joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140151c40
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140074929
sub rsp, rax
mov rax, qword [0x14019e130]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140168970]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140151e32
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140151d86
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140151d86
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140151d6b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140151d08
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140151df2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140151e51
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140151e2d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140151e51
jmp 0x140151cde
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140075883
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140151f00
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140074929
sub rsp, rax
mov rax, qword [0x14019e130]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140168970]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14015210d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140152059
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140152059
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140152039
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140151fc8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401520cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015212c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140152108
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015212c
jmp 0x140151f9e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140075883
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140003154
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm6
mov rdi, r9
test dil, 0xf
je 0x140003185
mov qword [rcx + 8], 0
jmp 0x140003395
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rcx
mov rcx, rdi
xor edx, edx
call fcn.140272bf2
mov qword [rsp + 0x48], rax
mov r15, rdx
mov rcx, rdx
mov rdx, r14
mov r8, rdi
call fcn.14038a820
mov esi, edi
shr esi, 4
and esi, 7
mov r12, rdi
and r12, 0xffffffffffffff80
mov qword [rsp + 0x28], r15
add r12, r15
lea r14, [rsp + 0xb0]
mov rcx, r14
call fcn.1401e21c8
lea rdx, [rbx + 0x3c0]
mov rcx, r14
mov qword [rsp + 0x40], rdx
call fcn.14026a15c
mov qword [rsp + 0x58], rdi
cmp rdi, 0x80
jb 0x1400032b0
lea r15, [rsp + 0x70]
mov r13, qword [rsp + 0x28]
mov r8d, 0x70
lea rcx, [rsp + 0xc0]
mov rdx, r13
call fcn.14038a820
lea rdx, [r13 + 0x70]
mov rcx, r15
call fcn.14026a15c
mov r14d, 8
mov rdx, r13
cmp r14, 4
mov ebp, 4
cmovb rbp, r14
mov rdi, rbp
shl rdi, 4
add rdi, rdx
mov rcx, rbx
mov r8, rbp
call fcn.14002252d
mov rdx, rdi
sub r14, rbp
jne 0x140003232
lea rax, [r13 + 0x80]
lea rcx, [rsp + 0xb0]
xor edx, edx
inc rdx
xor r8d, r8d
mov r9b, byte [rcx + r8]
xor byte [r13 + r8], r9b
lea r9, [r8 + 1]
mov r8, r9
cmp r9, 0x10
jne 0x140003273
add rcx, 0x10
add r13, 0x10
cmp rdx, 8
jne 0x14000326d
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
mov r13, rax
cmp rax, r12
jne 0x140003207
lea r14, [rsp + 0x70]
lea rdx, [rsp + 0xb0]
mov rcx, r14
call fcn.14026a15c
movups xmm0, xmmword [r14]
mov r13, qword [rsp + 0x40]
movups xmmword [r13], xmm0
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.14026a15c
test rsi, rsi
je 0x14000336c
shl rsi, 4
add rsi, r12
lea r14, [rsp + 0x60]
xorps xmm6, xmm6
lea r15, [rsp + 0x70]
mov rcx, r14
mov rdx, r12
call fcn.14026a15c
xor eax, eax
movups xmmword [rsp + rax + 0x70], xmm6
add rax, 0x10
cmp rax, 0x40
jne 0x14000330a
lea rdi, [r12 + 0x10]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x70], xmm0
mov r8d, 4
mov rcx, rbx
mov rdx, r15
call fcn.14002252d
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [r12], xmm0
xor eax, eax
mov cl, byte [rsp + rax + 0x30]
xor byte [r12 + rax], cl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, 0x10
jne 0x140003345
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm0
mov r12, rdi
cmp rdi, rsi
jne 0x1400032fd
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rcx + 0x10], rax
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000e46d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x14000e4b3
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov r10, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x14000e59b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x14000e5aa
cmp byte [rax + 0x3a], 0
jne 0x14000e5d9
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov bl, byte [rax + 0x38]
mov r8, qword [rax + 0x28]
mov r11d, ebx
xor r11b, 1
test r8, r8
je 0x14000e4ee
cmp r9, r8
jbe 0x14000e4e8
cmp byte [r10 + r8], 0xbf
jg 0x14000e4ee
jmp 0x14000e5e9
jne 0x14000e5e9
cmp r8, r9
je 0x14000e5b1
mov bpl, byte [r10 + r8]
movzx esi, bpl
test sil, sil
jns 0x14000e558
mov edi, esi
and edi, 0x1f
movzx r14d, byte [r10 + r8 + 1]
and r14d, 0x3f
cmp sil, 0xdf
jbe 0x14000e549
movzx esi, byte [r10 + r8 + 2]
shl r14d, 6
and esi, 0x3f
or esi, r14d
cmp bpl, 0xf0
jb 0x14000e553
movzx ebp, byte [r10 + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebp, 0x3f
or ebp, esi
or ebp, edi
mov esi, ebp
jmp 0x14000e558
shl edi, 6
or edi, r14d
mov esi, edi
jmp 0x14000e558
shl edi, 0xc
or esi, edi
test bl, bl
jne 0x14000e5bb
cmp esi, 0x110000
je 0x14000e5d1
mov edi, 1
cmp esi, 0x80
jb 0x14000e58d
mov edi, 2
cmp esi, 0x800
jb 0x14000e58d
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov ebx, r11d
jmp 0x14000e4ce
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
call fcn.1401df764
jmp 0x14000e5de
mov byte [rax + 0x38], r11b
test bl, bl
jne 0x14000e5c2
jmp 0x14000e5d5
mov byte [rax + 0x38], r11b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x14000e5db
mov byte [rax + 0x38], r11b
mov byte [rax + 0x3a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rax + 0x38], r11b
lea rax, str._rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.14038ee40
ud2
Function at 0x14001ae0e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov rbx, rcx
lea rdx, str.APPDATA
lea rsi, [rsp + 0x28]
mov r8d, 7
mov rcx, rsi
call fcn.140230580
cmp byte [rsi + 0x18], 3
jne 0x14001b013
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x70], xmm0
lea rax, [0x140393880]
lea rdx, [rsp + 0xc0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0xda2aa37f787c8a34
mov qword [rdx], rax
mov rdx, qword [rdx]
call fcn.14000ce1d
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x14039c7a0]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0xa8], r8
add rcx, 8
cmp rcx, 0x10
jb 0x14001aeab
mov al, byte [rax + 0x18]
xor al, 0xea
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x18], al
lea rax, [rsp + 0x108]
mov qword [rax], rcx
mov qword [rax + 8], 0x19
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
lea rcx, [0x140009a60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x140071250]
mov qword [rsp + 0x40], rax
lea rax, [0x140498cb8]
lea rdx, [rsp + 0xc0]
mov qword [rdx + 0x10], rax
mov eax, 2
mov qword [rdx + 0x18], rax
mov qword [rdx], 0
mov qword [rdx + 0x20], rsi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x88]
call fcn.1400476f0
cmp qword [rdi], 0
je 0x14001af63
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.1402352a0
cmp dword [rsi], 2
jne 0x14001afae
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 2
jmp 0x14001afcc
lea rax, [rsp + 0x28]
lea rsi, [rsp + 0xc0]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
cmp qword [rax], 2
jne 0x14001afdc
lea rcx, [rsp + 0x30]
call fcn.1401b10eb
mov byte [rbx + 0x18], 2
jmp 0x14001afea
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.140248d80
test r12, r12
je 0x14001b001
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
lea r8, [rsp + 0xc0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, [0x14039c788]
mov qword [rsp + 0x20], rax
lea rcx, [0x1404ccfe2]
lea r9, fcn.1400047d0
mov edx, 0x2b
call fcn.14038ebe0
ud2
Function at 0x140055ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140055b60
cmp r10, r11
jb 0x140055bd6
cmp r10, rdx
ja 0x140055bea
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140055b62
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140055b40
jmp 0x140055bc4
ja 0x140055b6a
mov r11, r10
cmp rax, r8
jne 0x140055b04
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140055ba0
mov rdi, r8
sub ecx, edx
jns 0x140055bbb
jmp 0x140055bc6
cmp r8, rsi
je 0x140055bfb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140055bc6
xor al, 1
cmp rdi, rsi
jne 0x140055b80
jmp 0x140055bc6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14038ebd0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14038e940
ud2
lea rcx, [0x1404ccfb7]
lea r8, str.8E:_
mov edx, 0x2b
call fcn.14038e950
ud2
Function at 0x14005c209
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
not ecx
lea rax, [0x1403a8310]
cmp r8, 0x40
jb 0x14005c33e
add rdx, 0x10
xor r10d, r10d
mov r9d, 0xff
cmp r8, 0xf
jbe 0x14005c36b
movzx esi, byte [rdx - 1]
movzx r11d, byte [rdx - 2]
mov r11d, dword [rax + r11*4 + 0x400]
xor r11d, dword [rax + rsi*4]
movzx esi, byte [rdx - 3]
xor r11d, dword [rax + rsi*4 + 0x800]
movzx esi, byte [rdx - 4]
xor r11d, dword [rax + rsi*4 + 0xc00]
movzx esi, byte [rdx - 5]
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, byte [rdx - 6]
xor r11d, dword [rax + rsi*4 + 0x1400]
movzx esi, byte [rdx - 7]
xor r11d, dword [rax + rsi*4 + 0x1800]
movzx esi, byte [rdx - 8]
xor r11d, dword [rax + rsi*4 + 0x1c00]
movzx esi, byte [rdx - 9]
xor r11d, dword [rax + rsi*4 + 0x2000]
movzx esi, byte [rdx - 0xa]
xor r11d, dword [rax + rsi*4 + 0x2400]
movzx esi, byte [rdx - 0xb]
xor r11d, dword [rax + rsi*4 + 0x2800]
movzx esi, byte [rdx - 0xc]
xor r11d, dword [rax + rsi*4 + 0x2c00]
mov esi, ecx
shr esi, 0x18
movzx edi, byte [rdx - 0xd]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3000]
mov esi, ecx
shr esi, 0x10
and esi, r9d
movzx edi, byte [rdx - 0xe]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3400]
inc r10
mov esi, ecx
shr esi, 8
and esi, r9d
movzx edi, byte [rdx - 0xf]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3800]
and ecx, r9d
movzx esi, byte [rdx - 0x10]
xor esi, ecx
mov ecx, r11d
xor ecx, dword [rax + rsi*4 + 0x3c00]
lea r11, [r8 - 0x10]
cmp r10, 4
jne 0x14005c32e
cmp r11, 0x3f
jbe 0x14005c33a
xor r10d, r10d
add rdx, 0x10
mov r8, r11
jmp 0x14005c22f
add r8, 0xfffffffffffffff0
test r8, r8
je 0x14005c360
xor r9d, r9d
mov r10b, byte [rdx + r9]
xor r10b, cl
movzx r10d, r10b
shr ecx, 8
xor ecx, dword [rax + r10*4]
inc r9
cmp r8, r9
jne 0x14005c346
not ecx
mov eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r8
mov r8, rax
call fcn.14038e8b0
ud2
Function at 0x14005c384
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14005c586
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x14039ab20]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14005c3ea
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x14039ab30]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14005c508
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x14005c4de
movdqa xmm1, xmmword [0x14039ab30]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
xorps xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x14039ab40], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14005c5a4
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14005c209
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14007977a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x18]
xor eax, eax
test rbx, rbx
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.14006e8ab
test rbx, rbx
je 0x1400797c4
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14006e8ab
movzx eax, byte [rdi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.14006e8ab
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400797e6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rax
movabs rax, 0x100000001b3
mov r9, qword [rcx + 0x18]
xor r8d, r8d
test r9, r9
setne r8b
mov qword [rsp], r8
mov r8, qword [rdx]
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor r8, r11
imul r8, rax
cmp r10, 8
jne 0x140079809
test r9, r9
je 0x14007984b
mov r9, qword [rcx + 8]
test r9, r9
je 0x14007986e
mov rcx, qword [rcx]
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor r11, r8
imul r11, rax
inc r10
mov r8, r11
cmp r9, r10
jne 0x140079832
jmp 0x140079871
movzx ecx, byte [rcx]
mov qword [rsp], rcx
xor ecx, ecx
movzx r9d, byte [rsp + rcx]
inc rcx
xor r8, r9
imul r8, rax
cmp rcx, 8
jne 0x140079854
mov qword [rdx], r8
jmp 0x140079874
mov r11, r8
mov qword [rdx], r11
pop rax
ret
Function at 0x1400fbae4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
mov rsi, rcx
lea rdi, [rsp + 0x88]
mov rcx, rdi
call fcn.1400f6fde
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.1400f7244
mov al, byte [rbx + 0x38]
mov r13, qword [rbx]
cmp al, 0xc
jne 0x1400fbc11
mov eax, dword [r13 + 0x48]
mov dword [rsp + 0x24], eax
mov r15, qword [r13 + 8]
mov rdi, qword [r13 + 0x10]
mov rcx, rdi
xor edx, edx
call fcn.14024c47c
mov qword [rsp + 0x40], rax
mov rcx, rdx
mov qword [rsp + 0x38], rdx
mov rdx, r15
mov r8, rdi
call fcn.14038a820
mov r12, qword [r13 + 0x20]
mov r15, qword [r13 + 0x28]
mov rcx, r15
xor edx, edx
call fcn.14024c47c
mov qword [rsp + 0x30], rax
mov rbp, rdx
mov rcx, rdx
mov rdx, r12
mov r8, r15
call fcn.14038a820
mov r12, qword [r13 + 0x38]
mov rbx, qword [r13 + 0x40]
mov rcx, rbx
xor edx, edx
call fcn.14024c47c
mov qword [rsp + 0x28], rax
mov r14, rdx
mov rcx, rdx
mov rdx, r12
mov r8, rbx
call fcn.14038a820
movzx eax, word [r13 + 0x50]
mov ecx, dword [r13 + 0x4c]
mov dl, byte [r13 + 0x52]
mov r8, qword [rsp + 0x40]
mov qword [rsi], r8
mov r8, qword [rsp + 0x38]
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdi
mov r8, qword [rsp + 0x30]
mov qword [rsi + 0x18], r8
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x28], r15
mov r8, qword [rsp + 0x28]
mov qword [rsi + 0x30], r8
mov qword [rsi + 0x38], r14
mov qword [rsi + 0x40], rbx
mov r8d, dword [rsp + 0x24]
mov dword [rsi + 0x48], r8d
mov dword [rsi + 0x4c], ecx
mov word [rsi + 0x50], ax
mov byte [rsi + 0x52], dl
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x53], eax
mov al, byte [rsp + 0x4c]
mov byte [rsi + 0x57], al
jmp 0x1400fbc4a
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmm2, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov ecx, dword [rsp + 0x81]
mov edx, dword [rsp + 0x84]
mov dword [rsi + 0x39], ecx
mov dword [rsi + 0x3c], edx
mov qword [rsi], r13
mov byte [rsi + 0x38], al
mov byte [rsi + 0x50], 2
lea rcx, [rsp + 0x88]
call fcn.1400fb074
nop
add rsp, 0x3a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret