joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011fffc
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x58], r9
mov r14d, ecx
mov r10, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
movzx eax, r8b
mov qword [rsp + 0x50], rax
test dl, dl
jne 0x140120176
mov r15d, r10d
and r15d, 0x1f
mov rax, r10
and rax, 0xffffffffffffffe0
mov qword [rsp + 0x60], rax
lea r13, [r12 + rax]
lea rsi, [0x14042e630]
mov rdi, 0xffffffffffffffff
xor r14d, r14d
mov rbx, 0xffffffffffffffff
mov bpl, byte [rsi]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0xe0]
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov ecx, ebp
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
call fcn.1401201d0
mov rcx, qword [rsp + 0x60]
xor eax, eax
test rcx, rcx
je 0x1401200f3
mov r8, r12
lea rdx, [r8 + 0x20]
xor r9d, r9d
xor r10d, r10d
mov r11b, byte [r8 + r10]
inc r10
mov r12d, r11d
sar r12b, 7
xor r11b, r12b
sub r11b, r12b
movzx r11d, r11b
add r9, r11
cmp r10, 0x20
jne 0x1401200c2
add rax, r9
cmovb rax, rdi
mov r8, rdx
add rcx, 0xffffffffffffffe0
jne 0x1401200b8
inc rsi
test r15, r15
je 0x140120132
xor edx, edx
xor ecx, ecx
mov r12, qword [rsp + 0xe8]
mov r10, qword [rsp + 0xf0]
mov r8b, byte [r13 + rdx]
mov r9d, r8d
sar r9b, 7
xor r8b, r9b
sub r8b, r9b
movzx r8d, r8b
add rcx, r8
inc rdx
cmp r15, rdx
jne 0x14012010f
jmp 0x140120144
xor ecx, ecx
mov r12, qword [rsp + 0xe8]
mov r10, qword [rsp + 0xf0]
add rax, rcx
cmovb rax, rdi
cmp rax, rbx
movzx ecx, r14b
movzx r14d, bpl
cmova r14d, ecx
cmovb rbx, rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fpng_0.17.10_src_text_metadata.rsunreachable
cmp rsi, rax
jne 0x140120064
mov al, 4
cmp r14b, 4
je 0x1401201bc
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0xe0]
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov ecx, r14d
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
call fcn.1401201d0
mov eax, r14d
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14012234d
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.1401248fb
test rax, rax
je 0x14012238a
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1401223c3
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.14012240e
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140122460
Function at 0x1401248fb
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x14012495e
mov edi, eax
mov rcx, rbx
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14012493d
xor esi, esi
jmp 0x14012495e
xor edi, 0x80000000
je 0x140124939
mov ecx, 4
mov edx, 4
call fcn.140020b50
test rax, rax
je 0x140124969
mov rsi, rax
mov dword [rax], edi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.14038e430
ud2

Function at 0x14012540d
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x20]
mov r15b, byte [rdx + 0x28]
lea rcx, [rsp + 0x80]
call fcn.140124f13
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x78], rax
movabs rax, 0x7465646279746573
movabs rcx, 0x6c7967656e657261
movabs rdx, 0xded7d4e2d7dedfc6
movabs r8, 0xa60c596fc19fead0
movabs r9, 0xe414a674f0de7325
mov r11d, 1
lock xadd qword [0x1404fd040], r11
mov r10, r11
xor r10, rax
lea r12, [r10 + rcx]
mov rbx, r10
rol rbx, 0x10
xor rbx, r12
lea r13, [rbx + rdx]
rol rbx, 0x15
xor rbx, r13
add r10, r8
mov r12, r10
xor r12, r9
rol r10, 0x20
xor r11, r13
add r11, r12
rol r12, 0xd
mov r13, rbx
xor r12, r11
rol r11, 0x20
btc r13, 0x3b
add r10, r13
shrd r13, rbx, 0x30
xor r13, r10
add r11, r13
rol r13, 0x15
add r10, r12
rol r12, 0x11
xor r13, r11
xor r12, r10
rol r10, 0x20
btc r11, 0x3b
add r11, r12
rol r12, 0xd
xor r12, r11
rol r11, 0x20
xor r10, 0xff
add r10, r13
rol r13, 0x10
xor r13, r10
add r11, r13
rol r13, 0x15
add r10, r12
rol r12, 0x11
xor r12, r10
rol r10, 0x20
xor r13, r11
add r11, r12
rol r12, 0xd
xor r12, r11
rol r11, 0x20
add r10, r13
rol r13, 0x10
xor r13, r10
add r11, r13
rol r13, 0x15
add r10, r12
rol r12, 0x11
xor r12, r10
rol r10, 0x20
xor r13, r11
add r11, r12
rol r12, 0xd
add r10, r13
rol r13, 0x10
xor r13, r10
rol r13, 0x15
xor r12, r11
add r10, r12
rol r12, 0x11
mov rbx, r10
rol rbx, 0x20
xor rbx, r12
xor rbx, r13
xor rbx, r10
je 0x140125482
