joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cb400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], 0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x1800cb461
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x30], 0
je 0x1800cb526
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 0x88
mov qword [rsp + 0x70], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
or eax, 0x20202020
cmp eax, 0x6e72656b
je 0x1800cb50b
jmp 0x1800cb44a
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x32336c65
jne 0x1800cb521
jmp 0x1800cb526
jmp 0x1800cb44a
cmp qword [rsp + 0x30], 0
jne 0x1800cb535
xor eax, eax
jmp 0x1800cb610
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0
jmp 0x1800cb5a3
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x20], eax
jae 0x1800cb60e
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.1800cb330
cmp eax, dword [rsp + 0xb0]
jne 0x1800cb60c
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
jmp 0x1800cb610
jmp 0x1800cb599
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1800cbd60
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov ecx, 0x13a71f1
call fcn.1800cb040
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x20], 5
jae 0x1800cbded
lea rdx, [rsp + 0x40]
lea rcx, [0x1800cbc50]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, str.32770
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800cbdc6
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0xffffffffffe17b80
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [rsp + 0x38]
jmp 0x1800cbd84
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800d37dc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800d380c
xor eax, eax
jmp 0x1800d38cf
mov rbp, rbx
cmp word [rax], si
je 0x1800d3831
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800d3818
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800d3814
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800d372c
movsxd r14, eax
test eax, eax
jne 0x1800d386f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800d3805
mov rcx, r14
call fcn.1800d1004
mov rdi, rax
test rax, rax
jne 0x1800d3888
xor ecx, ecx
call fcn.1800d0fc8
jmp 0x1800d3864
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800d372c
test eax, eax
jne 0x1800d38b9
mov rcx, rdi
call fcn.1800d0fc8
jmp 0x1800d38c3
xor ecx, ecx
call fcn.1800d0fc8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140297d60]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140297d70]
mov dword [rax], 1
mov rax, qword [0x140297d80]
mov dword [rax], 1
mov rax, qword [0x140297cc0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140297d50]
mov dword [0x1402e600c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [str._l._]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140297e20]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140297ca0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x14000c049
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp qword [rdx], 0
je 0x14000c08c
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x14000c17b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x14000c18a
mov r11b, byte [rdx + 0x1a]
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov bl, byte [rdx + 0x18]
xor r10d, r10d
test r11b, r11b
jne 0x14000c1b2
mov esi, ebx
xor sil, 1
mov byte [rdx + 0x18], sil
test r8, r8
je 0x14000c0d1
cmp r8, r9
jae 0x14000c0cb
cmp byte [rax + r8], 0xbf
jg 0x14000c0d1
jmp 0x14000c1c0
jne 0x14000c1c0
cmp r8, r9
je 0x14000c194
movzx esi, byte [rax + r8]
test sil, sil
jns 0x14000c138
mov edi, esi
and edi, 0x1f
movzx r14d, byte [rax + r8 + 1]
and r14d, 0x3f
cmp sil, 0xdf
jbe 0x14000c127
movzx ebp, byte [rax + r8 + 2]
shl r14d, 6
and ebp, 0x3f
or ebp, r14d
cmp sil, 0xf0
jb 0x14000c131
movzx esi, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl ebp, 6
and esi, 0x3f
or esi, ebp
or esi, edi
jmp 0x14000c138
shl edi, 6
or edi, r14d
mov esi, edi
jmp 0x14000c138
shl edi, 0xc
or ebp, edi
mov esi, ebp
test bl, bl
jne 0x14000c1a1
cmp esi, 0x110000
je 0x14000c198
mov edi, 1
cmp esi, 0x80
jb 0x14000c16d
mov edi, 2
cmp esi, 0x800
jb 0x14000c16d
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx + 8], r8
mov bl, 1
jmp 0x14000c0a2
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call sym.core::str::pattern::TwoWaySearcher::next::h315433bc8b82c186
jmp 0x14000c1b5
test bl, bl
jne 0x14000c1a4
mov byte [rdx + 0x1a], 1
xor r10d, r10d
jmp 0x14000c1b2
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r10d, 1
add byte [rax], al
invalid
mov qword [rcx], r10
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, str._rustc_3406ada96f8e16e49e947a91db3eba0db45245falibrarycore_src_strpattern.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call dbg.slice_error_fail
pop rcx
add qword [rax], r8
int3
Function at 0x1400218d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140021960
cmp r11, r10
ja 0x1400219d6
cmp r10, rdx
ja 0x1400219e8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140021962
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140021940
jmp 0x1400219c4
ja 0x14002196a
mov r11, r10
cmp rax, r8
jne 0x140021904
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400219a0
mov rdi, r8
sub ecx, edx
jns 0x1400219bb
jmp 0x1400219c6
cmp r8, rsi
je 0x1400219f7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400219c6
xor al, 1
cmp rdi, rsi
jne 0x140021980
jmp 0x1400219c6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call dbg.slice_index_order_fail
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call dbg.slice_end_index_len_fail
lea rcx, str.librarycore_srcunicodeprintable.rs
call dbg.unwrap_failed
int3

