joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009ac40
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009ac71
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800ec278]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800ec288]
lea rdx, [rdi + rdi]
call fcn.180066770
mov rax, qword [0x1800ec278]
lea r9, [rdi - 1]
mov qword [0x1800ec2a0], r9
mov qword [0x1800ec2a8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009ade4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800ec288]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009ad30
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009ada5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009ad6d
mov r10, qword [rdx]
cmp r10, rax
je 0x18009ad67
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009ada5
cmp r9, rdx
je 0x18009ad81
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009adb9
cmp r9, rdx
jne 0x18009ad72
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009addf
mov r9, qword [0x1800ec2a0]
jmp 0x18009ace1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009ada5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009c150
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov r15, rdx
mov rdi, rcx
mov r9, qword [rax + 0x60]
mov rsi, qword [r9 + 0x10]
movsxd rax, dword [rsi + 0x3c]
mov r9d, dword [rax + rsi + 0x50]
lea r10, [rsi + r9]
test r8, r8
je 0x18009c1ad
cmp r8, rsi
jb 0x18009c23b
cmp r8, r10
ja 0x18009c23b
mov r9d, r10d
lea rsi, [r8 + 5]
sub r9d, r8d
mov ecx, r9d
lea eax, [r9 - 0x10]
add rcx, r8
cmp rcx, r10
cmovb eax, r9d
mov ebp, eax
test eax, eax
je 0x18009c23b
mov r14, rsi
mov rbx, rsi
neg r14
nop dword [rax]
movzx eax, byte [rbx]
sub al, 0x48
test al, 0xfb
jne 0x18009c22f
cmp byte [rbx + 1], 0x8d
jne 0x18009c22f
mov eax, dword [rbx + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, r14
add rdx, rbx
add rdx, rsi
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18009c22f
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18009c22f
mov r8d, 0xc
lea rcx, str.ByteProperty
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x18009c261
inc rbx
lea rax, [r14 + rbx]
cmp rax, rbp
jb 0x18009c1d0
xor r9d, r9d
mov qword [rdi], r9
mov byte [rdi + 8], r9b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
test rbx, rbx
je 0x18009c23b
xor r9d, r9d
mov r8, rbx
mov edx, r9d
nop
cmp byte [rbx], 0xff
jne 0x18009c28b
mov rcx, r8
sub rcx, rdx
movsxd rax, dword [rcx + 2]
add rcx, 6
add rcx, rax
cmp rcx, r15
je 0x18009c2aa
inc r9d
inc rdx
dec rbx
cmp rdx, 0x150
jl 0x18009c270
mov rdx, r15
mov rcx, rdi
call fcn.18009c150
jmp 0x18009c245
movsxd rax, r9d
sub r8, rax
mov rax, rdi
add r8, 6
cmp byte [r8], 0xe8
jne 0x18009c2d4
movsxd rcx, dword [r8 + 1]
add rcx, 5
mov byte [rdi + 8], 0
add rcx, r8
mov qword [rdi], rcx
jmp 0x18009c248
movsxd rcx, dword [r8 + 3]
add rcx, 7
mov byte [rdi + 8], 1
add rcx, r8
mov qword [rdi], rcx
jmp 0x18009c248
Function at 0x18009c2f0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800ec040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x30]
lea r8, [0x1800dc8c0]
lea rdx, str.kernel32.dll
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x10]
call fcn.18009b110
mov rcx, qword gs:[0x30]
mov rdx, rax
mov r8, qword [rcx + 0x60]
lea rcx, [rsp + 0x20]
mov r8, qword [r8 + 0x10]
call fcn.18009c150
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x18009c4db
cmp byte [rsp + 0x28], 0
je 0x18009c431
mov rax, qword gs:[0x30]
mov r9, qword [rsp + 0x20]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
cmp r9, rdx
jbe 0x18009c4db
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp r9, rcx
jae 0x18009c4db
mov rcx, qword [r9]
lea rdx, [rsp + 0x30]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009c4db
mov ecx, dword [rsp + 0x54]
mov r15d, 1
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
cmovne ecx, r15d
test cl, cl
jne 0x18009c4db
mov rdx, qword [0x1800ee2a0]
test rdx, rdx
jne 0x18009c411
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
mov qword [0x1800ee2a0], rdx
mov rax, qword [rsp + 0x20]
xor ebp, ebp
mov ecx, eax
sub ecx, edx
cmp rax, rdx
movzx eax, r15b
cmova ebp, ecx
mov dword [0x1800ee214], ebp
jmp 0x18009c4dd
call rax
xor ebp, ebp
mov r14, rax
mov ebx, ebp
mov r12d, 0x8b48
lea r15d, [rbp + 1]
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x20]
add rdx, rbx
cmp word [rdx], r12w
jne 0x18009c4cb
movsxd rdi, dword [rdx + 3]
add rdx, 7
mov rax, qword gs:[0x30]
