.1400849c0
jmp 0x140084af3
test al, 0x10
je 0x140084af3
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140084bdf
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401760a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140084b73
jne 0x140084b39
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.140084910
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14020fd78]
mov edx, 0x23
call fcn.140046f60
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14020fdb8]
mov edx, 0x25
call fcn.140046f60
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140046300]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x14020fe00]
lea rcx, [rsp + 0x28]
call fcn.140046220
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._home_dreamingcodes_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.140046220
int3
Function at 0x140085ac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140085ad0
test al, 1
je 0x140085b73
test al, 2
jne 0x140085b8b
test al, 8
jne 0x140085b0b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.1400849c0
jmp 0x140085b23
test al, 0x10
je 0x140085b23
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140085c0f
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140174820
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140085ba3
jne 0x140085b69
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.140085a10
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14020fd78]
mov edx, 0x23
call fcn.140046f60
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14020fdb8]
mov edx, 0x25
call fcn.140046f60
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140046300]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x14020fe00]
lea rcx, [rsp + 0x28]
call fcn.140046220
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._home_dreamingcodes_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.140046220
int3
Function at 0x14008c5a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.14008c2b0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x1402792e0]
mov edx, 0x800
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x14008c70d
mov rbx, rax
mov qword [rsp + 0x38], 0x800
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x58]
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x48]
sub r12, r13
nop
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14008c670
mov r8d, dword [rsp + 0x30]
cmp r12, r8
jae 0x14008c630
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.140060840
mov rbx, qword [rsp + 0x40]
jmp 0x14008c621
test eax, eax
jne 0x14008c692
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x14008c6ef
movabs rax, 0xde00000002
jmp 0x14008c69a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x38], 0
je 0x14008c6c4
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, rbx
call fcn.1401abdbc
cmp qword [rsp + 0x50], 0
je 0x14008c6dd
mov rcx, qword [0x140279280]
xor edx, edx
mov r8, rdi
call fcn.1401abdbc
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x50], 0
jne 0x14008c6cc
jmp 0x14008c6dd
mov ecx, 1
mov edx, 0x800
call fcn.1400418b0
int3
Function at 0x14008fb20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14008fbb6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x1401d48f0]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401d4900]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010ef70
test rdi, rdi
je 0x14008fc45
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14008fc5e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14008fd56
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14008fdd8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14008fd63
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14008fc20
cmp r9, 8
jae 0x14008fd6c
jmp 0x14008fdd8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010ef70
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14008fdd8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14008fdd8
mov r8, rcx
cmp r9, 8
jb 0x14008fdd8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14008fd70
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400d85a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x1400d8680
mov rsi, r8
test r8, r8
je 0x1400d86a4
mov rdi, rdx
mov r14, rsi
shl r14, 6
cmp rsi, 4
jae 0x1400d85e3
xor eax, eax
jmp 0x1400d8620
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x1400d85f0
cmp rax, rsi
je 0x1400d8637
nop dword [rax]
mov rdx, qword [rbx + rax*8]
not rdx
mov qword [rdi + rax*8], rdx
lea rdx, [rax + 1]
mov rax, rdx
cmp rsi, rdx
jne 0x1400d8620
or byte [rdi], 1
sub r14, qword [rcx + 0x20]
je 0x1400d8676
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.1401bc2e0
dec r14
jne 0x1400d8660
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x38], 0
lea r9, [0x1401fbe80]
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.1400ca4a0
lea r8, str._home_dreamingcodes_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_limb.rs
xor ecx, ecx
xor edx, edx
call fcn.140046290
int3

Function at 0x1400ded90
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400dedb5
cmp rax, rcx
je 0x1400dedbb
cmp rdx, 4
jae 0x1400dedbf
xor eax, eax
xor r8d, r8d
jmp 0x1400dee50
pop rbp
jmp fcn.140046710
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401d5490]
movdqa xmm3, xmmword [0x1401d54a0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400dede0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400dee67
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400dee50
pop rbp
ret
Function at 0x1400dff10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x1400dff94
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x1400dff94
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x1400dffad
cmp eax, 0x42
jne 0x1400dff94
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
mov r9b, 1
cmp rsi, r11
jae 0x1400e00dd
cmp byte [r10 + rsi], 0x5f
jne 0x1400e006c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x1400e00dd
