joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov rsi, qword [rdi + 0x28]
cmp rsi, 0x7fff
jbe 0x14002e457
lea rcx, [rdx + 0x18]
mov r9, qword [rdx]
mov rax, qword [rdx + 8]
mov r8, qword [rdx + 0x10]
mov rdx, rax
call qword [r9 + 0x20]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14002e450
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
call qword [rax + 0x20]
xor eax, eax
jmp 0x14002e579
lea r15, [rcx + 8]
movzx ebp, word [rcx + 0x30]
mov r14, qword [rcx + 0x28]
movzx ebx, byte [rcx + 0x32]
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
cmp rsi, qword [rdi + 0x18]
jne 0x14002e497
lea rcx, [rdi + 0x18]
lea rdx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001fhttp_1.2.0_srcheadermap.rs
call fcn.140016d20
mov rcx, qword [rdi + 0x20]
imul rax, rsi, 0x68
mov qword [rcx + rax], 0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + rax + 0x18], xmm0
movups xmmword [rcx + rax + 0x28], xmm1
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax + 0x38], rdx
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rcx + rax + 0x40], xmm0
movups xmmword [rcx + rax + 0x50], xmm1
mov word [rcx + rax + 0x60], bp
lea rcx, [rsi + 1]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rdi + 0x48]
mov r8, qword [rdi + 0x50]
xor edx, edx
mov r9d, esi
nop word cs:[rax + rax]
mov r10, r14
mov r14d, 0
cmp r10, r8
jae 0x14002e500
movzx r11d, word [rcx + r10*4]
cmp r11w, 0xffff
je 0x14002e53c
inc rdx
movzx r14d, word [rcx + r10*4 + 2]
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
inc r10
mov ebp, r14d
mov r9d, r11d
mov r14, r10
jmp 0x14002e500
xor bl, 1
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
cmp rdx, 0x80
setb cl
test cl, bl
jne 0x14002e565
cmp qword [rdi], 0
jne 0x14002e565
mov qword [rdi], 1
mov rdx, qword [rdi + 0x28]
cmp rsi, rdx
jae 0x14002e586
mov rcx, qword [rdi + 0x20]
add rax, rcx
add rax, 0x18
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001fhttp_1.2.0_srcheadermap.rs
mov rcx, rsi
call fcn.1400f7fe0
int3
Function at 0x14002e5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14002e636
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdetpppppppppppppppp]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1400ff700]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001af60
test rdi, rdi
je 0x14002e6c5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002e6de
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14002e7d6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14002e858
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14002e7e3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14002e6a0
cmp r9, 8
jae 0x14002e7ec
jmp 0x14002e858
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001af60
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14002e858
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14002e858
mov r8, rcx
cmp r9, 8
jb 0x14002e858
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14002e7f0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14003b330
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14003b340
test al, 1
je 0x14003b403
test al, 2
jne 0x14003b41b
test al, 8
jne 0x14003b37a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
call fcn.14003bcd0
jmp 0x14003b398
test al, 0x10
je 0x14003b398
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14003b4a5
mov rcx, qword [rsi + 0x90]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x98]
test rax, rax
je 0x14003b3cf
mov r8, qword [rsi + 0xa0]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [r8 + 0x28]
mov qword [rsp + 0x20], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14003b433
jne 0x14003b3f9
mov rcx, rsi
call fcn.14003b150
nop
add rsp, 0x90
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140142e70]
mov edx, 0x23
call fcn.1400f8090
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140142eb0]
mov edx, 0x25
call fcn.1400f8090
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rax, [fcn.140009b10]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140142ef8]
lea rcx, [rsp + 0x30]