add rdi, rdx
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
cmp rdi, rdx
jbe 0x18009c4cb
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp rdi, rcx
jae 0x18009c4cb
mov rsi, qword [rdi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009c4cb
mov ecx, dword [rsp + 0x54]
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
cmovne ecx, r15d
test cl, cl
jne 0x18009c4cb
cmp rsi, r14
je 0x18009c509
inc rbx
cmp rbx, 0x100
jl 0x18009c450
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800a0da0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rcx, qword [0x1800ee2a0]
test rcx, rcx
jne 0x18009c52d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [0x1800ee2a0], rcx
mov eax, edi
sub eax, ecx
cmp rdi, rcx
cmova ebp, eax
movzx eax, r15b
mov dword [0x1800ee214], ebp
jmp 0x18009c4dd
Function at 0x18009fe80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1800ec040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x30]
mov edx, 0x10
mov byte [0x1800ec0c8], 0
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x10]
mov ecx, dword [0x1800ee114]
movsxd rax, dword [rsi + 0x3c]
mov ebx, dword [rax + rsi + 0x50]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800ef584], ecx
jle 0x18009ff0d
lea rcx, [0x1800ef584]
call fcn.1800a1104
cmp dword [0x1800ef584], 0xffffffff
jne 0x18009ff0d
lea rcx, [0x1800ef584]
call fcn.1800a1098
lea eax, [rbx - 8]
xor ebp, ebp
mov r14d, eax
test eax, eax
je 0x18009ffdb
mov rdi, rsi
mov rdx, qword [rdi]
mov rbx, qword [rdi + 8]
cmp rdx, rbx
je 0x18009ffc8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18009ffc8
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18009ffc8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rbx, r8
jbe 0x18009ffc8
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rbx, rcx
jae 0x18009ffc8
mov r8d, 0x11
lea rcx, str.Conv_NameToString
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x18009ffc8
mov eax, dword [rbx]
cmp eax, 0x284883ec
je 0x18009ffc8
cmp eax, 0x4883ec28
je 0x18009ffc8
xor r9d, r9d
mov dword [rsp + 0x20], ebp
mov rdx, rbx
lea rcx, str.48_8B_05_________48_85_C0_75___48_8D_15
lea r8d, [r9 + 0x28]
call fcn.18009b620
test rax, rax
je 0x18009ffde
add rdi, 8
mov rax, rdi
sub rax, rsi
cmp rax, r14
jb 0x18009ff20
mov rbx, rbp
mov rdx, qword [0x1800ee2f0]
lea rax, str.89_44_____48_01_____E8
mov qword [rsp + 0x30], rax
lea rax, str.48_89_____48_8D_______E8
mov qword [rsp + 0x38], rax
lea rax, str.48_89_______48_89_____E8
mov qword [rsp + 0x40], rax
mov edi, ebp
test rdx, rdx
jne 0x1800a0069
lea rsi, [rsp + 0x30]
cmp edi, 3
jae 0x1800a0064
test rbx, rbx
jne 0x1800a0031
mov rdx, rbp
inc edi
mov qword [0x1800ee2f0], rdx
add rsi, 8
jmp 0x1800a0015
mov rcx, qword [rsi]
mov r9b, 1
mov r8d, 0x90
mov dword [rsp + 0x20], 0xffffffff
mov rdx, rbx
call fcn.18009b620
inc edi
mov qword [0x1800ee2f0], rax
add rsi, 8
mov rdx, rax
test rax, rax
je 0x1800a0015
jmp 0x1800a0069
test rdx, rdx
je 0x1800a0097
mov rcx, qword [0x1800ee2a0]
test rcx, rcx
jne 0x1800a008d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [0x1800ee2a0], rcx
mov eax, edx
sub eax, ecx
cmp rdx, rcx
cmova ebp, eax
mov dword [0x1800ee1e0], ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800a0da0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1800a0c20
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 8
cmp byte [rcx + 0x10], 0
mov r9d, edx
je 0x1800a0d80
cmp r9d, 0xffffffff
je 0x1800a0d80
mov rax, qword [rcx + 8]
cmp byte [rax + 0x13], 0
je 0x1800a0d80
mov rax, qword [rcx]
movabs r11, 0x100000001b3
movsxd r8, dword [0x1800ee25c]
mov qword [rsp], rbx
movabs rbx, 0xcbf29ce484222325
mov r10d, dword [r8 + rax]
xor r8d, r8d
mov eax, r10d
shr eax, 8
movzx edx, al
movzx eax, r10b
xor rax, rbx
imul rax, r11
xor rdx, rax
mov eax, r10d
imul rdx, r11
shr eax, 0x10
movzx ecx, al
mov eax, r10d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x1800ec220]
imul rdx, r11
xor rdx, rax
imul rdx, r11
and rcx, rdx
mov rdx, qword [0x1800ec1f8]
shl rcx, 4
add rcx, qword [0x1800ec208]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800a0cf1
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x1800a0cf4
nop dword [rax]
cmp rax, rcx
je 0x1800a0cf1
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x1800a0ce0
jmp 0x1800a0cf4
mov rax, r8
test rax, rax
mov r10, rdx
cmovne r10, rax
cmp r10, rdx
je 0x1800a0d75
movzx eax, byte [rsp + 0x19]
mov rcx, qword [r10 + 0x48]
movzx edx, r9b
xor rdx, rbx
imul rdx, r11
xor rdx, rax
movzx eax, byte [rsp + 0x1a]
imul rdx, r11
xor rdx, rax
movzx eax, byte [rsp + 0x1b]
imul rdx, r11
xor rdx, rax
imul rdx, r11
and rcx, rdx
shl rcx, 4
add rcx, qword [r10 + 0x30]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 0x20]
je 0x1800a0d66
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1800a0d63
cmp rax, rcx
je 0x1800a0d66
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1800a0d54
mov r8, rax
mov rbx, qword [rsp]
test r8, r8
setne al
add rsp, 8
ret
mov rbx, qword [rsp]
xor al, al
add rsp, 8
ret
xor al, al
add rsp, 8
ret

Function at 0x1800a2000
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800a203a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800a203f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800a2088
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800ab880]
cmp byte [rcx + rax], 0
je 0x1800a2088
dec r8
sub rdx, 1
jne 0x1800a206e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400076b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140007740
cmp r11, r10
ja 0x1400077b6
cmp r10, rdx
ja 0x1400077c8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140007742
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140007720
jmp 0x1400077a4
ja 0x14000774a
mov r11, r10
cmp rax, r8
jne 0x1400076e4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140007780
mov rdi, r8
sub ecx, edx
jns 0x14000779b
jmp 0x1400077a6
cmp r8, rsi
je 0x1400077d7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400077a6
xor al, 1
cmp rdi, rsi
jne 0x140007760
jmp 0x1400077a6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400053f0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400049c0
lea rcx, [0x1400950d3]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140004d60
int3

Function at 0x14000910e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140049028]
test ecx, ecx
je 0x140009127
dec ecx
add rsp, 0x28
jmp fcn.14004658c
lea rcx, [0x140049010]
call fcn.1400176f0
mov ecx, eax
jmp 0x14000911e

Function at 0x140009137
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140009158
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140046584
mov rcx, rax
call fcn.1400176f0
mov ecx, eax
jmp 0x14000914b
Function at 0x14000d8ba
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14000d8d3
dec ecx
add rsp, 0x28
jmp fcn.14004658c
mov rcx, rax
call fcn.1400176f0
mov ecx, eax
jmp 0x14000d8ca
Function at 0x14000f83b
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rdi, qword [rdi]
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
call fcn.14000f929
cmp eax, 0x1edab0ed
jne 0x14000f863
mov r14, qword [rdi + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov eax, dword [rax + r14 + 0x88]
test rax, rax
je 0x14000f8fb
mov edi, dword [rax + r14 + 0x18]
mov ecx, dword [rax + r14 + 0x1c]
add rcx, r14
mov qword [rsp + 0x20], rcx
mov r12d, dword [rax + r14 + 0x20]
add r12, r14
mov r13d, dword [rax + r14 + 0x24]
add r13, r14
xor ebx, ebx
xor r15d, r15d
cmp r15, rdi
je 0x14000f8fd
mov rbp, r15
mov ecx, dword [r12 + r15*4]
add rcx, r14
mov rax, rcx
mov rdx, rax
inc rax
cmp byte [rdx], 0
jne 0x14000f8c8
lea r15, [rbp + 1]
sub rdx, rcx
call fcn.14000f929
cmp eax, esi
jne 0x14000f8b6
movzx ecx, word [r13 + rbp*2]
cmp rdi, rcx
jbe 0x14000f919
mov rax, qword [rsp + 0x20]
mov ebx, dword [rax + rcx*4]
add rbx, r14
jmp 0x14000f8fd
xor ebx, ebx
movzx eax, word [rbx + 4]
add rbx, 0x12
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str._home_m0hx_.cargo_git_checkouts_rust_syscalls_68f3d3f4128be087_162451a_src_syscall_resolve.rs
mov rdx, rdi
call fcn.1400040e0
int3

Function at 0x14000f929
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x14000f965
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x14000f944
inc r8
jmp 0x14000f931
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x14000f93f
ret

Function at 0x1400131d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140004550
cmp rax, rcx
je 0x1400131f5
cmp rdx, 4
jae 0x1400131f8
xor eax, eax
xor r8d, r8d
jmp 0x140013290
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14004a5e0]
movdqa xmm3, xmmword [0x14004a5f0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140013220
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400132a7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140013290
ret
Function at 0x140014210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x14001426b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001426b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x140014286
cmp eax, 0x42
jne 0x14001426b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140014336
cmp byte [r8 + r11], 0x5f
jne 0x140014336
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001439e
mov rcx, rsi
xor edx, edx
call fcn.14000fc00
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14000fc00
test al, al
jne 0x140014431
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400142c2
lea rdx, [0x14009180b]
mov r8d, 1
call fcn.140004a40
test al, al
jne 0x140014431
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001427a
xor r14d, r14d
lea rbx, [0x140091b79]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400142f4
cmp byte [rax + rcx], 0x45
je 0x140014453
sub r14, 1
jb 0x140014319
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140014319
mov r8d, 2
mov rdx, rbx
call fcn.140004a40
test al, al
jne 0x140014431
mov rcx, rsi
call fcn.140011430
test al, al
jne 0x140014431
mov rax, qword [rsi]
test rax, rax
jne 0x1400142e0
jmp 0x14001427a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x1400143f8
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x140014392
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001437c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001436b
add dl, 0xa9
jmp 0x14001437a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400143f8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400143f8
movzx edx, bl
add rax, rdx
jae 0x140014340
jmp 0x1400143f8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400143f8
cmp rax, rcx
jae 0x1400143f5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001444b
cmp qword [rsi + 0x20], 0
je 0x140014444
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140014210
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001427c
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140014439
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x140091b58]
test r9b, r9b
cmovne rdx, rax
call fcn.140004a40
test al, al
je 0x140014439
mov dil, 2
jmp 0x14001427a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14001427a
mov dil, 1
xor r9d, r9d
jmp 0x1400143fa
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001427a
Function at 0x1400176f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140017775
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400177b6
cmp dword [rsp + 0x2c], 0
je 0x14001779a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400177ce
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x14009c108]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14009c108], rsi
jne 0x140017750
mov byte [0x14009c100], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400177ac
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140017818
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001779f
mov edi, dword [rsp + 0x28]
jmp 0x1400177ac
mov edi, dword [rsi + 0x18]
jmp 0x1400177aa
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140017e00
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadlocal.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140004020
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadlocal.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140017e50
int3
Function at 0x140017cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1400490f0]
test ecx, ecx
je 0x140017db0
dec ecx
call fcn.14004658c
cmp rax, 2
jb 0x140017d04
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140017d04
add rdi, 0x10
jmp 0x140017da6
mov ecx, dword [0x1400490f0]
test ecx, ecx
je 0x140017dc3
dec ecx
call fcn.14004658c
cmp rax, 1
je 0x140017da4
mov rsi, rax
test rax, rax
jne 0x140017d73
movzx eax, byte [0x14009c128]
mov ecx, 0x18
mov edx, 8
call fcn.140002f10
test rax, rax
je 0x140017de6
mov rsi, rax
lea rax, [0x1400490d8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400490f0]
test ecx, ecx
je 0x140017dd6
dec ecx
mov rdx, rsi
call fcn.140046584
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140017da6
test rcx, rcx
je 0x140017da6
lock dec qword [rcx]
jne 0x140017da6
call fcn.1400176a0
jmp 0x140017da6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400490d8]
call fcn.1400176f0
mov ecx, eax
jmp 0x140017ce6
lea rcx, [0x1400490d8]
call fcn.1400176f0
mov ecx, eax
jmp 0x140017d14
lea rcx, [0x1400490d8]
call fcn.1400176f0
mov ecx, eax
jmp 0x140017d6b
mov ecx, 8
mov edx, 0x18
call fcn.1400034d0
int3