joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052f10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140052f30
test al, 1
je 0x140053057
test al, 2
jne 0x140053071
test al, 8
jne 0x140052f72
mov rdi, qword [rsi + 0x28]
call fcn.1400fd450
test rax, rax
je 0x140052f92
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140052f95
test al, 0x10
je 0x140052fb3
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1400530f9
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x140052fb3
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.140024d50
mov byte [rsi + 0xa8], 4
call fcn.1400fd450
test rax, rax
je 0x140052fb3
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140104bf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14005308b
jne 0x140053045
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140053003
mov rcx, rdi
call fcn.140029560
lea rcx, [rsi + 0x30]
call fcn.140024d50
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140053022
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140189110]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.14011631c
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140154db0]
mov edx, 0x23
call fcn.140086940
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140154df0]
mov edx, 0x25
call fcn.140086940
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140085d20]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:__bN
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140154e38]
lea rcx, [rsp + 0x30]
call fcn.140085be0
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x140178ba0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str._Users_no_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x30]
call fcn.140085be0
ud2
Function at 0x140053140
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140053150
test al, 1
je 0x1400531f3
test al, 2
jne 0x14005320d
test al, 8
jne 0x14005318a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.140050d80
jmp 0x1400531a2
test al, 0x10
je 0x1400531a2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140053295
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140104bf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140053227
jne 0x1400531e9
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.1400516a0
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140154db0]
mov edx, 0x23
call fcn.140086940
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140154df0]
mov edx, 0x25
call fcn.140086940
ud2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140085d20]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:__bN
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x140154e38]
lea rcx, [rsp + 0x28]
call fcn.140085be0
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x140178ba0]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._Users_no_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.140085be0
ud2
Function at 0x1400532e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400532f0
test al, 1
je 0x140053390
test al, 2
jne 0x1400533aa
test al, 8
jne 0x140053327
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.140050e60
jmp 0x14005333f
test al, 0x10
je 0x14005333f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140053432
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140104bf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400533c4
jne 0x140053386
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.140051750
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140154db0]
mov edx, 0x23
call fcn.140086940
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140154df0]
mov edx, 0x25
call fcn.140086940
ud2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140085d20]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:__bN
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x140154e38]
lea rcx, [rsp + 0x28]
call fcn.140085be0
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x140178ba0]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._Users_no_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.140085be0
ud2
Function at 0x140053470
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140053480
test al, 1
je 0x14005352a
test al, 2
jne 0x140053544
test al, 8
jne 0x1400534bb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.140051120
jmp 0x1400534d9
test al, 0x10
je 0x1400534d9
mov rax, qword [rsi + 0x220]
test rax, rax
je 0x1400535cc
mov rcx, qword [rsi + 0x228]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140103180
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14005355e
jne 0x140053520
mov rcx, rsi
add rsp, 0x230
pop rsi
jmp fcn.1400515e0
nop
add rsp, 0x230
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140154db0]
mov edx, 0x23
call fcn.140086940
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140154df0]
mov edx, 0x25
call fcn.140086940
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140085d20]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__bN
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140154e38]
lea rcx, [rsp + 0x50]
call fcn.140085be0
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x140178ba0]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str._Users_no_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x50]
call fcn.140085be0
ud2
Function at 0x140053610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140053630
test al, 1
je 0x140053758
test al, 2
jne 0x140053772
test al, 8
jne 0x140053672
mov rdi, qword [rsi + 0x28]
call fcn.1400fd450
test rax, rax
je 0x140053692
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140053695
test al, 0x10
je 0x1400536b4
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1400537fa
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
jmp 0x1400536b4
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.1400230a0
mov qword [rsi + 0x30], 0xc
call fcn.1400fd450
test rax, rax
je 0x1400536b4
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140104bf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14005378c
jne 0x140053746
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140053704
mov rcx, rdi
call fcn.140029560
lea rcx, [rsi + 0x30]
call fcn.1400230a0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140053723
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140189110]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.14011631c
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140154db0]
mov edx, 0x23
call fcn.140086940
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140154df0]
mov edx, 0x25
call fcn.140086940
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140085d20]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:__bN
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140154e38]
lea rcx, [rsp + 0x30]
call fcn.140085be0
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x140178ba0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str._Users_no_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x30]
call fcn.140085be0
ud2
Function at 0x140053840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x1400539aa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140053871
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x1400539dc
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x1400539e2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400539ff
mov rsi, rax
test rax, rax
jne 0x140053906
movzx eax, byte [0x1401891c0]
mov rcx, qword [0x140189110]
test rcx, rcx
jne 0x1400538c3
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140053a20
mov rcx, rax
mov qword [0x140189110], rax
mov r8d, 0x60
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140053a20
mov rsi, rax
lea rax, [0x140119110]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x140053a0d
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x1401536c0]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x1401536b0]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x1401536a0]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140153690]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140153680]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x1400539dc
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x1400539dc
lea rcx, [rsp + 0x38]
test rax, rax
je 0x1400539cc
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400539dc
call fcn.140029560
jmp 0x1400539dc
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140053863
jmp 0x140053871
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400539dc
call fcn.1400ac7c0
add rsi, 0x10
jmp 0x140053a01
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140053890
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
jmp 0x1400538fe
mov ecx, 8
mov edx, 0x60
call fcn.140083160
ud2
Function at 0x1400542f0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.140053fd0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x1401891c0]
mov rcx, qword [0x140189110]
test rcx, rcx
jne 0x140054357
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140054492
mov rcx, rax
mov qword [0x140189110], rax
mov r8d, 0x800
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140054492
mov r14, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x50]
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
sub r12, r13
nop word cs:[rax + rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400543f0
mov r8d, dword [rsp + 0x30]
cmp r12, r8
jae 0x1400543b0
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.1400d0ce0
mov r14, qword [rsp + 0x38]
jmp 0x140054396
test eax, eax
jne 0x140054421
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x140054474
movabs rax, 0xde00000002
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
jne 0x140054438
jmp 0x140054449
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
je 0x140054449
mov rcx, qword [0x140189110]
xor edx, edx
mov r8, r14
call fcn.14011631c
cmp qword [rsp + 0x58], 0
je 0x140054462
mov rcx, qword [0x140189110]
xor edx, edx
mov r8, rdi
call fcn.14011631c
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x58], 0
jne 0x140054451
jmp 0x140054462
mov ecx, 1
mov edx, 0x800
call fcn.140083160
ud2
Function at 0x1400544b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400544f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1400544fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14005450b
jmp 0x140054522
xor r10d, r10d
jmp 0x1400545ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140054522
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140054539
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140054559
add r11, r8
jmp 0x14005468a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140054622
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400545d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140054640
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140054652
jmp 0x14005466c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14005466c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140054686
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140070360
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x140070396
xor r15d, r15d
jmp 0x14007040b
mov rbx, qword [rsp + 0x28]
mov r14, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400703ef
movzx eax, byte [0x1401891c0]
mov rcx, qword [0x140189110]
test rcx, rcx
jne 0x1400703ce
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400703e0
mov rcx, rax
mov qword [0x140189110], rax
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400703f5
mov ecx, 1
mov rdx, rdi
call fcn.140083160
ud2
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 8], r15
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140070430
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xc0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x140070466
xor r15d, r15d
jmp 0x1400704db
mov rbx, qword [rsp + 0x28]
mov r14, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400704bf
movzx eax, byte [0x1401891c0]
mov rcx, qword [0x140189110]
test rcx, rcx
jne 0x14007049e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400704b0
mov rcx, rax
mov qword [0x140189110], rax
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400704c5
mov ecx, 1
mov rdx, rdi
call fcn.140083160
ud2
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 8], r15
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140078710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x14007887a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140078741
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x1400788ac
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x1400788b2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400788cf
mov rsi, rax
test rax, rax
jne 0x1400787d6
movzx eax, byte [0x1401891c0]
mov rcx, qword [0x140189110]
test rcx, rcx
jne 0x140078793
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400788f0
mov rcx, rax
mov qword [0x140189110], rax
mov r8d, 0x60
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400788f0
mov rsi, rax
lea rax, [0x140119110]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140119128]
test ecx, ecx
je 0x1400788dd
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x1401536c0]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x1401536b0]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x1401536a0]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140153690]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140153680]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x1400788ac
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x1400788ac
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14007889c
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400788ac
call fcn.14007f620
jmp 0x1400788ac
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140078733
jmp 0x140078741
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400788ac
call fcn.14007f560
add rsi, 0x10
jmp 0x1400788d1
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140078760
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x140119110]
call fcn.1400d3180
mov ecx, eax
jmp 0x1400787ce
mov ecx, 8
mov edx, 0x60
call fcn.140083160
ud2
Function at 0x14008b1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14008b280
cmp r11, r10
ja 0x14008b2f6
cmp r10, rdx
ja 0x14008b30a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14008b282
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14008b260
jmp 0x14008b2e4
ja 0x14008b28a
mov r11, r10
cmp rax, r8
jne 0x14008b224
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14008b2c0
mov rdi, r8
sub ecx, edx
jns 0x14008b2db
jmp 0x14008b2e6
cmp r8, rsi
je 0x14008b31b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14008b2e6
xor al, 1
cmp rdi, rsi
jne 0x14008b2a0
jmp 0x14008b2e6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140087290
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400865a0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140086940
ud2