joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c39b0
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x4c3a02
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4c3a02
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4c3a02
mov rbx, rax
xor esi, esi
jmp 0x4c3a86
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x4c3af0
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4c3af0
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4c3af0
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4c3af0
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x4c3af0
mov rbx, qword [rsp + 0x28]
movzx eax, byte [0x0083c308]
mov edx, 0x18
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4c3b27
mov r14, rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbx
xor eax, eax
lock cmpxchg qword [0x0083c080], r14
je 0x4c3ae3
mov rsi, rax
cmp qword [r14], 0
je 0x4c3acf
mov rcx, qword [r14 + 0x10]
call fcn.006f5a3c
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, r14
call fcn.006f5b74
mov r14, rsi
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._home_slixe_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.10_src_thread_parker_windows_mod.rs
lea rcx, [rsp + 0x28]
call sym.core::panicking::panic_fmt::h9e181c62584cc428
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
ud2

Function at 0x4c3b80
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx + 0x38]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4c3b98
dec ecx
jmp 0x4c3ba2
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
mov edx, 1
call fcn.006f5c64
lock dec qword [0x0083c070]
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4c3bd0
dec ecx
jmp 0x4c3bda
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
xor edx, edx
call fcn.006f5c64
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x4c59a0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4c59b8
dec ecx
jmp 0x4c59c2
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
mov edx, 1
call fcn.006f5c64
mov r8, qword [rdi]
dec qword [r8]
jne 0x4c59e8
dec qword [r8 + 8]
jne 0x4c59e8
mov rcx, qword [0x0083c108]
xor edx, edx
call fcn.006f5b74
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4c5a04
dec ecx
jmp 0x4c5a0e
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
xor edx, edx
call fcn.006f5c64
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x4e8d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4e8d6c
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e8d85
add rax, 8
jmp 0x4e8e20
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e8d63
je 0x4e8e1e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x0083c308]
mov edx, 0x18
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4e8e4d
mov rbx, rax
mov rsi, rax
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4e8e2d
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4e8e3d
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
je 0x4e8e19
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov rax, rbx
jmp 0x4e8e20
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4e8de3
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4e8df7
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
int3

Function at 0x4e8e60
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4e8e77
dec ecx
jmp 0x4e8e81
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
mov edx, 1
call fcn.006f5c64
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4e8ea7
dec ecx
jmp 0x4e8eb1
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
xor edx, edx
call fcn.006f5c64
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x53e240
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
sub rbx, rdx
je 0x53e32b
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x53e403
mov rdi, rdx
movzx eax, byte [0x0083c308]
xor ecx, ecx
mov rdx, rbx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x53e408
shr r14, 3
cmp rbx, 0x80
jae 0x53e348
xor ecx, ecx
mov rdx, rcx
or rdx, 1
test bl, 8
je 0x53e2d0
mov r8d, dword [rdi + rcx*8]
mov r9d, dword [rdi + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp r14, rdx
je 0x53e333
nop word cs:[rax + rax]
mov edx, dword [rdi + rcx*8]
mov r8d, dword [rdi + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [rdi + rcx*8 + 8]
mov r8d, dword [rdi + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp r14, rcx
jne 0x53e2e0
jmp 0x53e333
xor r14d, r14d
mov eax, 4
mov qword [rsi], r14
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x53e2a1
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x53e2a1
lea rdx, [r14 - 1]
shr rdx, 0x3d
jne 0x53e2a1
movabs rcx, 0xffffffffffffffe
and rcx, r14
xor edx, edx
movdqa xmm0, xmmword [0x00721360]
nop dword [rax + rax]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x53e3a0
cmp r14, rcx
jne 0x53e2a1
jmp 0x53e333
call sym.alloc::raw_vec::capacity_overflow::h29d4877d33cf78a3
mov ecx, 4
mov rdx, rbx
call sym.alloc::raw_vec::handle_error::h5313441c9bd13595
int3
Function at 0x55ba30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x55bb10
mov rsi, r8
test r8, r8
je 0x55bb34
mov rdi, rdx
mov r14, rsi
shl r14, 6
cmp rsi, 4
jae 0x55ba73
xor eax, eax
jmp 0x55bab0
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x55ba80
cmp rax, rsi
je 0x55bac7
nop dword [rax]
mov rdx, qword [rbx + rax*8]
not rdx
mov qword [rdi + rax*8], rdx
lea rdx, [rax + 1]
mov rax, rdx
cmp rsi, rdx
jne 0x55bab0
or byte [rdi], 1
sub r14, qword [rcx + 0x20]
je 0x55bb06
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call sym.ring_core_0_17_8_LIMBS_shl_mod
dec r14
jne 0x55baf0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x38], 0
lea r9, str._home_slixe_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_arithmetic_bigint_modulus.rs
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
call sym.core::panicking::assert_failed::h689e79a769bcde02
lea r8, [0x0079fd18]
xor ecx, ecx
xor edx, edx
call sym.core::panicking::panic_bounds_check::ha5eba36dbaff2278
int3
Function at 0x55c2f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x58
mov al, 1
cmp rdx, 0x20
jne 0x55c483
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [rcx]
movzx edx, byte [rcx + 1]
movzx r8d, byte [rcx + 2]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 3]
movzx r8d, byte [rcx + 4]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 5]
movzx r8d, byte [rcx + 6]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 7]
or rax, rdx
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 8]
movzx edx, byte [rcx + 9]
movzx r8d, byte [rcx + 0xa]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0xb]
movzx r8d, byte [rcx + 0xc]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0xd]
movzx r8d, byte [rcx + 0xe]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0xf]
or rax, rdx
mov qword [rsp + 0x30], rax
movzx eax, byte [rcx + 0x10]
movzx edx, byte [rcx + 0x11]
movzx r8d, byte [rcx + 0x12]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x13]
movzx r8d, byte [rcx + 0x14]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x15]
movzx r8d, byte [rcx + 0x16]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x17]
or rax, rdx
mov qword [rsp + 0x28], rax
movzx eax, byte [rcx + 0x18]
movzx edx, byte [rcx + 0x19]
movzx r8d, byte [rcx + 0x1a]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x1b]
movzx r8d, byte [rcx + 0x1c]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x1d]
movzx r8d, byte [rcx + 0x1e]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x1f]
or rax, rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x0079fea0]
lea rcx, [rsp + 0x20]
mov r8d, 4
call sym.ring_core_0_17_8_LIMBS_less_than
mov rcx, rax
mov al, 1
cmp rcx, 0xffffffffffffffff
je 0x55c488
add rsp, 0x58
ret
lea rcx, [rsp + 0x20]
mov edx, 4
call sym.ring_core_0_17_8_LIMBS_are_zero
test rax, rax
setne al
add rsp, 0x58
ret
Function at 0x55c4b0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, r8
mov rdi, rcx
mov r12, qword [rdx + 0x28]
cmp r9, 0x20
jne 0x55c694
mov ebp, 0x64
xorps xmm6, xmm6
lea r14, [0x0079fea0]
lea r15, [rsp + 0x20]
jmp 0x55c4f8
dec ebp
je 0x55c6bc
mov r8d, 0x20
mov rcx, rdi
mov rdx, rsi
call r12
mov bl, 1
test al, al
jne 0x55c6bc
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
movzx eax, byte [rsi]
movzx ecx, byte [rsi + 1]
movzx edx, byte [rsi + 2]
shl eax, 0x10
shl ecx, 8
or ecx, eax
or ecx, edx
movzx eax, byte [rsi + 3]
movzx edx, byte [rsi + 4]
shl rcx, 0x10
shl eax, 8
or rax, rcx
or rax, rdx
movzx ecx, byte [rsi + 5]
movzx edx, byte [rsi + 6]
shl rax, 0x10
shl ecx, 8
or rcx, rax
or rcx, rdx
shl rcx, 8
movzx eax, byte [rsi + 7]
or rax, rcx
mov qword [rsp + 0x38], rax
movzx eax, byte [rsi + 8]
movzx ecx, byte [rsi + 9]
movzx edx, byte [rsi + 0xa]
shl eax, 0x10
shl ecx, 8
or ecx, eax
or ecx, edx
movzx eax, byte [rsi + 0xb]
movzx edx, byte [rsi + 0xc]
shl rcx, 0x10
shl eax, 8
or rax, rcx
or rax, rdx
movzx ecx, byte [rsi + 0xd]
movzx edx, byte [rsi + 0xe]
shl rax, 0x10
shl ecx, 8
or rcx, rax
or rcx, rdx
shl rcx, 8
movzx eax, byte [rsi + 0xf]
or rax, rcx
mov qword [rsp + 0x30], rax
movzx eax, byte [rsi + 0x10]
movzx ecx, byte [rsi + 0x11]
movzx edx, byte [rsi + 0x12]
shl eax, 0x10
shl ecx, 8
or ecx, eax
or ecx, edx
movzx eax, byte [rsi + 0x13]
movzx edx, byte [rsi + 0x14]
shl rcx, 0x10
shl eax, 8
or rax, rcx
or rax, rdx
movzx ecx, byte [rsi + 0x15]
movzx edx, byte [rsi + 0x16]
shl rax, 0x10
shl ecx, 8
or rcx, rax
or rcx, rdx
shl rcx, 8
movzx eax, byte [rsi + 0x17]
or rax, rcx
mov qword [rsp + 0x28], rax
movzx eax, byte [rsi + 0x18]
movzx ecx, byte [rsi + 0x19]
movzx edx, byte [rsi + 0x1a]
shl eax, 0x10
shl ecx, 8
or ecx, eax
or ecx, edx
movzx eax, byte [rsi + 0x1b]
movzx edx, byte [rsi + 0x1c]
shl rcx, 0x10
shl eax, 8
or rax, rcx
or rax, rdx
movzx ecx, byte [rsi + 0x1d]
movzx edx, byte [rsi + 0x1e]
shl rax, 0x10
shl ecx, 8
or rcx, rax
or rcx, rdx
shl rcx, 8
movzx eax, byte [rsi + 0x1f]
or rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, 4
mov rcx, r15
mov rdx, r14
call sym.ring_core_0_17_8_LIMBS_less_than
cmp rax, 0xffffffffffffffff
jne 0x55c4f0
mov edx, 4
mov rcx, r15
call sym.ring_core_0_17_8_LIMBS_are_zero
test rax, rax
jne 0x55c4f0
xor ebx, ebx
jmp 0x55c6bc
mov r14, r9
mov ebp, 0x63
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
mov r8, r14
call r12
sub ebp, 1
setb cl
mov bl, 1
test al, al
jne 0x55c6bc
test cl, cl
je 0x55c6a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x55c700
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x58
mov al, 1
cmp rdx, 0x30
jne 0x55c93b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [rcx]
movzx edx, byte [rcx + 1]
movzx r8d, byte [rcx + 2]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 3]
movzx r8d, byte [rcx + 4]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 5]
movzx r8d, byte [rcx + 6]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 7]
or rax, rdx
mov qword [rsp + 0x48], rax
movzx eax, byte [rcx + 8]
movzx edx, byte [rcx + 9]
movzx r8d, byte [rcx + 0xa]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0xb]
movzx r8d, byte [rcx + 0xc]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0xd]
movzx r8d, byte [rcx + 0xe]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0xf]
or rax, rdx
mov qword [rsp + 0x40], rax
movzx eax, byte [rcx + 0x10]
movzx edx, byte [rcx + 0x11]
movzx r8d, byte [rcx + 0x12]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x13]
movzx r8d, byte [rcx + 0x14]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x15]
movzx r8d, byte [rcx + 0x16]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x17]
or rax, rdx
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x18]
movzx edx, byte [rcx + 0x19]
movzx r8d, byte [rcx + 0x1a]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x1b]
movzx r8d, byte [rcx + 0x1c]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x1d]
movzx r8d, byte [rcx + 0x1e]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x1f]
or rax, rdx
mov qword [rsp + 0x30], rax
movzx eax, byte [rcx + 0x20]
movzx edx, byte [rcx + 0x21]
movzx r8d, byte [rcx + 0x22]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x23]
movzx r8d, byte [rcx + 0x24]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x25]
movzx r8d, byte [rcx + 0x26]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x27]
or rax, rdx
mov qword [rsp + 0x28], rax
movzx eax, byte [rcx + 0x28]
movzx edx, byte [rcx + 0x29]
movzx r8d, byte [rcx + 0x2a]
shl eax, 0x10
shl edx, 8
or edx, eax
or edx, r8d
movzx eax, byte [rcx + 0x2b]
movzx r8d, byte [rcx + 0x2c]
shl rdx, 0x10
shl eax, 8
or rax, rdx
or rax, r8
movzx edx, byte [rcx + 0x2d]
movzx r8d, byte [rcx + 0x2e]
shl rax, 0x10
shl edx, 8
or rdx, rax
or rdx, r8
shl rdx, 8
movzx eax, byte [rcx + 0x2f]
or rax, rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x0079ffb0]
lea rcx, [rsp + 0x20]
mov r8d, 6
call sym.ring_core_0_17_8_LIMBS_less_than
mov rcx, rax
mov al, 1
cmp rcx, 0xffffffffffffffff
je 0x55c940
add rsp, 0x58
ret
lea rcx, [rsp + 0x20]
mov edx, 6
call sym.ring_core_0_17_8_LIMBS_are_zero
test rax, rax
setne al
add rsp, 0x58
ret
Function at 0x55c960
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, r8
mov rdi, rcx
mov r12, qword [rdx + 0x28]
cmp r9, 0x30
jne 0x55cbe4
mov ebp, 0x64
xorps xmm6, xmm6
lea r14, [0x0079ffb0]
lea r15, [rsp + 0x20]
jmp 0x55c9a8
mov r14, r9
mov ebp, 0x63
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
mov r8, r14
call r12
sub ebp, 1
setb cl
mov bl, 1
test al, al
jne 0x55cc0c
test cl, cl
je 0x55cbf0
Function at 0x563de0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov al, 1
test rdx, rdx
je 0x563ede
movzx r10d, byte [rcx]
mov r9, qword [r8]
movzx r9d, byte [r9]
not r9b
test r10b, r9b
jne 0x563ede
mov r9, qword [r8 + 0x10]
test r9, r9
je 0x563ee6
mov r8, qword [r8 + 8]
xor byte [r8], r10b
mov r10d, 1
cmp r9, 1
je 0x563ed8
lea rsi, [r8 + 1]
lea r10, [rdx - 1]
lea rdi, [r9 - 2]
cmp r10, rdi
cmovb rdi, r10
mov r10d, 1
cmp rdi, 0xf
jbe 0x563e6a
lea r11, [rcx + rdi]
add r11, 2
cmp rsi, r11
jae 0x563e6f
lea r11, [r8 + rdi]
add r11, 2
lea rbx, [rcx + 1]
cmp rbx, r11
jae 0x563e6f
mov r11, rsi
jmp 0x563eb2
inc rdi
mov r10d, edi
and r10d, 0xf
mov r11d, 0x10
cmovne r11, r10
sub rdi, r11
lea r11, [rsi + rdi]
xor r10d, r10d
nop dword [rax]
movups xmm0, xmmword [rcx + r10 + 1]
movups xmm1, xmmword [rsi + r10]
xorps xmm1, xmm0
movups xmmword [rsi + r10], xmm1
add r10, 0x10
cmp rdi, r10
jne 0x563e90
inc rdi
mov r10, rdi
add r8, r9
nop word cs:[rax + rax]
cmp rdx, r10
je 0x563ede
movzx r9d, byte [rcx + r10]
xor byte [r11], r9b
inc r10
inc r11
cmp r11, r8
jne 0x563ec0
cmp r10, rdx
setne al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea r8, str._home_slixe_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_rsa_padding_pss.rs
xor ecx, ecx
xor edx, edx
call sym.core::panicking::panic_bounds_check::ha5eba36dbaff2278
int3

Function at 0x56a640
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x56a665
cmp rax, rcx
je 0x56a66b
cmp rdx, 4
jae 0x56a66f
xor eax, eax
xor r8d, r8d
jmp 0x56a700
pop rbp
jmp sym.core::str::count::do_count_chars::h2fd5de11ed1589cd
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x00721c10]
movdqa xmm3, xmmword [0x00721c20]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x56a690
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x56a717
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x56a700
pop rbp
ret
Function at 0x57ef90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
cmp rax, qword [rdx + 0x20]
jne 0x57efc2
test rax, rax
je 0x57efc9
lea r8, [rax - 0x21]
cmp r8, 0xffffffffffffffe0
jb 0x57f0d3
cmp rax, 7
ja 0x57efd0
xor r9d, r9d
xor r8d, r8d
jmp 0x57f0b0
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp rax, 0x10
jae 0x57f03c
xor r9d, r9d
xor r8d, r8d
mov r10, r8
mov r8d, eax
and r8d, 0x38
movzx r9d, r9b
movd xmm0, r9d
nop
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp r8, r10
jne 0x57eff0
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, r8
jne 0x57f0b0
jmp 0x57f0c8
mov r8d, eax
and r8d, 0x30
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
pxor xmm1, xmm1
cmp r8, 0x10
je 0x57f067
movdqu xmm2, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rdx + 0x10]
pxor xmm1, xmm2
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r9d, xmm0
cmp rax, r8
je 0x57f0c8
test al, 8
jne 0x57efdc
nop dword [rax]
movzx r10d, byte [rdx + r8]
xor r10b, byte [rcx + r8]
lea r11, [r8 + 1]
or r9b, r10b
mov r8, r11
cmp rax, r11
jne 0x57f0b0
test r9b, r9b
sete al
add rsp, 0x28
ret
lea r8, [0x007a99c0]
mov ecx, 0x20
mov edx, 0x20
call sym.core::panicking::panic_bounds_check::ha5eba36dbaff2278
int3
Function at 0x59f580
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x59f5e9
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x59f5a8
add rdi, rbx
sub rsi, rbx
je 0x59f5e9
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x59f5a0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x59f5a0
test ebp, 0x7fffffff
setne al
jmp 0x59f5eb
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x5a3560
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x5a35c9
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x5a3588
add rdi, rbx
sub rsi, rbx
je 0x5a35c9
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x5a3580
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x5a3580
test ebp, 0x7fffffff
setne al
jmp 0x5a35cb
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret