joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010bde0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1fe0
call fcn.1401f8c70
sub rsp, rax
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14010be00
test al, 1
je 0x14010bf2a
test al, 2
jne 0x14010bf44
test al, 8
jne 0x14010be58
mov qword [rsp + 0x1030], 4
mov rdi, qword [rsi + 0x28]
call fcn.1401b1020
test rax, rax
je 0x14010be78
mov rbx, qword [rax + 0x30]
mov r15, qword [rax + 0x38]
mov qword [rax + 0x30], 1
mov qword [rax + 0x38], rdi
cmp rbx, 2
je 0x14010be78
jmp 0x14010be7a
test al, 0x10
je 0x14010bec9
mov rax, qword [rsi + 0xff8]
test rax, rax
je 0x14010bfcc
mov rcx, qword [rsi + 0xff0]
call qword [rax + 0x10]
jmp 0x14010bec9
xor ebx, ebx
lea rdi, [rsi + 0x30]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x1030]
mov r8d, 0xfb0
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call fcn.14010b440
lea rdx, [rsp + 0x80]
mov r8d, 0xfb0
mov rcx, rdi
call sub.msvcrt.dll_memcpy
call fcn.1401b1020
test rax, rax
je 0x14010bec9
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], r15
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401bf240
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14010bf5e
jne 0x14010bf1a
mov rcx, rsi
call fcn.1400f80f0
mov r8, qword [rsi - 8]
mov rcx, qword [0x14031a128]
xor edx, edx
call fcn.1401f903c
nop
add rsp, 0x1fe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140298d68]
mov edx, 0x23
call fcn.14002cb80
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140298da8]
mov edx, 0x25
call fcn.14002cb80
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14002bad0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__r__
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x140298df0]
lea rcx, [rsp + 0x50]
call fcn.14002ba10
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 0
lea rax, [0x1402be068]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x80]
call fcn.14002ba10
ud2
Function at 0x14010cd80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1fe0
call fcn.1401f8c70
sub rsp, rax
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14010cda0
test al, 1
je 0x14010ceca
test al, 2
jne 0x14010cee4
test al, 8
jne 0x14010cdf8
mov qword [rsp + 0x1030], 4
mov rdi, qword [rsi + 0x28]
call fcn.1401b1020
test rax, rax
je 0x14010ce18
mov rbx, qword [rax + 0x30]
mov r15, qword [rax + 0x38]
mov qword [rax + 0x30], 1
mov qword [rax + 0x38], rdi
cmp rbx, 2
je 0x14010ce18
jmp 0x14010ce1a
test al, 0x10
je 0x14010ce69
mov rax, qword [rsi + 0xff8]
test rax, rax
je 0x14010cf6c
mov rcx, qword [rsi + 0xff0]
call qword [rax + 0x10]
jmp 0x14010ce69
xor ebx, ebx
lea rdi, [rsi + 0x30]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x1030]
mov r8d, 0xfb0
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call fcn.14010b440
lea rdx, [rsp + 0x80]
mov r8d, 0xfb0
mov rcx, rdi
call sub.msvcrt.dll_memcpy
call fcn.1401b1020
test rax, rax
je 0x14010ce69
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], r15
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401bf240
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14010cefe
jne 0x14010ceba
mov rcx, rsi
call fcn.1400f8060
mov r8, qword [rsi - 8]
mov rcx, qword [0x14031a128]
xor edx, edx
call fcn.1401f903c
nop
add rsp, 0x1fe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140298d68]
mov edx, 0x23
call fcn.14002cb80
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140298da8]
mov edx, 0x25
call fcn.14002cb80
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14002bad0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__r__
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x140298df0]
lea rcx, [rsp + 0x50]
call fcn.14002ba10
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 0
lea rax, [0x1402be068]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x80]
call fcn.14002ba10
ud2
Function at 0x140137bb0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rdi, r9
mov rbx, r8
mov r15, rcx
mov r14, qword [rsp + 0x290]
movups xmm0, xmmword [0x14028ae18]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x14028ae08]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x14028adf8]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x14028ade8]
movaps xmmword [rsp + 0x30], xmm0
lea rax, [0x14028adb8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rsi, [rsp + 0x30]
mov r8d, 0x20
mov rcx, rsi
call fcn.140136060
mov r8d, 0x20
mov rcx, rsi
mov rdx, rbx
call fcn.140136060
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.140136060
lea rcx, [rsp + 0x168]
mov r8d, 0xd8
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x1b0]
mov r9, qword [rax + 0x10]
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movaps xmm3, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x140], xmm3
movaps xmmword [rsp + 0x130], xmm2
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
cmp r9, 0x81
jae 0x140137d36
lea r8, [rsp + 0x1c0]
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x110]
mov rcx, r15
call fcn.1401362f0
nop
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_srcdigest.rs
mov edx, pe_nt_image_headers64
mov rcx, r9
call fcn.14002c6f0
ud2
Function at 0x14013d030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x14013d209
mov r14, r8
mov r12, rdx
mov edx, 0x40
mov rax, r8
mul rdx
jo 0x14013d1c5
test r14, r14
je 0x14013d236
mov r15, qword [rcx]
cmp r14, 4
jae 0x14013d084
xor edi, edi
jmp 0x14013d140
mov rdi, r14
and rdi, 0xfffffffffffffffc
lea rbx, [rdi - 4]
mov r8, rbx
shr r8, 2
inc r8
test rbx, rbx
je 0x14013d1b4
mov rbx, r8
and rbx, 0xfffffffffffffffe
xor esi, esi
pcmpeqd xmm0, xmm0
nop
movdqu xmm1, xmmword [r15 + rsi*8]
movdqu xmm2, xmmword [r15 + rsi*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r12 + rsi*8], xmm1
movdqu xmmword [r12 + rsi*8 + 0x10], xmm2
movdqu xmm1, xmmword [r15 + rsi*8 + 0x20]
movdqu xmm2, xmmword [r15 + rsi*8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r12 + rsi*8 + 0x20], xmm1
movdqu xmmword [r12 + rsi*8 + 0x30], xmm2
add rsi, 8
add rbx, 0xfffffffffffffffe
jne 0x14013d0b0
test r8b, 1
je 0x14013d12c
movdqu xmm0, xmmword [r15 + rsi*8]
movdqu xmm1, xmmword [r15 + rsi*8 + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [r12 + rsi*8], xmm0
movdqu xmmword [r12 + rsi*8 + 0x10], xmm1
cmp rdi, r14
je 0x14013d157
nop word cs:[rax + rax]
mov rbx, qword [r15 + rdi*8]
not rbx
mov qword [r12 + rdi*8], rbx
lea rdx, [rdi + 1]
mov rdi, rdx
cmp r14, rdx
jne 0x14013d140
or byte [r12], 1
mov rsi, qword [rcx + 0x20]
mov rcx, rax
sub rcx, rsi
jb 0x14013d1d5
je 0x14013d1a6
cmp rcx, 0x40
jae 0x14013d1ef
mov rdx, qword [r12 + r14*8 - 8]
shl rdx, cl
shr rdx, cl
mov qword [r12 + r14*8 - 8], rdx
sub rsi, rax
nop word cs:[rax + rax]
mov rcx, r12
mov rdx, r12
mov r8, r15
mov r9, r14
call fcn.140209970
inc rsi
jne 0x14013d190
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
test r8b, 1
jne 0x14013d106
jmp 0x14013d12c
lea rcx, str.attempt_to_multiply_with_overflowInvalidEncodingC:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigint_boxed_limbs.rs
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigintmodulus.rs
jmp 0x14013d1e3
lea rcx, str.attempt_to_subtract_with_overflowSHA1SHA256SHA384SHA512SHA512_256
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigintmodulus.rs
mov edx, 0x21
call fcn.14002cb80
ud2
lea rcx, str.attempt_to_shift_right_with_overflowC:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigint.rs
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigintmodulus.rs
mov edx, 0x24
call fcn.14002cb80
ud2
mov qword [rsp + 0x38], 0
lea rax, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_arithmetic_bigintmodulus.rs
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x38]
xor ecx, ecx
call fcn.14012f210
ud2
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_srclimb.rs
xor ecx, ecx
xor edx, edx
call fcn.14002ba50
ud2
Function at 0x140143c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x140143ce2
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x140143ce2
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x140143cfd
cmp eax, 0x42
jne 0x140143ce2
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x140143d3a
cmp byte [rdi + rcx], 0x5f
jne 0x140143d3a
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x140143e32
mov rcx, rsi
xor edx, edx
call fcn.14013eda0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.14013eda0
test al, al
jne 0x140143d35
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140143dac
lea rdx, [0x14028cedb]
mov r8d, 1
call fcn.14002c780
test al, al
je 0x140143dac
mov dil, 2
jmp 0x140143cf1
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x140143e4e
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x140143e26
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x140143d8f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x140143d7e
add dl, 0xa9
jmp 0x140143d8d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140143e4e
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x140143e4e
movzx edx, bl
add rax, rdx
jae 0x140143d50
jmp 0x140143e4e
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x140143cf1
xor ebx, ebx
lea r14, [0x14028d2c6]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140143de4
cmp byte [rax + rcx], 0x45
je 0x140143edc
sub rbx, 1
jb 0x140143e09
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140143e09
mov r8d, 2
mov rdx, r14
call fcn.14002c780
test al, al
jne 0x140143d35
mov rcx, rsi
call fcn.140143ef0
test al, al
jne 0x140143d35
mov rax, qword [rsi]
test rax, rax
jne 0x140143dd0
jmp 0x140143cf1
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x140143e4e
cmp rax, r9
jae 0x140143e4b
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
jbe 0x140143e9f
mov bl, 1
xor r8d, r8d
jmp 0x140143e50
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140143e8e
lea rax, [0x14028d291]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14002c780
mov dil, 2
test al, al
jne 0x140143cf1
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x140143cf1
cmp qword [rsi + 0x20], 0
je 0x140143e98
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140143c90
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140143cf3
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x140143cf1
Function at 0x1401481e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140148227
mov r15d, 8
sub r15, r11
cmp r8, r15
mov rax, r15
cmovb rax, r8
cmp rax, 3
jbe 0x14014822f
mov r14d, dword [rdx]
mov r10d, 4
mov rcx, r10
or rcx, 1
cmp rcx, rax
jb 0x140148241
jmp 0x140148258
xor r15d, r15d
jmp 0x1401482e5
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140148258
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x14014826f
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x14014828f
add r11, r8
jmp 0x1401483ca
mov rdi, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x30], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rcx
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140148363
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
nop dword [rax + rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140148310
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 3
jbe 0x140148381
mov esi, dword [rdx + r15]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r11
jb 0x140148392
jmp 0x1401483ac
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x1401483ac
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x1401483c6
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140188b70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140188bee
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140188c2f
cmp dword [rsp + 0x2c], 0
je 0x140188c13
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140188c57
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x14031a148]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14031a148], rsi
jne 0x140188bd0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x140188c25
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140188cad
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140188c18
mov edi, dword [rsp + 0x28]
jmp 0x140188c25
mov edi, dword [rsi + 0x18]
jmp 0x140188c23
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x140294fc0]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140189680
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea rax, [0x1402be068]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.14002ba10
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea rax, [0x1402be068]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1401896e0
ud2
Function at 0x140189530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14021e128]
test ecx, ecx
je 0x14018955f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140189578
mov rdi, rax
cmp qword [rax], 0
je 0x140189578
add rdi, 8
jmp 0x14018964f
lea rcx, [0x14021e110]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14018954d
mov ecx, dword [0x14021e128]
test ecx, ecx
je 0x140189630
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14018964d
mov rsi, rax
test rax, rax
jne 0x140189602
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x1401895c3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140189669
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140189669
mov rsi, rax
mov qword [rax], 0
lea rax, [0x14021e110]
mov qword [rsi + 0x18], rax
mov ecx, dword [0x14021e128]
test ecx, ecx
je 0x140189659
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 8]
cmp qword [rsi], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
je 0x14018964f
test rcx, rcx
je 0x14018964f
lock dec qword [rcx]
jne 0x14018964f
call fcn.140081400
jmp 0x14018964f
lea rcx, [0x14021e110]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140189597
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14021e110]
call fcn.140188b70
mov ecx, eax
jmp 0x1401895fa
mov ecx, 0x20
mov edx, 8
call fcn.1400270c0
ud2

Function at 0x140189d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14021e108]
test ecx, ecx
je 0x140189dbf
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140189d2d
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x140189db9
mov ecx, dword [0x14021e108]
test ecx, ecx
je 0x140189de1
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140189dfe
mov rsi, rax
test rax, rax
jne 0x140189db3
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x140189d78
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140189e19
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140189e19
mov rsi, rax
mov byte [rax + 8], 0
lea rax, [0x14021e0f0]
mov qword [rsi], rax
mov ecx, dword [0x14021e108]
test ecx, ecx
je 0x140189e09
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x140189e00
lea rcx, [0x14021e0f0]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140189d20
jmp 0x140189d2d
lea rcx, [0x14021e0f0]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140189d4c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14021e0f0]
call fcn.140188b70
mov ecx, eax
jmp 0x140189dab
mov ecx, 0x10
mov edx, 8
call fcn.1400270c0
ud2
Function at 0x14018b2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14021e148]
test ecx, ecx
je 0x14018b3a7
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14018b30d
mov rsi, rax
cmp qword [rax], 0
jne 0x14018b3a1
mov ecx, dword [0x14021e148]
test ecx, ecx
je 0x14018b3c9
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14018b3e6
mov rsi, rax
test rax, rax
jne 0x14018b397
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x14018b358
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14018b401
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14018b401
mov rsi, rax
mov qword [rax], 0
lea rax, [0x14021e130]
mov qword [rsi + 0x10], rax
mov ecx, dword [0x14021e148]
test ecx, ecx
je 0x14018b3f1
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
movaps xmm0, xmmword [0x140220520]
movups xmmword [rsi], xmm0
add rsi, 8
jmp 0x14018b3e8
lea rcx, [0x14021e130]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14018b300
jmp 0x14018b30d
lea rcx, [0x14021e130]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14018b32c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14021e130]
call fcn.140188b70
mov ecx, eax
jmp 0x14018b38f
mov ecx, 0x18
mov edx, 8
call fcn.1400270c0
ud2
Function at 0x14018de30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14018de63
test ecx, ecx
jne 0x14018deb2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x14018de70
test ecx, ecx
jne 0x14018deb2
mov rcx, rdi
call fcn.14018dd10
movzx r10d, al
test bl, bl
jne 0x14018deb9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14018dea6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14018e02c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14018dea6.2
xor r10d, r10d
test bl, bl
je 0x14018de80
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14018e00e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14018deeb
xor edi, edi
jmp 0x14018df68
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14018df30
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14018df4b
inc rsi
dec rax
cmp rsi, 1
jne 0x14018df10
jmp 0x14018df68
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14018df4b
cmp ebx, 0x5c
je 0x14018df4b
inc rsi
dec rax
cmp rsi, 1
jne 0x14018df30
jmp 0x14018df68
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14018e01c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14018df92
mov al, 9
cmp rdx, 2
je 0x14018df96
cmp rdx, 1
jne 0x14018dfa6
cmp byte [r9], 0x2e
jne 0x14018dfa6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14018dfa6
mov al, 0xa
jmp 0x14018dfa6
cmp byte [r9], 0x2e
jne 0x14018dfa6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14018dea6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14018dea6.2
mov esi, 2
jmp case.0x14018dea6.2
lea r8, [0x140293c60]
call fcn.14002c660
ud2
lea r8, [0x140293c78]
call fcn.14002c660
ud2