call fcn.1400f8050
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.1400f8050
int3
Function at 0x140046f60
Capabilities:
Encrypt data using aes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov byte [rdx + 0xf0], 0xe
mov r8d, dword [rcx]
bswap r8d
mov dword [rdx], r8d
mov eax, dword [rcx + 4]
bswap eax
mov dword [rdx + 4], eax
movdqu xmm0, xmmword [rcx + 8]
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpckhbw xmm2, xmm1
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm0, xmm1
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm2
movdqu xmmword [rdx + 8], xmm0
mov r9d, dword [rcx + 0x18]
bswap r9d
mov dword [rdx + 0x18], r9d
mov ecx, dword [rcx + 0x1c]
bswap ecx
mov dword [rdx + 0x1c], ecx
movd r9d, xmm0
pshufd xmm0, xmm0, 0x55
movd ebx, xmm0
xor r10d, r10d
lea r11, [0x140134c28]
lea r13, [0x140135028]
lea r15, [0x140135428]
lea r14, [0x140135828]
nop word cs:[rax + rax]
mov r12d, ecx
shr r12d, 0xe
and r12d, 0x3fc
movzx ebp, byte [r12 + r11 + 3]
shl ebp, 0x18
movzx esi, ch
movzx esi, byte [r13 + rsi*4 + 2]
shl esi, 0x10
xor esi, r8d
xor esi, ebp
movzx r8d, cl
movzx ebp, byte [r15 + r8*4 + 1]
shl ebp, 8
mov r8d, ecx
shr r8d, 0x18
movzx r8d, byte [r14 + r8*4]
xor r8d, ebp
xor r8d, esi
lea rsi, [0x140135c28]
xor r8d, dword [r10 + rsi]
mov dword [rdx + r10*8 + 0x20], r8d
xor eax, r8d
mov dword [rdx + r10*8 + 0x24], eax
xor r9d, eax
mov dword [rdx + r10*8 + 0x28], r9d
xor ebx, r9d
mov dword [rdx + r10*8 + 0x2c], ebx
cmp r10, 0x18
je 0x1400470e3
mov esi, ebx
shr esi, 0x18
movzx esi, byte [r11 + rsi*4 + 3]
shl esi, 0x18
xor esi, dword [rdx + r10*8 + 0x10]
mov r12d, ebx
shr r12d, 0xe
and r12d, 0x3fc
movzx ebp, byte [r12 + r13 + 2]
shl ebp, 0x10
movzx edi, bh
movzx edi, byte [r15 + rdi*4 + 1]
shl edi, 8
xor edi, ebp
movzx r12d, bl
movzx ebp, byte [r14 + r12*4]
xor ebp, edi
xor ebp, esi
mov dword [rdx + r10*8 + 0x30], ebp
xor ebp, dword [rdx + r10*8 + 0x14]
mov dword [rdx + r10*8 + 0x34], ebp
xor ebp, dword [rdx + r10*8 + 0x18]
mov dword [rdx + r10*8 + 0x38], ebp
xor ecx, ebp
mov dword [rdx + r10*8 + 0x3c], ecx
add r10, 4
jmp 0x140047000
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400619f0
Capabilities:
Check os version
Encode data using xor
Get number of processors

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x9b8
movdqa xmmword [rsp + 0x9a0], xmm11
movdqa xmmword [rsp + 0x990], xmm10
movaps xmmword [rsp + 0x980], xmm9
movaps xmmword [rsp + 0x970], xmm8
movdqa xmmword [rsp + 0x960], xmm7
movaps xmmword [rsp + 0x950], xmm6
mov rbx, r8
mov r13, rdx
mov qword [rsp + 0x538], rcx
lea rax, [rdx + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rdx + 0x220]
mov qword [rsp + 0x90], rax
Function at 0x14006b6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe08
movaps xmmword [rsp + 0xdf0], xmm10
movaps xmmword [rsp + 0xde0], xmm9
movaps xmmword [rsp + 0xdd0], xmm8
movaps xmmword [rsp + 0xdc0], xmm7
movaps xmmword [rsp + 0xdb0], xmm6
mov rsi, rdx
mov rdi, rcx
movzx r14d, byte [rdx + 0xb8]
movzx eax, byte [rdx + 0xd8]
lea ecx, [rax - 2]
cmp ecx, 2
jae 0x14006b74a
movzx ebp, byte [rsi + 0x60]
test ebp, ebp
je 0x14006b7f4
cmp ebp, 1
jne 0x14006b7f6
movzx r15d, byte [rsi + 0x61]
jmp 0x14006b849
cmp eax, 1
jne 0x14006b790
cmp r14b, 7
jne 0x14006b72b
movzx eax, byte [0x1401542b0]
mov edx, 0x98
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je 0x14006c224
mov rdi, rax
mov qword [rax], 3
mov qword [rax + 8], 0
mov byte [rax + 0x31], 2
mov byte [rax + 0x38], 3
jmp 0x14006bb43
movzx eax, byte [0x1401542b0]
mov edx, 0x98
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je 0x14006c224
mov rbx, rax
mov qword [rax], 3
mov qword [rax + 8], 0
mov byte [rax + 0x31], 2
mov byte [rax + 0x38], 4
movzx eax, byte [0x1401542b0]
mov edx, 8
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je 0x14006c251
mov rdi, rax
mov qword [rax], rbx
lea rbx, [0x140117d20]
jmp 0x14006bb4a
jmp 0x14006b849
mov r15, qword [rsi + 0x68]
movzx eax, byte [0x1401542b0]
mov edx, 0x20
xor ecx, ecx
call fcn.1400de8b0
test rax, rax
je 0x14006c233
