joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d70
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140002e6f
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140002e6f
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140002e72
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140002c90
xor edi, edi
test al, al
je 0x140002e72
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, [0x1400054d0]
mov edx, 0x12c
call fcn.140003480
test al, al
je 0x140002e62
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003480
test al, al
je 0x140002e60
lea r8, [0x14000558a]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003480
test al, al
jne 0x140002e7e
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002e72
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140002e62
Function at 0x140002ea0
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.140003440
test al, al
je 0x140002f07
lea r8, [0x140005662]
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.140003480
test al, al
je 0x140002f07
mov edx, 0x104
mov rcx, rdi
call fcn.140003410
sub rbx, rax
cmp rbx, 0xb
jae 0x140002f1a
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.140002d70
test al, al
jne 0x140002f57
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
jmp 0x140002f07
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
jmp 0x140002feb
lea r8, [0x140005598]
mov edx, 0x104
mov rcx, rdi
call fcn.140003480
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002fa1
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete al
jmp 0x140002f09
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, str..tmp
call fcn.140003480
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002f76
inc r13d
je 0x140002f91
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.1400033b0
cmp rbp, 0x103
ja 0x140002fb4
jmp 0x140002fac

Function at 0x1400036c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003704
add rsp, 0x38
pop rdi
pop rsi
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x1400036fd
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x140003736
mov edx, ecx
and edx, 0xfffffffe
cmp word [rsi + rdx - 2], 0
je 0x14000373b
shr ecx, 1
mov eax, 0xea
cmp rcx, rdi
jae 0x1400036fd
add rsi, rdx
mov word [rsi], 0
xor eax, eax
jmp 0x1400036fd

Function at 0x140003740
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000377a
add rsp, 0x38
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 4
jne 0x140003775
xor ecx, ecx
cmp dword [rsp + 0x30], 4
mov eax, 0xe8
cmove eax, ecx
jmp 0x140003775
Function at 0x1400037a0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400037f0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140003830
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
lea rax, [rsp + 0x40]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
xor edi, edi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003881
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003875
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, qword [rsp + 0x90]
lea r9, [rsp + 0x3c]
mov dword [r9], 0
lea eax, [r14 + r14]
lea rdx, [rsp + 0x38]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003865
cmp dword [rsp + 0x3c], 1
jne 0x140003865
mov eax, dword [rsp + 0x38]
cmp rax, 2
jb 0x1400038e9
mov ecx, eax
and ecx, 0xfffffffe
cmp word [rsi + rcx - 2], 0
je 0x1400038ee
shr eax, 1
cmp rax, r14
jae 0x1400038f6
add rsi, rcx
mov word [rsi], 0
mov dil, 1
jmp 0x140003865
xor edi, edi
jmp 0x140003865

Function at 0x1400039a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.140001d90
mov rcx, rbx
mov rdx, rsi
call fcn.140001df0
test al, al
je 0x140003a73
mov rbx, qword [rdi + 8]
mov sil, 1
test rbx, rbx
je 0x140003a75
xor r13d, r13d
mov ebp, 0x800000
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x2c]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
sub rbx, r13
cmp rbx, rbp
cmovae rbx, rbp
mov dword [rsp + 0x2c], 0
mov r12, qword [rdi]
add r12, r13
mov rcx, r14
call fcn.140001f60
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, ebx
mov r9, r15
call rsi
test eax, eax
je 0x140003a4e
add r13, rbx
mov rbx, qword [rdi + 8]
cmp r13, rbx
jb 0x140003a02
mov sil, 1
jmp 0x140003a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140001ea0
mov rcx, rdi
call fcn.140001db0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x30]
call fcn.140001db0
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009d8e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14009d8ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14009d8fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14009d8e5
lea eax, [rcx + 1]
jmp 0x14009d90b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14009d91e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14009d904
sub eax, 3
jb 0x14009d93e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14009d98d
sar eax, 1
movsxd rbp, eax
jb 0x14009d974
jmp 0x14009d94c
add ebx, ebx
jne 0x14009d94a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14009d974
inc ecx
add ebx, ebx
jne 0x14009d95a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14009d974
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14009d96d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14009d95c
add ecx, 2
jmp 0x14009d979
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14009d8a2
jmp 0x14009d8ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x6600
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14009d9d9
cmp rsi, rcx
jae 0x14009d9e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14009d9c0
cmp al, 0x8f
ja 0x14009d9c0
cmp byte [rsi - 2], 0xf
je 0x14009d9c6
sub al, 0xe8
cmp al, 1
ja 0x14009d9aa
cmp rsi, rcx
jae 0x14009d9e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14009d9b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14009d9e1
lodsb al, byte [rsi]
jmp 0x14009d9c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9b000]
mov eax, dword [rdi]
or eax, eax
je 0x14009da3e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9d1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14009d9ee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14009da38
mov qword [rbx], rax
add rbx, 8
jmp 0x14009da0e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14009da78
cmp al, 0xef
ja 0x14009da6a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14009da4a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14009da59
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14009dacc
sub rsp, 0xffffffffffffff80
jmp 0x140001644
Function at 0x14000f230
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
add qword [rdx + 0x30], 8
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x14000f2d2
mov r11d, 8
mov r8d, 8
sub r8, r9
cmp r8, 8
cmovb r11, r8
xor r10d, r10d
xor eax, eax
cmp r11, 4
mov ecx, ecx
cmovae r10, rcx
setae al
lea rcx, [rax*4 + 1]
shl rax, 2
cmp rcx, r11
jae 0x14000f29b
movzx esi, word [rsp + rax]
lea ecx, [rax*8]
shl rsi, cl
or r10, rsi
or rax, 2
cmp rax, r11
jae 0x14000f2b0
movzx r11d, byte [rsp + rax]
shl eax, 3
mov ecx, eax
shl r11, cl
or r10, r11
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rdx + 0x38]
mov qword [rdx + 0x38], r10
cmp r9, 8
jbe 0x14000f2d7
add r9, 8
jmp 0x14000f416
xor r8d, r8d
jmp 0x14000f32b
mov r9, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx]
add rax, rcx
rol rcx, 0xd
xor r9, r10
xor rcx, rax
rol rax, 0x20
mov r11, qword [rdx + 8]
add r11, r9
rol r9, 0x10
xor r9, r11
add rax, r9
rol r9, 0x15
xor r9, rax
add r11, rcx
rol rcx, 0x11
mov qword [rdx + 0x18], r9
xor rcx, r11
rol r11, 0x20
mov qword [rdx + 0x10], rcx
mov qword [rdx + 8], r11
xor rax, r10
mov qword [rdx], rax
mov eax, 8
sub rax, r8
mov r9d, eax
and r9d, 7
and rax, 0xfffffffffffffff8
cmp r8, rax
jae 0x14000f3b2
mov rcx, qword [rdx]
mov r10, qword [rdx + 8]
mov rsi, qword [rdx + 0x18]
mov r11, qword [rdx + 0x10]
nop word cs:[rax + rax]
add rcx, r11
rol r11, 0xd
mov rdi, qword [rsp + r8]
xor r11, rcx
rol rcx, 0x20
xor rsi, rdi
add r10, rsi
rol rsi, 0x10
xor rsi, r10
add rcx, rsi
rol rsi, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor rsi, rcx
xor rcx, rdi
add r8, 8
cmp r8, rax
jb 0x14000f360
mov qword [rdx + 0x18], rsi
mov qword [rdx + 0x10], r11
mov qword [rdx + 8], r10
mov qword [rdx], rcx
cmp r9d, 3
jbe 0x14000f3cf
mov r10d, dword [rsp + r8]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x14000f3e0
jmp 0x14000f3fa
xor eax, eax
xor r10d, r10d
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x14000f3fa
lea rcx, [rax + r8]
movzx r11d, word [rsp + rcx]
lea ecx, [rax*8]
shl r11, cl
or r10, r11
or rax, 2
cmp rax, r9
jae 0x14000f412
add r8, rax
movzx r8d, byte [rsp + r8]
shl eax, 3
mov ecx, eax
shl r8, cl
or r10, r8
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r9
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x14000f580
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
movzx r9d, word [rdx]
movsxd rax, dword [rdx + 0x3c]
xor r10d, r10d
test rax, rax
setne r10b
xor r11d, r11d
cmp r9d, 0x5a4d
lea r9d, [r10 + r10*4 + 1]
cmovne r9d, r11d
cmp r9b, 6
jne 0x14000f60c
cmp eax, 0x40
jb 0x14000f67a
cmp rax, r8
ja 0x14000f690
movzx r8d, word [rax + rdx + 0x18]
cmp r8d, 0x10b
je 0x14000f611
cmp r8d, 0x20b
jne 0x14000f641
mov r9b, 2
cmp dword [rdx + rax], 0x4550
jne 0x14000f63c
lea r8, [rdx + rax]
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x8664
jne 0x14000f63c
mov r10d, 1
mov r9b, 4
test byte [r8 + 0x16], 2
je 0x14000f63c
jmp 0x14000f657
mov byte [rcx], r9b
jmp 0x14000f644
mov r9b, 2
cmp dword [rdx + rax], 0x4550
jne 0x14000f63c
lea r8, [rdx + rax]
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x14c
jne 0x14000f63c
mov r9b, 4
test byte [r8 + 0x16], 2
jne 0x14000f654
mov byte [rcx], r9b
jmp 0x14000f644
mov byte [rcx], 5
mov qword [rcx + 0x18], 2
mov rax, rcx
add rsp, 0x28
ret
xor r10d, r10d
add rax, 0xffffffffffffffc0
mov qword [rcx], rdx
add rdx, 0x40
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x20], r8
mov rax, rcx
add rsp, 0x28
ret
lea r8, str.memexec_srcpeparserheader.rs
mov ecx, 0x40
mov rdx, rax
call fcn.14013ace0
ud2
lea r9, str.memexec_srcpeparserheader.rs
mov rcx, rax
mov rdx, r8
mov r8, r9
call fcn.14013acd0
ud2
Function at 0x1400439e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
movzx edx, byte [rcx]
add qword [rsi + 0x30], 8
movzx ecx, dl
mov qword [rsp + 0x20], rcx
mov r9, qword [rsi + 0x40]
test r9, r9
je 0x140043ac3
mov r11d, 8
mov r8d, 8
sub r8, r9
cmp r8, 8
cmovb r11, r8
xor r10d, r10d
xor eax, eax
cmp r11, 4
cmovae r10, rcx
setae al
lea rcx, [rax*4 + 1]
shl rax, 2
cmp rcx, r11
jae 0x140043a5a
movzx ebx, word [rsp + rax + 0x20]
lea ecx, [rax*8]
shl rbx, cl
or r10, rbx
or rax, 2
cmp rax, r11
jae 0x140043a70
movzx r11d, byte [rsp + rax + 0x20]
shl eax, 3
mov ecx, eax
shl r11, cl
or r10, r11
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rsi + 0x38]
mov qword [rsi + 0x38], r10
cmp r9, 8
jbe 0x140043ac8
add r9, 8
mov qword [rsi + 0x40], r9
inc rdi
test dl, dl
jne 0x140043c19
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, rsi
call fcn.14000e1a0
mov r8d, 4
jmp 0x140043c3b
xor r8d, r8d
jmp 0x140043b1c
mov r9, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi]
add rax, rcx
rol rcx, 0xd
xor r9, r10
xor rcx, rax
rol rax, 0x20
mov r11, qword [rsi + 8]
add r11, r9
rol r9, 0x10
xor r9, r11
add rax, r9
rol r9, 0x15
xor r9, rax
add r11, rcx
rol rcx, 0x11
mov qword [rsi + 0x18], r9
xor rcx, r11
rol r11, 0x20
mov qword [rsi + 0x10], rcx
mov qword [rsi + 8], r11
xor rax, r10
mov qword [rsi], rax
mov eax, 8
sub rax, r8
mov r9d, eax
and r9d, 7
and rax, 0xfffffffffffffff8
cmp r8, rax
jae 0x140043ba3
mov rcx, qword [rsi]
mov r10, qword [rsi + 8]
mov rbx, qword [rsi + 0x18]
mov r11, qword [rsi + 0x10]
nop word cs:[rax + rax]
add rcx, r11
rol r11, 0xd
mov r14, qword [rsp + r8 + 0x20]
xor r11, rcx
rol rcx, 0x20
xor rbx, r14
add r10, rbx
rol rbx, 0x10
xor rbx, r10
add rcx, rbx
rol rbx, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor rbx, rcx
xor rcx, r14
add r8, 8
cmp r8, rax
jb 0x140043b50
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x10], r11
mov qword [rsi + 8], r10
mov qword [rsi], rcx
cmp r9d, 3
jbe 0x140043bc1
mov r10d, dword [rsp + r8 + 0x20]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x140043bd2
jmp 0x140043bed
xor eax, eax
xor r10d, r10d
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x140043bed
lea rcx, [rax + r8]
movzx r11d, word [rsp + rcx + 0x20]
lea ecx, [rax*8]
shl r11, cl
or r10, r11
or rax, 2
cmp rax, r9
jae 0x140043c06
add r8, rax
movzx r8d, byte [rsp + r8 + 0x20]
shl eax, 3
mov ecx, eax
shl r8, cl
or r10, r8
mov qword [rsi + 0x38], r10
mov qword [rsi + 0x40], r9
inc rdi
test dl, dl
je 0x140043a9c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, rsi
call fcn.14000e1a0
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14000e1a0
Function at 0x14004f690
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
cmp rax, qword [rdx + 0x20]
jne 0x14004f6c2
test rax, rax
je 0x14004f6c9
lea r8, [rax - 0x21]
cmp r8, 0xffffffffffffffe0
jb 0x14004f7d3
cmp rax, 8
jae 0x14004f6d0
xor r9d, r9d
xor r8d, r8d
jmp 0x14004f7b0
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp rax, 0x10
jae 0x14004f73c
xor r9d, r9d
xor r8d, r8d
mov r10, r8
mov r8, rax
and r8, 0xfffffffffffffff8
movzx r9d, r9b
movd xmm0, r9d
nop
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp r8, r10
jne 0x14004f6f0
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, r8
jne 0x14004f7b0
jmp 0x14004f7c8
mov r8, rax
and r8, 0xfffffffffffffff0
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
cmp r8, 0x10
je 0x14004f767
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x10]
pxor xmm2, xmm1
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r9d, xmm0
cmp rax, r8
je 0x14004f7c8
test al, 8
jne 0x14004f6dc
nop word cs:[rax + rax]
movzx r10d, byte [rdx + r8]
xor r10b, byte [rcx + r8]
lea r11, [r8 + 1]
or r9b, r10b
mov r8, r11
cmp rax, r11
jne 0x14004f7b0
test r9b, r9b
sete al
add rsp, 0x28
ret
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rustls_0.21.9_srcmsgshandshake.rsRandom
mov ecx, 0x20
mov edx, 0x20
call fcn.14013a920
ud2
Function at 0x1400936c0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov rdi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
movzx ecx, byte [0x1401fd288]
call fcn.1400bd640
cmp al, 2
jne 0x140093888
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x140160748]
movaps xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [0x140160758]
movaps xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [0x140160768]
movaps xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [0x140160778]
movaps xmmword [rsp + 0x130], xmm0
lea rax, [0x140160748]
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
lea rbp, [rsp + 0x80]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.14009ae00
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.14009ae00
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.14009ae00
lea rcx, [rsp + 0x160]
mov r8d, 0xd8
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x228]
mov r9, qword [rax + 0x50]
movups xmm0, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x1e0]
movups xmm1, xmmword [rsp + 0x1f0]
movups xmm2, xmmword [rsp + 0x200]
movups xmm3, xmmword [rsp + 0x210]
movaps xmmword [rsp + 0x60], xmm3
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
cmp r9, 0x81
jae 0x140093899
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x160]
mov rcx, rsi
call fcn.14009ab00
mov rax, rsi
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401fd288]
call fcn.1401350f0
jmp 0x14009370b
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.5_srcdigest.rs
mov edx, 0x80
mov rcx, r9
call fcn.14013acd0
ud2
Function at 0x1400a0b60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov rcx, rax
call fcn.14002d3b0
mov rcx, rax
mov al, 1
test rdx, rdx
je 0x1400a0c8e
test rcx, rcx
je 0x1400a0c8e
mov r8, qword [rsi + 0x10]
movzx r9d, byte [rcx]
movzx r8d, byte [r8]
not r8b
test r9b, r8b
jne 0x1400a0c8e
mov r10, qword [rsi + 8]
test r10, r10
je 0x1400a0c98
mov r8, qword [rsi]
xor byte [r8], r9b
mov r11d, 1
cmp r10, 1
je 0x1400a0c88
lea rbx, [r10 - 2]
lea rdi, [rdx - 1]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [r8 + 1]
inc rsi
cmp rsi, 0x10
jbe 0x1400a0c5e
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x1400a0c12
add rdi, r8
add rdi, 2
mov rbx, rcx
inc rbx
cmp rbx, rdi
jb 0x1400a0c5e
mov r11d, esi
and r11d, 0xf
mov r14d, reloc.WS2_32.dll_recv
cmovne r14, r11
mov rdi, rsi
sub rdi, r14
lea rbx, [r9 + rdi]
neg r14
lea r11, [rsi + r14]
inc r11
xor esi, esi
nop dword [rax]
movups xmm0, xmmword [rcx + rsi + 1]
movups xmm1, xmmword [r9 + rsi]
xorps xmm1, xmm0
movups xmmword [r9 + rsi], xmm1
add rsi, 0x10
cmp rdi, rsi
jne 0x1400a0c40
mov r9, rbx
add r8, r10
nop word cs:[rax + rax]
cmp rdx, r11
je 0x1400a0c8e
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, r8
jne 0x1400a0c70
cmp r11, rdx
setne al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.5_src_rsapaddingpss.rs
xor ecx, ecx
xor edx, edx
call fcn.14013a920
ud2