mov r12, qword [rsi + 0x60]
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x110], xmm1
movups xmmword [rdi + 0x100], xmm0
mov qword [rdi + 0x120], r14
mov byte [rdi + 0x128], r15b
lea rdx, [rsp + 0x80]
mov r8d, 0x100
mov rcx, rdi
call fcn.14038a820
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x130], rax
mov qword [rdi + 0x138], rbx
mov qword [rdi + 0x140], r12
mov r8, qword [rsi + 0x48]
test r8, r8
je 0x140125610
cmp qword [rsi + 0x40], 0
je 0x140125610
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
lea rsp, [rbp + 0x138]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401976e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov qword [rsp + 0x40], r9
mov byte [rsp + 0x33], r8b
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x1e0]
mov rbx, qword [r14 + 8]
mov r15d, dword [r14]
mov r12d, dword [r14 + 4]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400753e8
mov dil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400753e8
mov sil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400753e8
mov rbp, qword [rax + 0x88]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400753e8
mov r13d, dword [rax + 0xb8]
cmp dil, 5
ja 0x1401977a1
cmp dil, 3
jne 0x1401977fa
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14007535f
mov rdi, rax
movzx eax, byte [rax + 0x60]
lea ecx, [rax - 6]
cmp cl, 6
jb 0x1401977d9
cmp eax, 4
ja 0x1401977d9
cmp eax, 3
je 0x1401977d9
mov rcx, rdi
add rcx, 0x60
call fcn.1401ba777
mov byte [rdi + 0x60], 0
mov al, byte [rsp + 0x33]
mov byte [rdi + 0x61], al
mov dword [rdi + 0x64], r13d
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x68], eax
cmp sil, 5
ja 0x14019780e
test rbp, rbp
jne 0x14019780e
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov r8, r14
call fcn.1401d1d04
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.1400753e8
mov eax, dword [rax + 0xb8]
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdx + 8], eax
mov byte [rdx], 8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r8, rdi
mov r9, r14
call fcn.1401d1ea8
mov rcx, rsi
mov rdx, r14
mov r8, qword [rsp + 0x48]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14007bcba
Function at 0x1401a926f
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, rdx
mov rsi, rcx
lea rax, [r8 + 0xb]
lea r14, [rsp + 0x40]
mov qword [r14], rax
mov qword [r14 + 8], r8
mov word [r14 + 0x10], 0
mov dword [r14 + 0x18], 1
lea r12, [rsp + 0x60]
mov rcx, r12
mov rdx, r14
call fcn.14021dbbf
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
mov dword [r15], 0
mov ecx, 0x800
call fcn.14004b4d6
mov rdi, rdx
mov qword [r14], rax
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], 0
mov r12, qword [r12 + 8]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x1401a933a
mov r8d, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
cmp rax, r8
jae 0x1401a92f5
mov rcx, r14
call fcn.14038e7d9
mov rdi, qword [rsp + 0x48]
jmp 0x1401a92f5
test eax, eax
jne 0x1401a935c
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x1401a9387
movabs rax, 0xde00000002
jmp 0x1401a9364
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
je 0x1401a939b
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1401a939b
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x60], 0
je 0x1401a93b7
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401aa069
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1401aa1fe
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1401aa174
cmp eax, 0x80090318
je 0x1401aa1d2
test eax, eax
jne 0x1401aa1c2
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov rax, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x18], 0
add r9, r8
jb 0x1401aa20c
cmp rax, r9
jb 0x1401aa21d
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.14021ce82
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401aa3c5
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x1401aa1f4
cmp eax, 0x90317
je 0x1401aa1ee
cmp eax, 0x90321
jne 0x1401aa1c2
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401aa3c5
mov qword [rdi + 0x1d8], 0
mov byte [rsi + 1], bl
jmp 0x1401aa1f4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1401aa1f4
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x1401aa1f2
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
call fcn.14038e940
ud2
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rdx, r9
call fcn.14038ebd0
ud2
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rcx, r9
mov rdx, rax
jmp 0x1401aa205
Function at 0x1401ab1cf
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1401ab364
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1401ab2da
cmp eax, 0x80090318
je 0x1401ab338
test eax, eax
jne 0x1401ab328
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov rax, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x18], 0
add r9, r8
jb 0x1401ab372
cmp rax, r9
jb 0x1401ab383
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.14021ce82
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401aa3c5
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x1401ab35a
cmp eax, 0x90317
je 0x1401ab354
cmp eax, 0x90321
jne 0x1401ab328
mov dword [rdi + 0x108], 0x10000
xor ebx, ebx
mov byte [rdi + 0x10c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401aa3c5
mov qword [rdi + 0xd8], 0
mov byte [rsi + 1], bl
jmp 0x1401ab35a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1401ab35a
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x1401ab358
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
call fcn.14038e940
ud2
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rdx, r9
call fcn.14038ebd0
ud2
lea r8, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.5.0_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rcx, r9
mov rdx, rax
jmp 0x1401ab36b
Function at 0x1401deb8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x1401debd7
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov r10, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x1401decd3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x1401dece2
mov bl, byte [rax + 0x3a]
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov r8, qword [rax + 0x28]
mov dil, byte [rax + 0x38]
xor r11d, r11d
test bl, bl
jne 0x1401ded08
mov esi, edi
xor sil, 1
mov byte [rax + 0x38], sil
test r8, r8
je 0x1401dec1a
cmp r9, r8
jbe 0x1401dec14
cmp byte [r10 + r8], 0xbf
jg 0x1401dec1a
jmp 0x1401ded1a
jne 0x1401ded1a
cmp r8, r9
je 0x1401dece9
mov r15b, byte [r10 + r8]
movzx ebp, r15b
test bpl, bpl
jns 0x1401dec90
mov r14d, ebp
and r14d, 0x1f
movzx r12d, byte [r10 + r8 + 1]
and r12d, 0x3f
cmp bpl, 0xdf
jbe 0x1401dec7d
movzx ebp, byte [r10 + r8 + 2]
shl r12d, 6
and ebp, 0x3f
or ebp, r12d
cmp r15b, 0xf0
jb 0x1401dec89
movzx r15d, byte [r10 + r8 + 3]
and r14d, 7
shl r14d, 0x12
shl ebp, 6
and r15d, 0x3f
or r15d, ebp
or r15d, r14d
mov ebp, r15d
jmp 0x1401dec90
shl r14d, 6
or r14d, r12d
mov ebp, r14d
jmp 0x1401dec90
shl r14d, 0xc
or ebp, r14d
test dil, dil
jne 0x1401decf7
cmp ebp, 0x110000
je 0x1401decee
mov edi, 1
cmp ebp, 0x80
jb 0x1401decc6
mov edi, 2
cmp ebp, 0x800
jb 0x1401decc6
cmp ebp, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov edi, esi
jmp 0x1401debec
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
call fcn.1401df764
jmp 0x1401ded0b
test dil, dil
jne 0x1401decfa
mov byte [rax + 0x3a], 1
xor r11d, r11d
jmp 0x1401ded08
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r11d, 1
mov qword [rcx], r11
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str._rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.14038ee40
ud2
Function at 0x1401e0570
Capabilities:
Hash data using sha256

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [0x1404fd048]
test rax, rax
jne 0x1401e05b9
mov ecx, 1
xor eax, eax
lock cmpxchg qword [0x1404fd048], rcx
jne 0x1401e05b9
call fcn.1402c8b50
mov byte [0x1404fd050], 1
mov eax, 2
xchg qword [0x1404fd048], rax
jmp 0x1401e05c5
pause
mov rax, qword [0x1404fd048]
cmp rax, 1
je 0x1401e05b0
cmp rax, 2
jne 0x1401e0609
movups xmm0, xmmword [0x140494ec0]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140494eb0]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140494ea0]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140494e90]
movups xmmword [rsi], xmm0
lea rax, [0x140494e90]