mov rbx, rax
lea rdx, [r15 + 0x18]
mov rax, qword [r15]
mov r8, qword [r15 + 8]
mov r9, qword [r15 + 0x10]
lea rcx, [rsp + 0x2b0]
mov al, 2
add byte [rax], al

Function at 0x140071bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3c8
movaps xmmword [rsp + 0x3b0], xmm11
movaps xmmword [rsp + 0x3a0], xmm10
movaps xmmword [rsp + 0x390], xmm9
movaps xmmword [rsp + 0x380], xmm8
movaps xmmword [rsp + 0x370], xmm7
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [rdx + 0x158]
lock inc qword [rax]
jle 0x140072717
mov rdi, r8
mov r15, rdx
mov rsi, rcx
movups xmm6, xmmword [rdx + 0x158]
mov r13, qword [rdx + 0x168]
test r13, r13
je 0x140071c3f
lock inc qword [r13]
jle 0x140072717
movsd xmm7, qword [r15 + 0xb0]
movzx r12d, byte [r15 + 0xba]
movzx eax, byte [r15 + 0xb8]
mov byte [rsp + 0x3f], al
movzx r14d, byte [r15 + 0xb9]
mov rbx, qword [r15 + 0x80]
mov rax, qword [r15 + 0x88]
mov rcx, qword [r15 + 0x90]
mov rdx, qword [r15 + 0x98]
mov r8, qword [r15 + 0xa0]
mov r9, qword [r15 + 0xa8]
mov r10, qword [r15 + 0x138]
mov r11, qword [r15 + 0x140]
lock inc qword [r10]
jle 0x140072717
mov rbp, qword [r15 + 0x148]
test rbp, rbp
mov qword [rsp + 0x1e8], rbp
je 0x140071cd6
lock inc qword [rbp]
jle 0x140072717
mov rbp, qword [r15 + 0x150]
mov qword [rsp + 0x140], rbp
jmp 0x140071cd6
mov byte [rsp + 0x3e], r12b
movzx ebp, byte [r15 + 0x134]
add byte [rax - 0x78], al
insb byte [rdi], dx
and al, 0x3c
Function at 0x140073340
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0xb8]
mov r8d, 0xb
mov rdx, rax
call fcn.1400c0c30
mov esi, 0xc70004d8
and al, 0x5c
add byte [rax], al
add byte [rax], al
Function at 0x140088460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x1400884a0
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x1400885c2
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x1400885d1
cmp byte [rdx + 0x1a], 0
jne 0x1400885f8
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
movzx r10d, byte [rdx + 0x18]
jmp 0x1400884c7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.1400888b0
jmp 0x1400885fd

Function at 0x14008c270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp byte [rcx + 0x79], 0
je 0x14008c284
mov r8, qword [rcx + 0x48]
mov r9, qword [rcx + 0x50]
test byte [rcx], 1
je 0x14008c2bf
lea rdx, [rcx + 8]
mov rax, qword [rcx + 0x58]
cmp qword [rcx + 0x38], 0xffffffffffffffff
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
je 0x14008c3f6
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x14008c405
cmp byte [rcx + 0x1a], 0
je 0x14008c2df
mov rsi, r8
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x14008c445
jmp 0x14008c477
mov rax, qword [rcx + 8]
movzx edx, byte [rcx + 0x18]
jmp 0x14008c2f7
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
and al, 0x20
Function at 0x14008f820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1228
call fcn.1400f70a0
sub rsp, rax
movdqa xmmword [rsp + 0x1210], xmm11
movdqa xmmword [rsp + 0x1200], xmm10
movdqa xmmword [rsp + 0x11f0], xmm9
movaps xmmword [rsp + 0x11e0], xmm8
movaps xmmword [rsp + 0x11d0], xmm7
movdqa xmmword [rsp + 0x11c0], xmm6
mov qword [rsp + 0x630], rdx
mov rdi, rcx
movzx eax, byte [rcx + 0x1e0]
test eax, eax
mov qword [rsp + 0x68], rcx
je 0x14008f8c0
cmp eax, 3
jne 0x14008fb13
lea r14, [rdi + 0x1d8]
movzx eax, byte [rdi + 0x1d8]
test eax, eax
je 0x14008f98c
cmp eax, 3
jne 0x14008fb1f
mov rsi, qword [rdi + 0x1d0]
jmp 0x14008fb57
lea rsi, [rsp + 0x200]
mov r8d, 0x1a8
mov rcx, rsi
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call fcn.1400a2880
test rax, rax
je 0x14008f998
invalid
scasb al, byte [rdi]
add byte [rax], al
invalid
mov rcx, qword [rdi + 0x1b0]
mov rsi, qword [rdi + 0x1c8]
jmp 0x14008fb50
mov qword [rdi + 0x1b8], rdx
mov rcx, qword [rdi + 0x1b0]
xor edx, edx
call fcn.14007e0d0
cmp rax, 1
jne 0x14008fb03
mov rsi, rdx
test rdx, rdx
je 0x14008fa3a
mov rdi, qword [rsi + 0x58]
test rdi, rdi
je 0x14008f9ff
mov rbx, qword [rsi + 0x60]
mov rax, qword [rbx]
test rax, rax
je 0x14008f9d9
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x14008f9ff
