joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003a750
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18003a7dc
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18003a7b0
lea r11, [0x180048be0]
nop
cmp r9b, 0x23
jne 0x18003a793
cmp byte [r8], r9b
jne 0x18003a793
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18003a780
mov rcx, qword [0x1800557e0]
not eax
cmp dword [rcx + 0x406c], eax
jne 0x18003a7c7
mov dword [rcx + 0x4070], eax
cmp dword [rcx + 0x4098], eax
jne 0x18003a839
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800557e0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180005d60
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4054], eax
jne 0x18003a832
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18001cdc0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18003e170
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1800557e0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18003e38e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18003e38e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1800557e0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18003e244
movsx rdx, word [r8 + 0x60a8]
lea rax, [r8 + 0x60ac]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18003e239
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60a8], cx
movsx rax, cx
lea rax, [rax*8 + 0x60ac]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60a0]
test rdi, rdi
je 0x18003e261
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18003e264
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x18004d9d8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18003e2a7
mov rsi, qword [r8 + 0x90]
jmp 0x18003e2aa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18003e2d5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1800557e0]
mov rcx, qword [rax + 0x4b00]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18003e34e
inc rbx
cmp rbx, 5
jl 0x18003e330
jmp 0x18003e37a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18003e390
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180044d80
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x1800408c0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp edx, 1
je 0x1800408d6
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 1
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea r8, [0x18004dbe8]
mov rcx, rax
lea rdx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea r8, [0x18004dbe8]
mov rcx, rax
lea rdx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xor ecx, ecx
lea r8, [0x180040790]
mov qword [rsp + 0x28], rcx
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1800432d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x1800433ab
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x18004331e
cmp rbx, qword [0x180055008]
ja 0x18004331e
sub rbx, 0x8000000
jmp 0x1800433a2
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800433ab
cmp dword [rsp + 0x40], 0x10000
jne 0x180043386
cmp qword [rsp + 0x38], 0x10000
jb 0x180043386
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800433ad
sub rbx, 0x10000
jmp 0x1800433a2
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180043300
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800433c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800433e2
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x18004349d
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x18004340e
cmp rbx, qword [0x180055008]
ja 0x18004340e
add rbx, 0x8000000
jmp 0x180043494
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004349d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180043479
cmp rcx, 0x10000
jb 0x180043479
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18004349f
add rbx, 0x10000
jmp 0x180043494
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180043494
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1800433f0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800434b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x1800434d2
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x1800434ee
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180043505
cmp byte [rcx + 1], 0x25
jne 0x180043549
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180043511
cmp al, 0xe9
jne 0x180043549
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x180043534
cmp rcx, 0xffffffff80000000
jae 0x18004352b
lea rsi, [rcx + 0x7ff80000]
jmp 0x180043549
mov rsi, 0xfffffffffff80000
jmp 0x180043549
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180043549
mov edi, 0x80000
mov rdx, qword [0x180055188]
mov rax, qword [0x180055180]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180043570
test rax, rax
je 0x180043587
mov rdx, rax
mov qword [0x180055188], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180043587
cmp rcx, rdi
jb 0x180043587
cmp rcx, rsi
jbe 0x1800436da
mov qword [0x180055188], rax
mov rdx, rax
test rax, rax
je 0x1800435d2
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x1800435bc
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1800435bc
cmp rax, rdi
jb 0x1800435bc
cmp rax, rsi
jbe 0x1800436da
mov rdx, qword [rdx + 8]
mov qword [0x180055188], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x1800435a0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1800435fc
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.1800432d0
mov rdx, rax
test rax, rax
jne 0x180043688
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x180043622
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.1800433c0
mov rdx, rax
test rax, rax
jne 0x180043688
cmp rbx, 0x40000000
jbe 0x180043642
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800433c0
mov rdx, rax
test rax, rax
jne 0x180043688
cmp rbx, rbp
jae 0x18004365e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800432d0
mov rdx, rax
test rax, rax
jne 0x180043688
mov rdx, rbx
mov rcx, rdi
call fcn.1800432d0
mov rdx, rax
test rax, rax
jne 0x180043688
mov rdx, rsi
mov rcx, rbx
call fcn.1800433c0
mov rdx, rax
test rax, rax
je 0x180043711
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x180055188], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x180055180]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x180055180], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x1800436c2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x180043711
cmp rax, rsi
ja 0x180043711
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x180047680]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x180043713
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180043970
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18004399e
xor al, al
jmp 0x1800439e0
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800439af
xor al, al
jmp 0x1800439e0
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800439d6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800439d6
mov al, 1
jmp 0x1800439e0
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x180043ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x180055198], 0
jne 0x180043f67
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180055198], ecx
jne 0x180043f67
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x180055180]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x1800551b0], rdi
mov qword [0x1800551a8], rdi
mov qword [0x1800551a0], rdi
test rbx, rbx
je 0x180043f50
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180043f48
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180043f20
jmp 0x180043f50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18005519c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180044580
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18005519c]
mov rdi, rcx
test eax, eax
jne 0x180044623
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x1800445aa
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180044da0
mov rbx, rax
test rax, rax
jne 0x1800445c6
lea edi, [rax + 8]
jmp 0x1800445e9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180044607
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180045154
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18005519c], edi
mov qword [0x1800551a0], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800551a8]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x1800551a8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000e180
cmp r11, r10
ja 0x14000e1f6
cmp r10, rdx
ja 0x14000e208
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000e182
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000e160
jmp 0x14000e1e4
ja 0x14000e18a
mov r11, r10
cmp rax, r8
jne 0x14000e124
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000e1c0
mov rdi, r8
sub ecx, edx
jns 0x14000e1db
jmp 0x14000e1e6
cmp r8, rsi
je 0x14000e217
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000e1e6
xor al, 1
cmp rdi, rsi
jne 0x14000e1a0
jmp 0x14000e1e6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400c3870
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400c35e0
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400c3660
int3
Function at 0x14000f5ef
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x1400cad08]
mov ebx, 0xff
lea rsi, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.0_src_baseline.rs
cmp r9, 0x40
jb 0x14000f71f
mov r14d, 4
sub r14, 1
jb 0x14000f614
cmp r9, 0xf
jbe 0x14000f74c
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.14000fc32
mov r9, rdx
mov ecx, ebp
jmp 0x14000f624
xor edx, edx
cmp r9, rdx
je 0x14000f73d
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x14000f721
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.0_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.1400c3560
int3
Function at 0x14001a182
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14001a1a8
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14001a192
mov qword [rcx], rax
ret

Function at 0x14002711a
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r12, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
movzx edi, word [rdx]
test di, di
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov rax, qword [0x140138db0]
cmp rax, 3
jne 0x14002729b
lea rax, [rsp + 0xa0]
mov byte [rax], 1
add dword [rbp + rcx*4 + 0x44], ecx
and al, 0x50

Function at 0x14002875e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf0
mov r14, rdx
mov rsi, rcx
mov ecx, 0x18
mov edx, 8
call fcn.140008c0e
mov rdi, rax
mov eax, 1
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 0
mov rcx, r14
call fcn.1400b0b50
mov rcx, qword [rax]
xorps xmm0, xmm0
ror byte [rax - 0x73], 0x54
and al, 0x70
Function at 0x1400366c0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140038823
test rax, rax
je 0x1400366f8
mov edx, 4
mov rcx, rax
call fcn.140005da0
jmp 0x140036731
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.140035b50
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140035b92
Function at 0x140038823
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
Function at 0x14007228c
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x14007229e
add rcx, 8
jmp fcn.1400af4c3
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x38], rdx
mov rcx, r8
call fcn.140072428
mov rbx, rax
mov r14, rdx
lea r15, [rsp + 0x28]
mov rcx, rsi
call fcn.14007eac2
test rdx, rdx
jne 0x140072341
mov rcx, r15
mov rdx, rsi
call fcn.14007cf87
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x1400723d0
add byte [rax], al
invalid
test eax, eax
je 0x140072341
cmp qword [rsi + 0x110], 0
je 0x140072324
mov rcx, r15
mov rdx, rsi
call fcn.14007dbfd
cmp qword [rsp + 0x28], 0
jne 0x1400723d0
cmp qword [rsp + 0x30], 0
je 0x140072341
and qword [rsi + 0x110], 0
mov rcx, r15
mov rdx, rsi
call fcn.14007dda6
cmp byte [rsp + 0x28], 0
jne 0x1400723d0
cmp byte [rsp + 0x29], 0
je 0x1400722ca
mov rcx, rsi
call fcn.14007eac2
mov r15, rdx
test rax, rax
je 0x1400723d5
mov r13, rax
cmp r14, r15
mov r12, r15
cmovb r12, r14
lea r9, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.14007cca8
mov rbx, rax
mov r14, rdx
lea r9, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, r13
mov rdx, r15
mov r8, r12
call fcn.14002259a
mov r9, rdx
lea rcx, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.140033e52
mov rax, qword [rsi + 0x58]
add rax, r12
cmp rax, qword [rsi + 0x50]
ja 0x14007240f
mov qword [rsi + 0x58], rax
mov rcx, rdi
mov rdx, r12
call fcn.14007247e
xor r15d, r15d
jmp 0x1400723f5
mov r15, qword [rsp + 0x30]
mov rcx, r15
call fcn.1400339ec
cmp al, 0xd
jne 0x1400723f5
and qword [rsi + 0x38], 0
mov rcx, r15
call fcn.140027581
mov eax, 1
jmp 0x1400723fc
and qword [rsi + 0x38], 0
xor eax, eax
mov rdx, r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov edx, 0x3b
call fcn.1400c3660
int3
Function at 0x140072554
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x38], r8
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.14007cf87
mov eax, dword [r14]
cmp eax, 2
je 0x140072798
test eax, eax
je 0x140072746
mov rax, qword [rsi + 0x98]
cmp rax, qword [rsi + 0x90]
jne 0x140072782
mov rdx, qword [rsp + 0xf0]
mov r15d, dword [rsp + 0x34]
mov r13, qword [rsp + 0x38]
mov rbx, r13
shr rbx, 0x20
cmp rdx, rbx
mov r8, rbx
cmovb r8, rdx
lea r9, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, r12
mov qword [rsp + 0x70], r8
call fcn.14002259a
cmp rdx, rbx
ja 0x1400727f4
mov rbp, rdx
mov rbx, rax
mov r12, rdx
add r12, r15
mov eax, r13d
add rax, r12
mov rdx, qword [rsi + 0x90]
cmp rdx, rax
jae 0x14007261d
lea rcx, [rsi + 0x80]
mov rdx, rax
call fcn.140008bbd
mov rdx, qword [rsi + 0x90]
mov rcx, qword [rsi + 0x88]
lea rax, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.14007ec7d
add byte [rax - 0x77], cl
ror dword [rcx - 0x77], 0xd8
mov r9, rbp
call fcn.140068c31
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
lea r9, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
lea ecx, [0x1400fdb80]
mov r8, r15
call fcn.14007c9fb
mov r13, rax
mov rbp, rdx
xor eax, eax
test r13, r13
cmove ebp, eax
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
nop
add byte [rax], al
add byte [rax - 0x73], cl
add eax, 0x8b50f
mov ch, 8
invalid
mov r14d, eax
shl r14, 0x20
or r14, 2
jmp 0x14007279d
movabs r14, 0x8009031700000002
jmp 0x14007279d
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
and al, 0x30
add eax, dword [rsp + 0x50]
cmp qword [rsi + 0x90], rax
jb 0x14007276e
mov qword [rsi + 0x90], rax
and qword [rsi + 0x98], 0
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x118], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14007db29
cmp qword [rbx], 0
je 0x1400727e3
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.1400339ec
cmp al, 0xd
jne 0x1400727bf
mov qword [rdi], 2
and qword [rsi + 0x38], 0
mov rcx, r14
call fcn.140027581
jmp 0x1400727cf
mov qword [rdi], 1
mov qword [rdi + 8], r14
and qword [rsi + 0x38], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x118]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x1400727ca
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str.C:Usersleand.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov bl, 8
add byte [rdx + 0x3e], bh
call fcn.1400c3660
int3