mov qword [rsi + 0x40], 0
mov qword [rsi + 0x48], rax
add rsp, 0x20
pop rsi
ret
test rax, rax
jne 0x1401e0623
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.aJI_
mov edx, 0x28
jmp 0x1401e0636
lea rcx, str.Once_has_panickedC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_spin_0.5.2_srconce.rs
lea r8, [0x140494ac0]
mov edx, 0x11
call fcn.14038e950
ud2

Function at 0x1401eca8d
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x70
xor eax, eax
lea rcx, [rsp + 0x68]
mov dword [rcx], eax
mov word [rcx + 4], 0x500
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call qword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x1401ecb1c
call sub.kernel32.dll_GetLastError
lea r8, [rsp + 0x5f]
mov byte [r8], 0
mov rsi, qword [rsp + 0x60]
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.advapi32.dll_CheckTokenMembership]
test eax, eax
jne 0x1401ecb0b
call sub.kernel32.dll_GetLastError
mov byte [rsp + 0x5f], 0
mov rcx, rsi
call qword [sym.imp.advapi32.dll_FreeSid]
cmp byte [rsp + 0x5f], 0
setne al
add rsp, 0x70
pop rsi
ret
Function at 0x1402113f5
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
mov qword [rcx + 8], rdx
xor eax, eax
lea rdx, [rsp + 0x40]
mov dword [rdx], eax
mov qword [rdx + 8], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.crypt32.dll_CryptUnprotectData]
test eax, eax
je 0x14021144f
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
xor eax, eax
jmp 0x14021147a
call sub.kernel32.dll_GetLastError
call sub.kernel32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401b10ae
mov qword [rsi + 8], rax
lea rax, fcn.1401b10eb
mov qword [rsi + 0x10], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x60
pop rsi
ret

Function at 0x1402114a3
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14021ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14021acbb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14021acbb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14021acd6
cmp eax, 0x42
jne 0x14021acbb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14021ad86
cmp byte [r9 + r11], 0x5f
jne 0x14021ad86
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14021adee
mov rcx, rsi
xor edx, edx
call fcn.1402167b0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1402167b0
test al, al
jne 0x14021ae81
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14021ad12
lea rdx, [0x14049a48a]
mov r8d, 1
call fcn.14004cd80
test al, al
jne 0x14021ae81
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14021acca
xor r14d, r14d
lea rbx, [0x14049a856]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14021ad44
cmp byte [rax + rcx], 0x45
je 0x14021aea3
sub r14, 1
jb 0x14021ad69
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14021ad69
mov r8d, 2
mov rdx, rbx
call fcn.14004cd80
test al, al
jne 0x14021ae81
mov rcx, rsi
call fcn.14021aec0
test al, al
jne 0x14021ae81
mov rax, qword [rsi]
test rax, rax
jne 0x14021ad30
jmp 0x14021acca
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14021ae48
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14021ade2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14021adcc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14021adbb
add dl, 0xa9
jmp 0x14021adca
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14021ae48
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14021ae48
movzx edx, bl
add rax, rdx
jae 0x14021ad90
jmp 0x14021ae48
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14021ae48
cmp rax, rcx
jae 0x14021ae45
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14021ae9b
cmp qword [rsi + 0x20], 0
je 0x14021aeaf
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14021ac60
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14021accc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14021ae89
lea rax, [0x14049a821]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14004cd80
test al, al
je 0x14021ae89
mov dil, 2
jmp 0x14021acca
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14021acca
mov dil, 1
xor r8d, r8d
jmp 0x14021ae4a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14021acca
xor edi, edi
jmp 0x14021acca