Function at 0x140024095
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ea018]
test ecx, ecx
je 0x1400240ae
dec ecx
add rsp, 0x28
jmp fcn.14017ee14
lea rcx, section..data
call dbg.init
mov ecx, eax
jmp 0x1400240a5
Function at 0x1400242f8
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rcx
call sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3get17hdb37153f22a3cf6fE.2029
cmp rax, 2
jb 0x140024320
mov rbx, rax
cmp qword [rax + 8], 0
je 0x140024320
add rbx, 0x10
jmp 0x14002441c
call sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3get17hdb37153f22a3cf6fE.2029
cmp rax, 1
je 0x1400243d0
mov rsi, rax
test rax, rax
jne 0x140024399
and qword [rsp + 0x28], 0
lea rax, section..data
mov qword [rsp + 0x20], rax
mov al, byte [0x1402e61a8]
mov edx, 0x28
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x14002443a
mov rsi, rax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x20], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov ecx, dword [0x1401ea018]
test ecx, ecx
je 0x140024427
dec ecx
mov rdx, rsi
call fcn.14017ee1c
lea rbx, [rsi + 8]
test rdi, rdi
je 0x1400243de
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
and qword [rdi], 0
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x20], 0
je 0x1400243d4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x28]
jmp 0x1400243e1
xor ebx, ebx
jmp 0x14002441c
lea rcx, [rsp + 0x20]
call sym._ZN4core3ptr174drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_alloc..boxed..Box_LT_dy
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rsi + 8], 1
lea rbx, [rsi + 0x10]
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x20], rax
call sym._ZN4core3ptr174drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_alloc..boxed..Box_LT_dy
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rcx, section..data
call dbg.init
mov ecx, eax
jmp 0x140024391
lea rsi, [rsp + 0x28]
mov ecx, 8
mov edx, 0x28
call dbg.handle_alloc_error
ud2

Function at 0x140024b1a
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x20]
and qword [rdi], 0
lea rcx, [0x1401f86e8]
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x140024b5b
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140024b8d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call dbg.from_wide
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140030e46
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140030e6c
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140030e56
mov qword [rcx], rax
ret
Function at 0x14005dd67
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call sym.core::hash::impls::__impl_core::hash::Hash_for_isize_::hash::h313ddc7d02f93cb1
test rbx, rbx
je 0x14005dda0
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__fnv::FnvHasher_as_core::hash::Hasher_::write::hd33f9197c621f915
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__http::header::name::StandardHeader_as_core::hash::Hash_::hash::h7614a94d2c8cd127

Function at 0x14005fa4a
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
lea rdx, [0x140248488]
mov r8d, 1
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x14005fa6d
add rsp, 0x28
ret
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
lea rcx, [rax + 2]
add rsp, 0x28
jmp sym.core::ptr::drop_in_place_std::io::error::Error_::h403846c1aea292c4
Function at 0x14007ed1d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ea2a8]
test ecx, ecx
je 0x14007ed36
dec ecx
add rsp, 0x28
jmp fcn.14017ee14
lea rcx, sym.std::sys::pal::common::thread_local::os_local::destroy_value::h6394849691a2ce8f
call dbg.init
mov ecx, eax
jmp 0x14007ed2d