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x1400e0137
mov dil, 1
xor r9d, r9d
jmp 0x1400e00df
xor edx, edx
call fcn.1400db630
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.1400db630
test al, al
jne 0x1400e011d
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400dffec
lea rdx, [0x1401fe6e2]
mov r8d, 1
call fcn.140046c70
mov rdx, rbx
test al, al
jne 0x1400e011d
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x1400dffa0
xor r14d, r14d
lea rdi, [0x140208acf]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x1400e0024
cmp byte [rax + rcx], 0x45
je 0x1400e0170
sub r14, 1
jb 0x1400e004c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x1400e004c
mov r8d, 2
mov rdx, rdi
call fcn.140046c70
mov rdx, rbx
test al, al
jne 0x1400e011d
mov rcx, rdx
call fcn.1400dcec0
test al, al
jne 0x1400e011d
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x1400e0010
jmp 0x1400dffa0
xor eax, eax
mov r14d, 0x3e
nop word cs:[rax + rax]
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x1400e00cd
lea edi, [rdx - 0x30]
cmp dil, 0xa
jb 0x1400e00af
lea edi, [rdx - 0x61]
cmp dil, 0x1a
jae 0x1400e00a1
add dl, 0xa9
jmp 0x1400e00ad
lea edi, [rdx - 0x41]
cmp dil, 0x1a
jae 0x1400e00dd
add dl, 0xe3
mov edi, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul r14
jo 0x1400e00dd
movzx edx, dil
xor edi, edi
add rax, rdx
jb 0x1400e00df
cmp rsi, r11
jb 0x1400e0080
jmp 0x1400e00df
inc rsi
mov qword [rcx + 0x10], rsi
inc rax
jne 0x1400dff6f
xor edi, edi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x1400e0125
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for___::closureshim_as_mut_const___dyn___unsafe_extern__
lea rdx, [0x1401fea10]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.140046c70
mov rcx, rbx
test al, al
je 0x1400e0125
mov sil, 2
jmp 0x1400dffa0
mov qword [rcx], 0
mov byte [rcx + 8], dil
xor esi, esi
jmp 0x1400dffa0
cmp qword [rcx + 0x20], 0
je 0x1400e0130
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.1400dff10
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400dffa2
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x1400dffa0
Function at 0x1400e2a70
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x1400e2ad9
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x1400e2a98
add rdi, rbx
sub rsi, rbx
je 0x1400e2ad9
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400e2a90
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400e2a90
test ebp, 0x7fffffff
setne al
jmp 0x1400e2adb
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14010ef70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14010efb2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14010efba
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14010efcb
jmp 0x14010efe2
xor r10d, r10d
jmp 0x14010f06d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14010efe2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14010eff9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14010f019
add r11, r8
jmp 0x14010f14b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14010f0e2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14010f090
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14010f100
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14010f112
jmp 0x14010f12d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14010f12d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14010f147
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140146420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x1401d0140]
test ecx, ecx
je 0x140146452
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14014646b
cmp qword [rax + 8], 0
je 0x14014646b
add rax, 0x10
jmp 0x140146540
lea rcx, [0x1401d0128]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140146442
mov ecx, dword [0x1401d0140]
test ecx, ecx
je 0x140146521
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14014653e
test rax, rax
jne 0x1401464e7
mov qword [rbp - 8], 0
lea rax, [0x1401d0128]
mov qword [rbp - 0x10], rax
movzx eax, byte [0x1402792e0]
mov edx, 0x18
xor ecx, ecx
call fcn.1401685e0
test rax, rax
je 0x140146560
mov rcx, qword [rbp]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
mov ecx, dword [0x1401d0140]
test ecx, ecx
je 0x140146547
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov rdx, rax
add rax, 0x10
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 8], 0
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], 0
je 0x140146540
test rcx, rcx
je 0x140146540
lock dec qword [rcx]
jne 0x140146540
mov rsi, rax
call fcn.140146620
mov rax, rsi
jmp 0x140146540
lea rcx, [0x1401d0128]
call fcn.1401466e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14014648a
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x1401d0128]
mov rsi, rax
call fcn.1401466e0
mov ecx, eax
mov rax, rsi
jmp 0x1401464d9
mov ecx, 8
mov edx, 0x18
call fcn.140041910
ud2
Function at 0x1401466e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
cmp qword [rcx], 0
je 0x140146775
mov rax, qword [0x14027c038]
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp + 4], eax
cmp eax, 1
jne 0x1401467b4
cmp dword [rbp], 0
je 0x140146798
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1401467d7
mov edi, eax
mov rax, qword [0x140279298]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140279298], rsi
jne 0x140146750
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1401467a9
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x140146819
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14014679d
mov edi, dword [rbp + 4]
jmp 0x1401467a9
mov edi, dword [rsi + 0x18]
jmp 0x1401467a7
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x30], 0
lea rdx, [0x14020c418]
lea r9, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp + 4]
lea r8, [rbp - 0x30]
call fcn.140146880
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x30]
call fcn.140046220
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x30]
call fcn.1401468c0
int3