cmp qword [rbx + 0x10], 0x11
jb 0x14008f9eb
mov rdi, qword [rdi - 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsi]
neg rax
jo 0x14008fa21
jae 0x14008fa21
mov rdi, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x68]
mov rax, qword [rdi + 0x1b8]
lock dec qword [rax]
jne 0x14008fa53
mov rcx, qword [rdi + 0x1b8]
call fcn.140060ed0
mov rax, qword [rdi + 0x1a8]
mov qword [rdi + 0x1c0], rax
jmp 0x14008fb34
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.12.9_src_blockingclient.rsthread_not_dropped_yet
call fcn.1400f8620
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_src_syncmpscunbounded.rs
call fcn.1400f8620
Function at 0x1400956e0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xe8]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x140095720
movabs r12, 0x8000000000000000
jmp 0x140095781
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x140095761
movzx eax, byte [0x1401542b0]
xor ecx, ecx
mov rdx, rdi
call fcn.1400de8b0
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x14009576a
lea r8, str..rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrary_alloc_src_slice.rs
mov ecx, 1
mov rdx, rdi
call fcn.1400f7b73
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14009da00
Capabilities:
Connect socket
Enumerate pe sections

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x70]
test eax, eax
je 0x14009da4d
invalid
cmp eax, 3
jne 0x14009dcee
lea r15, [rsi + 0x68]
movzx eax, byte [rsi + 0x68]
lea rbx, [rsi + 0x30]
test eax, eax
je 0x14009db8f
cmp eax, 3
jne 0x14009dcfa
mov rax, qword [rsi + 0x60]
jmp 0x14009dbdd
add dword [rax], eax
invalid
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x28], rcx
mov eax, dword [rsi + 2]
movzx edx, word [rsi + 6]
shl rdx, 0x20
or rdx, rax
test byte [rsi], 1
je 0x14009dae0
mov r12, r8
mov r10d, dword [rsi + 0x14]
mov r8d, dword [rsi + 0x18]
sbb byte [rdi], r9b
mov bh, 0x46
sbb al, 0x48
shr edx, 0x10
mov dword [rsp + 0x50], edx
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x54], rdx
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x5c], edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
add byte [rax], al
add byte [rdi], cl
adc dword [rsp + 0xa4], eax
mov r12, r8
mov rax, rdx
shr rax, 0x20
rol ax, 8
ror byte [rax], 0xf
push rdi
ror byte [rdi], 0x11
test byte [rax + rsi*4], ah
add byte [rax], al
add byte [rdi], cl
adc dword [rsp + 0xa0], eax
invalid
add byte [rax], al
invalid
mov r12, r8
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
movups xmm0, xmmword [rsp + 0x58]
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_src_net_tcp_socket.rs
call fcn.1400f8620
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.42.0_src_net_tcp_stream.rs
call fcn.1400f8620
Function at 0x1400a0d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov r14, r8
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x10]
cmp dword [rdx + 0x18], 0x3b9aca00
jne 0x1400a0df2
invalid
test al, 0
add byte [rax], al
mov rdx, qword [rdi + 0x80]
mov r8d, dword [rdi + 0x88]
lea r9, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.12.9_src_async_impl_body.rs
lea rcx, [rsp + 0x20]
call fcn.1400e70f0
cmp dword [rdi + 0x18], 0x3b9aca00
je 0x1400a0da4
mov rcx, rbx
call fcn.1400e3b00
add byte [rax - 0x75], cl
and r8b, r14b
dec qword [rax]
jne 0x1400a0d8d
mov rcx, qword [rdi + 0x20]
call fcn.1400e1f10
cmp qword [rdi + 0x28], 0
je 0x1400a0da4
invalid
mov rax, qword [rdi + 0x50]
test rax, rax
je 0x1400a0da4
mov rcx, qword [rdi + 0x58]
call qword [rax + 0x18]
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rbx + 0x60], xmm0

Function at 0x1400a6b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
pop rax
add dword [rax], eax
add byte [rdi], cl
sub dword [rsp + 0x140], esi
mov rbx, rdx
mov rsi, rcx
mov r14, qword [rdx + 8]
mov rdi, qword [rdx + 0x10]
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov r8, rdi
call fcn.140008a10
mov r8, qword [rsp + 0xe0]
mov bpl, 3
cmp r8, 0xfffe
jbe 0x1400a6b98
mov r15b, 8
jmp 0x1400a6dea
test r8w, r8w
je 0x1400a6bd9
movzx eax, r8w
mov r15b, 9
jmp 0x1400a6dea