Function at 0x14007f86d
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14007f8bf
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14007f8bf
mov rsi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14007f8bf
mov r14, rax
xor edi, edi
jmp 0x14007f93f
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14007f98b
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14007f98b
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14007f98b
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14007f98b
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14007f98b
mov r14, qword [rsp + 0x20]
mov ecx, 0x18
call sym.alloc::alloc::exchange_malloc::h9fa36ba6eed0cf7a
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1402e6060], rbx
je 0x14007f97e
mov rsi, rax
mov rcx, qword [rbx]
mov rdx, qword [rbx + 0x10]
call sym.core::ptr::drop_in_place_parking_lot_core::thread_parker::imp::Backend_::hc3a99421d67d5a6c
mov rcx, rbx
call sym.__alloc::boxed::Box_T_A__as_core::ops::drop::Drop_::drop::h034a9b29025da3ad
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
lea r8, [0x140246b68]
mov edx, 0x5b
call sym.std::panicking::begin_panic::h7d8a0c8e17f58625
mov rsi, rax
mov rcx, rbx
call sym.__alloc::boxed::Box_T_A__as_core::ops::drop::Drop_::drop::h034a9b29025da3ad
jmp 0x14007f9be
mov rcx, rsi
call sym._Unwind_Resume
call dbg.panic_in_cleanup
int3
Function at 0x14007f9ea
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
call sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3get17hdb37153f22a3cf6fE.5749
cmp rax, 2
jb 0x14007fa09
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14007fa9c
call sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3get17hdb37153f22a3cf6fE.5749
cmp rax, 1
je 0x14007faa2
mov rsi, rax
test rax, rax
jne 0x14007fa61
mov al, byte [0x1402e61a8]
mov edx, 0x40
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x14007fabe
mov rsi, rax
lea rax, sym.std::sys::pal::common::thread_local::os_local::destroy_value::h6394849691a2ce8f
mov qword [rsi], rax
and qword [rsi + 8], 0
mov ecx, dword [0x1401ea2a8]
test ecx, ecx
je 0x14007faae
dec ecx
mov rdx, rsi
call fcn.14017ee1c
lea rdi, [rsp + 0x20]
mov rcx, rdi
call sym.parking_lot_core::parking_lot::ThreadData::new::hd1c486d406aabc5a
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 0x28], xmm2
mov rax, qword [rdi + 0x30]
mov qword [rsi + 0x38], rax
cmp qword [rsi + 8], 0
movups xmmword [rsi + 8], xmm0
je 0x14007fa9c
lock dec qword [0x1402e6050]
add rsi, 8
jmp 0x14007faa4
xor esi, esi
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::pal::common::thread_local::os_local::destroy_value::h6394849691a2ce8f
call dbg.init
mov ecx, eax
jmp 0x14007fa59
mov ecx, 8
mov edx, 0x40
call dbg.handle_alloc_error
int3
Function at 0x1400810c0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 0x20
call sym.__rand_core::os::OsRng_as_rand_core::RngCore_::try_fill_bytes::h2229e0169f62631f
test rax, rax
je 0x140081103
lea rdx, sym._ZN4core3ptr104drop_in_place_LT_hyper..client..connect..ExtraEnvelope_LT_hyper..client..connect..http..HttpInfo_GT__GT_17h5eb4
mov rcx, rax
call sym.__alloc::boxed::Box_T_A__as_core::ops::drop::Drop_::drop::h083154abfb109f96
mov rax, qword [rdi + 0x30]
jmp 0x14008116d
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x90]
mov rcx, rbx
call sym.__rand_chacha::chacha::ChaCha12Core_as_rand_core::SeedableRng_::from_seed::h56b5de7b449595d1
mov rcx, qword [rbx]
movups xmm0, xmmword [rbx + 8]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov qword [rdi], rcx
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rcx, qword [rsp + 0x40]
mov qword [rdi + 0x28], rcx
and qword [rdi + 0x40], 0
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
jmp sym.__rand_chacha::chacha::ChaCha12Core_as_rand_core::block::BlockRngCore_::generate::h9d6ee3bea080352f

Function at 0x1400813a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ea2c8]
test ecx, ecx
je 0x1400813b9
dec ecx
add rsp, 0x28
jmp fcn.14017ee14
lea rcx, sym.std::sys::pal::common::thread_local::os_local::destroy_value::h9d28477f22dd7d07
call dbg.init
mov ecx, eax
jmp 0x1400813b0

Function at 0x1400813c9
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400813e0
dec ecx
jmp 0x1400813ea
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call fcn.14017ee1c
mov rcx, rdi
call sym._ZN4core3ptr265drop_in_place_LT_alloc..boxed..Box_LT_std..sys..pal..common..thread_local..os_local..Value_LT_alloc..rc..Rc_LT_
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140081407
dec ecx
jmp 0x140081411
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
call fcn.14017ee1c
nop
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14008356c
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov r12d, 0xffffffff
test rdi, rdi
je 0x1400835f6
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x140083588
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140083588
and ebp, 0x7fffffff
je 0x1400835f4
mov al, byte [0x1402e61a8]
mov edx, 4
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x140083608
mov rsi, rax
mov dword [rax], ebp
jmp 0x1400835f6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call dbg.handle_alloc_error
int3

Function at 0x14009d464
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsp