joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e450
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
movdqa xmmword [rsp + 0xb0], xmm7
movdqa xmmword [rsp + 0xa0], xmm6
mov rsi, rdx
mov rdi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x14003e4b8
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14003e534
movdqa xmm7, xmmword [rsp + 0x20]
movdqa xmm6, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x90], xmm6
movdqa xmmword [rsp + 0x80], xmm7
mov rax, qword [0x1402141d8]
test rax, rax
je 0x14003e572
lea rbx, [rsp + 0x50]
test eax, 0x4000
jne 0x14003e587
pshufd xmm0, xmm7, 0xee
pshufd xmm1, xmm6, 0xee
movq rax, xmm7
movq rcx, xmm0
movq rdx, xmm6
movq r8, xmm1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
jmp 0x14003e59e
xor ebx, 0x80000000
je 0x14003e4b8
movzx eax, byte [0x140214210]
mov edx, 4
xor ecx, ecx
call fcn.140157b20
test rax, rax
je 0x14003e5f3
mov dword [rax], ebx
mov rcx, qword [0x140214150]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14003e5b6
call fcn.1401b9e10
lea rbx, [rsp + 0x50]
test eax, 0x4000
je 0x14003e4f6
lea r8, [0x1401ef900]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140141530
movdqa xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.140141550
movaps xmm6, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.1401b1500
int3
Function at 0x14004c210
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x7d0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004c220
test al, 1
je 0x14004c2ca
test al, 2
jne 0x14004c2e2
test al, 8
jne 0x14004c25b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call fcn.14004ba00
jmp 0x14004c279
test al, 0x10
je 0x14004c279
mov rax, qword [rsi + 0x7b8]
test rax, rax
je 0x14004c366
mov rcx, qword [rsi + 0x7c0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401861a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004c2fa
jne 0x14004c2c0
mov rcx, rsi
add rsp, 0x7d0
pop rsi
jmp 0x14004bd70
nop
add rsp, 0x7d0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x14004c3b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa10
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004c3c0
test al, 1
je 0x14004c469
test al, 2
jne 0x14004c481
test al, 8
jne 0x14004c3fa
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x60], 0x3b9aca01
lea rdx, [rsp + 0x58]
call fcn.14004b850
jmp 0x14004c418
test al, 0x10
je 0x14004c418
mov rax, qword [rsi + 0x9f8]
test rax, rax
je 0x14004c505
mov rcx, qword [rsi + 0xa00]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401861a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004c499
jne 0x14004c45f
mov rcx, rsi
add rsp, 0xa10
pop rsi
jmp 0x14004c140
nop
add rsp, 0xa10
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x14004c540
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x7d0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004c550
test al, 1
je 0x14004c5fa
test al, 2
jne 0x14004c612
test al, 8
jne 0x14004c58b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call fcn.14004ba00
jmp 0x14004c5a9
test al, 0x10
je 0x14004c5a9
mov rax, qword [rsi + 0x7b8]
test rax, rax
je 0x14004c696
mov rcx, qword [rsi + 0x7c0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140187af0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004c62a
jne 0x14004c5f0
mov rcx, rsi
add rsp, 0x7d0
pop rsi
jmp 0x14004be30
nop
add rsp, 0x7d0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x14004c6e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa10
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004c6f0
test al, 1
je 0x14004c799
test al, 2
jne 0x14004c7b1
test al, 8
jne 0x14004c72a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x60], 0x3b9aca01
lea rdx, [rsp + 0x58]
call fcn.14004b850
jmp 0x14004c748
test al, 0x10
je 0x14004c748
mov rax, qword [rsi + 0x9f8]
test rax, rax
je 0x14004c835
mov rcx, qword [rsi + 0xa00]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140187af0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004c7c9
jne 0x14004c78f
mov rcx, rsi
add rsp, 0xa10
pop rsi
jmp 0x14004bfb0
nop
add rsp, 0xa10
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x14004c870
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004c880
test al, 1
je 0x14004c929
test al, 2
jne 0x14004c941
test al, 8
jne 0x14004c8ba
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xf5], 7
lea rdx, [rsp + 0x58]
call fcn.14004b6c0
jmp 0x14004c8d8
test al, 0x10
je 0x14004c8d8
mov rax, qword [rsi + 0x268]
test rax, rax
je 0x14004c9c5
mov rcx, qword [rsi + 0x270]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401861a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004c959
jne 0x14004c91f
mov rcx, rsi
add rsp, 0x280
pop rsi
jmp 0x14004bef0
nop
add rsp, 0x280
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x14004ca00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14004ca10
test al, 1
je 0x14004cab9
test al, 2
jne 0x14004cad1
test al, 8
jne 0x14004ca4a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xf5], 7
lea rdx, [rsp + 0x58]
call fcn.14004b6c0
jmp 0x14004ca68
test al, 0x10
je 0x14004ca68
mov rax, qword [rsi + 0x268]
test rax, rax
je 0x14004cb55
mov rcx, qword [rsi + 0x270]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140187af0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14004cae9
jne 0x14004caaf
mov rcx, rsi
add rsp, 0x280
pop rsi
jmp 0x14004c080
nop
add rsp, 0x280
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f1750]
mov edx, 0x23
call fcn.1401b1e10
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1790]
mov edx, 0x25
call fcn.1401b1e10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1401013e0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401f17d8]
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x1401f79a8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1401b1c50
int3
Function at 0x140051cd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140051d12
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140051d1a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140051d2b
jmp 0x140051d42
xor r10d, r10d
jmp 0x140051dcd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140051d42
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140051d59
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140051d79
add r11, r8
jmp 0x140051eaa
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140051e42
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140051df0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140051e60
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140051e72
jmp 0x140051e8c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140051e8c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140051ea6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x140067810
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
movdqa xmmword [rsp + 0x140], xmm6
mov qword [rsp + 0xa8], rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp rax, 2
je 0x140067870
lea rdx, [rsi + 0x18]
test rax, rax
je 0x140067865
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x10]
dec r8
and r8, 0xfffffffffffffff0
add rcx, r8
add rcx, 0x10
jmp 0x14006786d
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
call qword [rax + 0x60]
lea rcx, [rsi + 0x28]
movzx eax, byte [rsi + 0x774]
Function at 0x14008c170
Capabilities:
Check for time delay via queryperformancecounter
Send data
Send data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x608
add byte [rax - 0x73], cl
lodsb al, byte [rsi]
and al, 0x80
add byte [rax], 0
add byte [rsi + 0x44], ah
movdqa xmmword [rbp + 0x570], xmm8
test dword [rax + 5], esi
add byte [rax], al
invalid
Function at 0x1400c3630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x1a8]
mov rdx, qword [rdx + 0x1b0]
shl rdx, 4
mov rcx, 0xffffffffffffffff
xor ebx, ebx
movdqa xmm0, xmmword [0x1401bd580]
xor r8d, r8d
nop word cs:[rax + rax]

Function at 0x1400c38e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movups xmmword [rsp + 0x30], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rdx + 0x50]
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm3
movups xmmword [rsp + 0x50], xmm2
movups xmmword [rsp + 0x40], xmm1
and al, 0x40

Function at 0x1400d9180
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x558
movdqa xmmword [rsp + 0x540], xmm6
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x1a8], r9
mov rax, qword [rcx + 0x10]
adc byte [r8 - 0x75], cl
cwde
push 0x48000001
test ebx, ebx

Function at 0x1400eecf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
call fcn.1400054f0
mov rbx, rax
mov rax, qword [rax]
cmp rax, 2
je 0x1400eed2b
test rax, rax
cmp qword [rbx + 8], 0
je 0x1400eed2b
mov r8, qword [rbx + 0x10]
mov rcx, qword [0x140214150]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rbx], 1
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 8], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x18], rax
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400c3630
Function at 0x140113060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1401130f6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
add byte [rsi + 0xf], ah
jg 0x1401130d4
and al, 0x30
Function at 0x140129040
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x1401290ef
mov rbx, rdx
mov rsi, rcx
lea rdi, [rcx + 0x10]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
mov rax, qword [0x140214208]
shl rax, 1
test rax, rax
jne 0x140129163
xor r14d, r14d
movzx eax, byte [rsi + 0x18]
test al, al
jne 0x14012917b
cmp dword [rsi + 0x58], 0x3b9aca00
je 0x1401290c8
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x10]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1401291ba
mov rcx, qword [rbp - 0x10]
call fcn.14014d6f0
mov qword [rsi + 0x50], rax
mov dword [rsi + 0x58], edx
cmp dword [rsi + 0x48], 0x3b9aca00
jne 0x1401290fa
lea rcx, [rsi + 0x20]
cmp qword [rcx], 0
je 0x14012913b
add qword [rsi + 0x28], rbx
cmp dword [rsi + 0x38], 0x3b9aca00
jne 0x14012913b
call fcn.140129a50
jmp 0x14012913b
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x10]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1401291f6
mov rcx, qword [rbp - 0x10]
call fcn.14014d6f0
cmp rax, qword [rsi + 0x40]
jb 0x14012913b
jne 0x14012912a
cmp edx, dword [rsi + 0x48]
jb 0x14012913b
mov dword [rsi + 0x48], 0x3b9aca00
lea rcx, [rsi + 0x20]
cmp qword [rcx], 0
jne 0x1401290db
test r14b, r14b
jne 0x14012914f
mov rax, qword [0x140214208]
shl rax, 1
test rax, rax
jne 0x1401291ab
mov rcx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
call fcn.1401b9760
mov r14d, eax
xor r14b, 1
movzx eax, byte [rsi + 0x18]
test al, al
je 0x140129095
mov qword [rbp - 0x20], rdi
mov byte [rbp - 0x18], r14b
lea rax, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_1.4.1_srcprotoh2ping.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1401f5a72]
lea r9, [0x1401e6038]
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1401b21a0
call fcn.1401b9760
test al, al
jne 0x14012914f
mov byte [rsi + 0x18], 1
jmp 0x14012914f
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x20], rax
lea rax, str.library_std_src_syspalwindows_time.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1401f5a72]
lea r9, fcn.14014ae80
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1401b21a0
jmp 0x140129230
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x20], rax
lea rax, str.library_std_src_syspalwindows_time.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1401f5a72]
lea r9, fcn.14014ae80
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1401b21a0
ud2
Function at 0x140132160
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x988
movaps xmmword [rsp + 0x970], xmm7
movaps xmmword [rsp + 0x960], xmm6
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x7c], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm6, xmmword [0x1401ef510]
movaps xmmword [rsp + 0xb0], xmm6
movups xmm7, xmmword [0x1401ef520]
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0x100], xmm7
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x120], xmm7
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x140], xmm7
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x160], xmm7
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1c0], xmm7
mov eax, dword [0x140214214]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xb0], 0
je 0x14013228b
call fcn.140162c80
mov eax, dword [0x140214214]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r15, qword [rax + 0xb8]
mov r14, qword [rax + 0xc0]
lea rdx, [r15 + 1]
mov qword [rax + 0xb8], rdx
cmp qword [rax + 0xb0], 0
je 0x1401322cb
mov r12, r14
jmp 0x1401322f4
mov r12, r14
call fcn.140162c80
mov eax, dword [0x140214214]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rax + 0xb8]
mov r14, qword [rax + 0xc0]

Function at 0x140133b10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
mov rax, rcx
add qword [rcx + 0x30], 8
add dword [rcx + 0x30], 8