joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d970
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400fde48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x14000dad7
cmp byte [rcx + 0x81], 0
je 0x14000dad7
or edx, 0xffffffff
call fcn.14000ca10
cmp eax, 0xffffffff
jne 0x14000d9c6
xor al, al
jmp 0x14000dad9
mov edx, 0xf
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x40], 0
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], 8
lea rax, [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x50]
add r9, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.MSVCP110.dll_public:_int___cdecl_std::codecvt_char__char__int_::unshift_int____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000da3e
dec eax
jne 0x14000dab4
jmp 0x14000da45
mov byte [rdi + 0x81], 0
lea rax, [rsp + 0x40]
mov rdx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
cmp r9, 0x10
cmovae rax, rdx
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x14000da8d
lea rcx, [rsp + 0x40]
cmp r9, 0x10
cmovae rcx, rdx
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call qword [sym.imp.MSVCR110.dll_fwrite]
cmp rbx, rax
jne 0x14000dab9
cmp byte [rdi + 0x81], 0
je 0x14000dabd
test rbx, rbx
jne 0x14000d9f5
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.14000d440
jmp 0x14000d9f5
sub eax, 2
je 0x14000dabd
xor bl, bl
jmp 0x14000dabf
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x14000dad2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_]
movzx eax, bl
jmp 0x14000dad9
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cc100
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001f8c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call fcn.140035ca0
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, ebx
movzx ecx, ax
mov r9b, 1
mov r8, rdi
and ecx, 0x8000
and edx, 1
call fcn.14001fb00
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, ebx
mov r9b, 3
movzx ecx, ax
and edx, 4
mov r8, rdi
and ecx, 0x8000
call fcn.14001fb00
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, ebx
mov r9b, 2
movzx ecx, ax
and edx, 2
mov r8, rdi
and ecx, 0x8000
call fcn.14001fb00
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, ebx
mov r9b, 4
movzx ecx, ax
and edx, 8
mov r8, rdi
and ecx, 0x8000
call fcn.14001fb00
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and ebx, 0x10
mov r9b, 5
movzx ecx, ax
mov r8, rdi
mov edx, ebx
and ecx, 0x8000
call fcn.14001fb00
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x38], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14001fbe0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
mov ebx, eax
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001fc50
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, ebx
sub eax, dword [rsp + 0x50]
test eax, eax
jle 0x14001fc50
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14001fc11
xor ecx, ecx
call fcn.1400302f0
mov edi, 0x8000
cmp byte [rax + 0xe1], 1
mov rbx, rax
jne 0x14001fc84
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x14001fc84
mov edx, 0xe1
xor ecx, ecx
call fcn.140030550
cmp byte [rbx + 0xe5], 1
jne 0x14001fca9
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x14001fca9
mov edx, 0xe5
xor ecx, ecx
call fcn.140030550
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14002d260
Capabilities:
Hash data using djb2

Disassembly:
mov r9d, 0x1505
lea r8, [rcx + 0x28]
mov r10d, 8
cvttss2si rax, dword [r8]
cvttss2si rdx, dword [r8 - 4]
cvttss2si rcx, dword [r8 - 0x14]
lea r8, [r8 + 0x40]
imul edx, edx, 0x21
imul ecx, ecx, 0x21
add edx, eax
imul edx, edx, 0x21
cvttss2si rax, dword [r8 - 0x3c]
add edx, eax
cvttss2si rax, dword [r8 - 0x38]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x34]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x30]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x50]
imul edx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x64]
imul ecx, ecx, 0x40a9121
add edx, ecx
mov ecx, r9d
imul ecx, ecx, 0x6d261dff
imul eax, eax, 0x5cb8923f
sub edx, eax
cvttss2si rax, dword [r8 - 0x48]
imul eax, eax, 0x13be2b1f
sub edx, eax
cvttss2si rax, dword [r8 - 0x4c]
imul eax, eax, 0x747c7101
add edx, eax
cvttss2si rax, dword [r8 - 0x60]
imul eax, eax, 0x3b4039a1
add edx, eax
cvttss2si rax, dword [r8 - 0x58]
imul eax, eax, 0x30f35d61
add edx, eax
cvttss2si rax, dword [r8 - 0x5c]
imul eax, eax, 0x4f5f0981
add edx, eax
cvttss2si rax, dword [r8 - 0x68]
imul eax, eax, 0xc3525e1
add edx, eax
cvttss2si rax, dword [r8 - 0x2c]
add edx, eax
mov r9d, edx
sub r9d, ecx
dec r10
jne 0x14002d270
mov eax, r9d
ret

Function at 0x14003e1e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
cmp qword [0x140100408], 0
jne 0x14003e24e
cmp qword [0x140100400], 0
mov qword [0x140100418], 0x40000
mov qword [0x140100420], 0x200000
mov dword [0x140100428], 5
jne 0x14003e22d
mov qword [0x140100400], 0x58585858
mov dword [0x140100790], 5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x140100408], rax
mov eax, dword [rsp + 0x48]
mov qword [0x140100410], rax
xor eax, eax
add rsp, 0x58
ret
Function at 0x14003f8d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x1401007c0]
mov rdx, qword [0x1401007b8]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
jne 0x14003f904
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rbx, qword [0x1401007c0]
jbe 0x14003f93e
mov rcx, qword [0x1401007b8]
mov rdx, rbx
call fcn.14003de70
test rax, rax
je 0x14003f8f7
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov qword [0x1401007b8], rax
mov qword [0x1401007c0], rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x1401007b8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140044630
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x10
mov rsi, r9
mov rdi, r8
mov rbp, rdx
call fcn.14003dad0
xor ecx, ecx
test rax, rax
jne 0x140044668
call fcn.14001b9a0
jmp 0x1400446be
lea rdx, [rsp + 0x30]
mov qword [rax + 8], rsi
mov qword [rax], rbp
mov qword [rsp + 0x28], rdx
mov r9, rax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x20], ecx
test rdi, rdi
je 0x140044696
lea r8, [0x140044620]
xor edx, edx
call rdi
jmp 0x1400446a5
lea r8, [0x140044620]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400446bc
lea rcx, str.Not_enough_resources_to_create_thread
call fcn.14001bc50
jmp 0x1400446be
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400456d0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
cmp qword [0x1400feb78], rdi
mov ebx, eax
jne 0x14001e437
lea rcx, [0x1400feb74]
call fcn.140025620
cmp qword [0x1400feb78], rdi
jne 0x14001e42b
call fcn.1400366b0
mov qword [0x1400feb78], rax
test rax, rax
jne 0x14001e42b
lea rcx, [0x1400feb74]
call fcn.140025660
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400feb74]
call fcn.140025660
mov rcx, qword [0x1400feb78]
call fcn.140036720
mov rax, qword [0x1400feb80]
test rax, rax
je 0x14001e463
nop
cmp dword [rax], ebx
je 0x14001e45f
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001e450
jmp 0x14001e463
mov rdi, qword [rax + 8]
mov rcx, qword [0x1400feb78]
call fcn.140036790
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x1400fb830], 0xffffffff
jne 0x14004572d
cmp dword [0x1401008d0], 0
jne 0x140045736
lea rcx, [0x1401008d4]
call fcn.140025620
cmp dword [0x1400fb830], 0xffffffff
jne 0x140045721
cmp dword [0x1401008d0], 0
jne 0x140045721
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140045717
mov dword [0x1400fb830], eax
jmp 0x140045721
mov dword [0x1401008d0], 1
lea rcx, [0x1401008d4]
call fcn.140025660
cmp dword [0x1401008d0], 0
je 0x14004573f
add rsp, 0x28
jmp 0x14001e3d0
mov ecx, dword [0x1400fb830]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140045750
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x1400feb78]
mov edi, eax
call fcn.140036720
mov rbx, qword [0x1400feb80]
xor edx, edx
test rbx, rbx
je 0x14001e4c3
cmp dword [rbx], edi
je 0x14001e514
mov rdx, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14001e4b3
mov ecx, 0x18
call fcn.14003dad0
mov rbx, rax
test rax, rax
je 0x14001e4ed
mov dword [rax], edi
mov qword [rax + 8], rsi
mov rax, qword [0x1400feb80]
mov qword [rbx + 0x10], rax
mov qword [0x1400feb80], rbx
mov rcx, qword [0x1400feb78]
call fcn.140036790
test rbx, rbx
jne 0x14001e547
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001b9a0
test rsi, rsi
je 0x14001e51f
mov qword [rbx + 8], rsi
jmp 0x14001e4ed
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x14001e536
mov rcx, rbx
mov qword [rdx + 0x10], rax
call fcn.14003d430
jmp 0x14001e4ed
mov rcx, rbx
mov qword [0x1400feb80], rax
call fcn.14003d430
jmp 0x14001e4ed
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x1401008d0], 0
je 0x140045766
add rsp, 0x28
jmp 0x14001e480
mov rdx, rcx
mov ecx, dword [0x1400fb830]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140045789
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.14001bc50
xor eax, eax
add rsp, 0x28
ret

Function at 0x140045910
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400459bb
mov rcx, rdi
call fcn.1400458b0
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400459bb
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140045996
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov rbx, rax
call fcn.14001e190
lea rdx, str.UTF_16LE
lea rcx, str.UTF_8
lea r9, [rax*2 + 2]
mov r8, rbx
call fcn.140041660
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1400459a2
lea rcx, str.Couldnt_get_clipboard_data
call fcn.1400457d0
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x1400459bb
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400e1128]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001d040
Function at 0x140046450
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rdi, rdx
lea r8, [rcx + 0x60]
mov rbp, rcx
mov r9d, 0x3e
mov edx, eax
mov rcx, rdi
call sub.IMM32.dll_ImmGetCompositionStringW
xor r14d, r14d
mov edx, 0x80
test eax, eax
mov rcx, rdi
cmovs eax, r14d
xor r9d, r9d
xor r8d, r8d
movsxd rbx, eax
shr rbx, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx eax, ax
mov dword [rbp + 0xc0], eax
cmp rax, 0x20
jae 0x1400464ee
mov edx, 0x3000
cmp word [rbp + rax*2 + 0x60], dx
jne 0x1400464ee
inc eax
movsxd rcx, ebx
movsxd rdx, eax
cmp rdx, rcx
jge 0x1400464ec
mov qword [rsp + 0x30], rsi
lea rdi, [rbp + 0x5e]
lea rsi, [rbp + 0x60]
lea rsi, [rsi + rdx*2]
lea rdi, [rdi + rdx*2]
sub rcx, rdx
rep movsw word [rdi], word [rsi]
mov rsi, qword [rsp + 0x30]
dec ebx
mov rdi, qword [rsp + 0x48]
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
mov word [rbp + rax*2 + 0x60], r14w
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140047330
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [0x140100988], rax
mov qword [rbx + 0x1510], rax
je 0x1400473be
movzx r8d, ax
mov qword [0x140100988], rax
mov edx, r8d
and edx, 0x3ff
sub edx, 4
je 0x140047391
sub edx, 0xd
je 0x140047381
dec edx
jne 0x1400473be
xor ecx, ecx
mov dword [rbx + 0x14dc], ecx
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x14dc], 1
add rsp, 0x20
pop rbx
ret
mov eax, 0xfc00
mov dword [rbx + 0x14dc], 1
xor ecx, ecx
and r8w, ax
mov eax, dword [rbx + 0x14dc]
mov edx, 0x800
cmp r8w, dx
cmove eax, ecx
mov dword [rbx + 0x14dc], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140047b60
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x820
lea rcx, [rsp + 0x20]
call fcn.14002ffd0
xor ebx, ebx
lea rsi, [0x1400d6090]
mov qword [rsp + 0x830], rdi
movsxd rax, dword [rsi]
test eax, eax
je 0x140047be0
lea rdi, [rsp + 0x20]
test dword [rdi + rax*4], 0x40000000
lea rdi, [rdi + rax*4]
jne 0x140047be0
cmp eax, 0x35
je 0x140047be0
add eax, 0xffffffe2
cmp eax, 9
jbe 0x140047be0
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x140047be0
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x140047be0
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x140047bde
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
movsxd rax, ebx
cmp rax, 0x80
jb 0x140047b88
lea rdx, [rsp + 0x20]
mov r8d, 0x200
xor ecx, ecx
call fcn.140030aa0
mov rdi, qword [rsp + 0x830]
mov rbx, qword [rsp + 0x838]
add rsp, 0x820
pop rsi
ret

Function at 0x14004c7d0
Capabilities:
Capture microphone audio

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov esi, edx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x12]
mov rcx, rbx
mov ebp, r9d
call fcn.14001ceb0
mov eax, 0x100
mov r8d, 1
test word [rdi + 4], ax
je 0x14004c818
mov eax, 3
mov word [rbx], ax
jmp 0x14004c81c
mov word [rbx], r8w
movzx edx, word [rdi + 4]
mov eax, 0xff
mov dword [rsp + 0x28], r8d
and dx, ax
xor r9d, r9d
mov r8, rbx
mov word [rbx + 0xe], dx
movzx eax, byte [rdi + 6]
shr dx, 3
mov word [rbx + 2], ax
mov ecx, dword [rdi]
xor edi, edi
imul dx, ax
movzx eax, dx
mov dword [rbx + 4], ecx
mov edx, esi
mov word [rbx + 0xc], ax
mov qword [rsp + 0x20], rdi
imul eax, ecx
xor ecx, ecx
mov dword [rbx + 8], eax
test ebp, ebp
je 0x14004c870
call qword [sym.imp.WINMM.dll_waveInOpen]
jmp 0x14004c876
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
test eax, eax
sete dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400cc524
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400cca80
add rsp, 0x28
jmp 0x1400cc524
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x20], 0
call qword [sym.imp.MSVCR110.dll___crtGetShowWindowMode]
movzx esi, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x140111b28], rdx
je 0x1400cc56b
cmp rax, rdx
jne 0x1400cc569
mov ebx, 1
jmp 0x1400cc56b
jmp 0x1400cc550
mov eax, dword [0x140111b30]
cmp eax, 1
jne 0x1400cc580
lea ecx, [rax + 0x1e]
call fcn.1401af000
jmp 0x1400cc5bf
mov eax, dword [0x140111b30]
test eax, eax
jne 0x1400cc5b5
mov dword [0x140111b30], 1
lea rdx, [0x1400d0d50]
lea rcx, [0x1400d0d28]
call sub.MSVCR110.dll__initterm_e
test eax, eax
je 0x1400cc5bf
mov eax, 0xff
jmp 0x1400cc6f7
mov dword [0x1401012cc], 1
mov eax, dword [0x140111b30]
cmp eax, 1
jne 0x1400cc5e7
lea rdx, [0x1400d0d20]
lea rcx, [0x1400d0c18]
call sub.MSVCR110.dll__initterm
mov dword [0x140111b30], 2
test ebx, ebx
jne 0x1400cc5f4
xor eax, eax
xchg qword [0x140111b28], rax
cmp qword [0x140111b38], 0
je 0x1400cc620
lea rcx, [0x140111b38]
call fcn.1400cca00
test eax, eax
je 0x1400cc620
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140111b38]
call rax
mov rax, qword [sym.imp.MSVCR110.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
ja 0x1400cc696
cmp byte [rbx], 0
je 0x1400cc641
test edi, edi
jne 0x1400cc696
mov al, byte [rbx]
dec al
cmp al, 0x1f
ja 0x1400cc653
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400cc641
movzx r9d, si
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400ccdc0
mov dword [0x1401012c8], eax
cmp dword [0x1401012e8], 0
jne 0x1400cc67f
mov ecx, eax
call qword [sym.imp.MSVCR110.dll_exit]
cmp dword [0x1401012cc], 0
jne 0x1400cc694
call qword [sym.imp.MSVCR110.dll__cexit]
mov eax, dword [0x1401012c8]
jmp 0x1400cc6f7
cmp byte [rbx], 0x22
jne 0x1400cc6a8
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR110.dll__ismbblead]
test eax, eax
je 0x1400cc6bd
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400cc633
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ccdc0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
lea rdx, str.Out_of_memory___aborting
lea rcx, str.Fatal_Error
call fcn.1400ccd20
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov rbx, rax
call sym.SSOverlay.exe_SDL_wcslen
lea rdx, str.UCS_2_INTERNAL
lea rcx, str.UTF_8
lea r9, [rax*2 + 2]
mov r8, rbx
call sym.SSOverlay.exe_SDL_iconv_string
mov rsi, rax
test rax, rax
jne 0x1400cce10
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp 0x1400ccbd0
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x30], rdi
call fcn.1400ccbf0
mov edi, eax
lea ecx, [rax + 1]
movsxd rcx, ecx
shl rcx, 3
call sym.SSOverlay.exe_SDL_malloc
mov rbx, rax
test rax, rax
jne 0x1400cce4c
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp 0x1400ccbd0
mov rdx, rax
mov rcx, rsi
call fcn.1400ccbf0
mov rdx, rbx
mov ecx, edi
call fcn.1400cce70
int3
Function at 0x1400098d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x140009966
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x1401f6070]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401f6080]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140011350
test rdi, rdi
je 0x1400099e6
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400099ff
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140009af7
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140009b78
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x140009b04
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x1400099c0
add r8, rcx
cmp r9, 8
jae 0x140009b0d
jmp 0x140009b78
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140011350
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140009b78
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140009b78
mov r8, rcx
cmp r9, 8
jb 0x140009b78
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140009b10
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14000fdb0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x758
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14000fdd0
test al, 1
je 0x14000fe9f
test al, 2
jne 0x14000feb7
test al, 8
jne 0x14000fe17
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
call fcn.14000fa00
jmp 0x14000fe35
test al, 0x10
je 0x14000fe35
mov rax, qword [rsi + 0x718]
test rax, rax
je 0x14000ff3b
mov rcx, qword [rsi + 0x720]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140196330
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14000fecf
jne 0x14000fe91
mov rcx, rsi
call fcn.140004520
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402f90f8]
xor edx, edx
add rsp, 0x758
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401d02bc
nop
add rsp, 0x758
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140274fd8]
mov edx, 0x23
call fcn.1400293d0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140275018]
mov edx, 0x25
call fcn.1400293d0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140028770]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_0P_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140275060]
lea rcx, [rsp + 0x50]
call fcn.140028690
lea rax, str.waker_missing
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x80]
call fcn.140028690
ud2