joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d54b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140036080]
jne 0x14001b54a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001b546
repz ret
ror rcx, 0x10
jmp 0x14001d4a4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140037740]
call qword [0x14002e308]
mov r11, qword [0x140037838]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14002b72a
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001d529
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140037740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call fcn.14002b736
jmp 0x14001d54b
mov rax, qword [rsp + 0x88]
mov qword [0x140037838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400377d8], rax
mov rax, qword [0x140037838]
mov qword [0x1400376b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400377c0], rax
mov dword [0x1400376a0], 0xc0000409
mov dword [0x1400376a4], 1
mov rax, qword [0x140036080]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140036088]
mov qword [rsp + 0x70], rax
call qword [0x14002e2f8]
mov dword [0x140037738], eax
mov ecx, 1
call fcn.140024948
xor ecx, ecx
call qword [0x14002e2f0]
lea rcx, [0x14002e7f8]
call qword [0x14002e2e8]
cmp dword [0x140037738], 0
jne 0x14001d5d2
mov ecx, 1
call fcn.140024948
call qword [0x14002e160]
mov edx, 0xc0000409
mov rcx, rax
call qword [0x14002e2e0]
add rsp, 0x88
ret

Function at 0x14001e134
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001dfa8
Function at 0x14001e140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140024b60
nop
cmp dword [0x140037c60], 1
je 0x14001e0e0
mov dword [0x140037c5c], 1
mov byte [0x140037c58], r12b
test ebx, ebx
jne 0x14001e0cc
mov rcx, qword [0x140039df0]
call fcn.14001d604
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001e0b9
mov rcx, qword [0x140039de8]
call fcn.14001d604
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001e058
call fcn.14001d5f8
cmp qword [rdi], rax
jne 0x14001e058
jmp 0x14001e03e
cmp rdi, rsi
jb 0x14001e0b9
mov rcx, qword [rdi]
call fcn.14001d604
mov rbx, rax
call fcn.14001d5f8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140039df0]
call fcn.14001d604
mov rbx, rax
mov rcx, qword [0x140039de8]
call fcn.14001d604
cmp r14, rbx
jne 0x14001e097
cmp r13, rax
je 0x14001e0b7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001e03e
lea rdx, [0x14002e5c0]
lea rcx, [0x14002e5a8]
call fcn.14001de88
lea rdx, [0x14002e5d0]
lea rcx, [0x14002e5c8]
call fcn.14001de88
nop
test r12d, r12d
je 0x14001e0ef
mov ecx, 8
call fcn.140024a60
test r12d, r12d
jne 0x14001e11a
mov dword [0x140037c60], 1
lea ecx, [r12 + 8]
call fcn.140024a60
mov ecx, r15d
call fcn.14001de1c
mov ecx, r15d
call qword [0x14002e358]
int3
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001dfa8
Function at 0x140029e1c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001d5f8
xor ebx, ebx
mov rdi, rax
cmp qword [0x140038528], rbx
jne 0x140029f22
lea rcx, str.USER32.DLL
call qword [0x14002e198]
mov rsi, rax
test rax, rax
je 0x140029ff7
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [0x14002e350]
test rax, rax
je 0x140029ff7
mov rcx, rax
call fcn.14001d5f0
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140038528], rax
call qword [0x14002e350]
mov rcx, rax
call fcn.14001d5f0
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140038530], rax
call qword [0x14002e350]
mov rcx, rax
call fcn.14001d5f0
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140038538], rax
call qword [0x14002e350]
mov rcx, rax
call fcn.14001d5f0
mov r11, rax
mov qword [0x140038548], rax
test rax, rax
je 0x140029f19
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [0x14002e350]
mov rcx, rax
call fcn.14001d5f0
mov qword [0x140038540], rax
jmp 0x140029f29
mov rax, qword [0x140038540]
jmp 0x140029f30
mov rax, qword [0x140038540]
mov r11, qword [0x140038548]
cmp rax, rdi
je 0x140029f98
cmp r11, rdi
je 0x140029f98
mov rcx, rax
call fcn.14001d604
mov rcx, qword [0x140038548]
mov rsi, rax
call fcn.14001d604
mov r12, rax
test rsi, rsi
je 0x140029f98
test rax, rax
je 0x140029f98
call rsi
test rax, rax
je 0x140029f92
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140029f92
test byte [rsp + 0x38], 1
jne 0x140029f98
bts ebp, 0x15
jmp 0x140029fd6
mov rcx, qword [0x140038530]
cmp rcx, rdi
je 0x140029fd6
call fcn.14001d604
test rax, rax
je 0x140029fd6
call rax
mov rbx, rax
test rax, rax
je 0x140029fd6
mov rcx, qword [0x140038538]
cmp rcx, rdi
je 0x140029fd6
call fcn.14001d604
test rax, rax
je 0x140029fd6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140038528]
call fcn.14001d604
test rax, rax
je 0x140029ff7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140029ff9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
nop
and rsp, 0xfffffffffffffff0
nop
call fcn.140001305
push r9
nop
push r8
nop
push rdx
nop
push rcx
nop
push rsi
nop
xor rdx, rdx
nop
mov rdx, qword gs:[rdx + 0x60]
nop
mov rdx, qword [rdx + 0x18]
nop
mov rdx, qword [rdx + 0x20]
nop

Function at 0x140001260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rdx + 0x50]
nop
movzx rcx, word [rdx + 0x4a]
nop
xor r9, r9
nop
xor rax, rax
nop
lodsb al, byte [rsi]
nop
cmp al, 0x61
nop
jl 0x14000122a
nop
sub al, 0x20
nop
ror r9d, 0xb7
nop
add r9d, eax
nop
loop 0x14000121b
nop
push rdx
nop
push r9
nop
mov rdx, qword [rdx + 0x20]
nop
mov eax, dword [rdx + 0x3c]
nop
add rax, rdx
nop
cmp word [rax + 0x18], 0x20b
nop
jne 0x1400012f6
nop
mov eax, dword [rax + 0x88]
nop
test rax, rax
nop
je 0x1400012f6
nop
add rax, rdx
nop
push rax
nop
mov ecx, dword [rax + 0x18]
nop
mov r8d, dword [rax + 0x20]
nop
add r8, rdx
nop
jrcxz 0x1400012f4
nop
dec rcx
leave
nop
mov esi, dword [r8 + rcx*4]
nop
add rsi, rdx
nop
xor r9, r9
nop
xor rax, rax
nop
lodsb al, byte [rsi]
nop
ror r9d, 0xb7
nop
add r9d, eax
nop
cmp al, ah
nop
jne 0x14000128f
nop
add r9, qword [rsp + 8]
nop
cmp r9d, r10d
nop
jne 0x14000127b
nop
pop rax
nop
mov r8d, dword [rax + 0x24]
nop
add r8, rdx
nop
mov cx, word [r8 + rcx*2]
nop
mov r8d, dword [rax + 0x1c]
nop
add r8, rdx
nop
mov eax, dword [r8 + rcx*4]
nop
add rax, rdx
nop
pop r8
nop
pop r8
nop
pop rsi
nop
pop rcx
nop
pop rdx
nop
pop r8
nop
pop r9
nop
pop r10
nop
sub rsp, 0x20
nop
push r10
nop
jmp rax
pop rax
nop
pop r9
nop
pop rdx
nop
mov rdx, qword [rdx]
nop
jmp 0x14000120c
Function at 0x140001730
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov qword [rsp + 0x58], 0
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x6c], 0
mov eax, dword [0x14019f30c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x48]
cmp rax, 1
jne 0x140001912
mov eax, dword [0x14019f30c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x50]
inc qword [rbx]
je 0x140001921
mov rax, qword [rbx + 0x110]
cmp rax, 0x40
jb 0x1400017e9
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x120]
mov rax, qword [rbx + 0x158]
test rax, rax
jle 0x1400017e2
cmp qword [rbx + 0x160], 0
js 0x1400017e2
add rax, 0xffffffffffffff00
mov qword [rbx + 0x158], rax
call fcn.1400441f0
jmp 0x1400017e7
call fcn.1401185b0
xor eax, eax
mov ebp, dword [rbx + rax*4 + 0x10]
inc rax
mov qword [rbx + 0x110], rax
and ebp, 1
or ebp, 0x1000
dec qword [rbx]
jne 0x14000181d
dec qword [rbx + 8]
jne 0x14000181d
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], 0x40
lea r14, [rsp + 0x58]
lea r15, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
mov rdx, r14
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r15
mov r9d, 0x50
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp qword [rsi], 0
je 0x140001904
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test rax, rax
jne 0x140001923
call fcn.1401264e0
jmp 0x14000177d
ud2
lea rax, [0x14018dc10]
mov qword [rsp + 0x20], rax
lea rcx, [0x14018db7b]
lea r9, [0x14018dc28]
lea r8, [rsp + 0x60]
mov edx, 0x46
call fcn.140121e20
int3
Function at 0x1400218b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400218f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400218fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002190b
jmp 0x140021922
xor r10d, r10d
jmp 0x1400219ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140021922
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140021939
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140021959
add r11, r8
jmp 0x140021a89
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140021a22
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400219d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140021a3f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x140021a50
jmp 0x140021a6b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x140021a6b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140021a85
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002c2e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14002c376
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14012e750]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14012e760]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400218b0
test rdi, rdi
je 0x14002c405
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002c41e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14002c516
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14002c598
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14002c523
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14002c3e0
cmp r9, 8
jae 0x14002c52c
jmp 0x14002c598
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400218b0
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14002c598
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14002c598
mov r8, rcx
cmp r9, 8
jb 0x14002c598
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14002c530
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14006d6c0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x14006d700
movabs r12, 0x8000000000000000
jmp 0x14006d75a
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x14006d73a
movzx eax, byte [0x14019f308]
xor ecx, ecx
mov rdx, rdi
call fcn.1400e7f40
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x14006d743
mov ecx, 1
mov rdx, rdi
call fcn.1401216a0
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140120b90
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14007d420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
movaps xmmword [rsp + 0x150], xmm6
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov r8, rbx
call fcn.140008010
mov r8, qword [rsp + 0xe0]
Function at 0x140081820
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140081830
test al, 1
je 0x14008191f
test al, 2
jne 0x140081937
test al, 8
jne 0x14008186b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.1400c5de0
jmp 0x140081889
test al, 0x10
je 0x140081889
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400819bb
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff070
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14008194f
jne 0x140081914
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400818d8
mov rcx, rdi
call fcn.140092df0
lea rcx, [rsi + 0x30]
call fcn.14007ee30
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400818f7
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14019f258]
xor edx, edx
add rsp, 0x238
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140165b78]
mov edx, 0x23
call fcn.140121b80
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140165bb8]
mov edx, 0x25
call fcn.140121b80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008da0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140165c00]
lea rcx, [rsp + 0x50]
call fcn.140121ad0
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140121ad0
int3
Function at 0x140081a00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140081a10
test al, 1
je 0x140081aff
test al, 2
jne 0x140081b17
test al, 8
jne 0x140081a4b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.1400c5de0
jmp 0x140081a69
test al, 0x10
je 0x140081a69
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140081b9b
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fecd0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140081b2f
jne 0x140081af4
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140081ab8
mov rcx, rdi
call fcn.140092d30
lea rcx, [rsi + 0x30]
call fcn.14007ee30
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140081ad7
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14019f258]
xor edx, edx
add rsp, 0x238
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140165b78]
mov edx, 0x23
call fcn.140121b80
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140165bb8]
mov edx, 0x25
call fcn.140121b80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008da0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140165c00]
lea rcx, [rsp + 0x50]
call fcn.140121ad0
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140121ad0
int3
Function at 0x140082a70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140082a80
test al, 1
je 0x140082b6f
test al, 2
jne 0x140082b87
test al, 8
jne 0x140082abb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 0xc
lea rdx, [rsp + 0x50]
call fcn.1400c5fc0
jmp 0x140082ad9
test al, 0x10
je 0x140082ad9
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140082c0b
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff070
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140082b9f
jne 0x140082b64
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140082b28
mov rcx, rdi
call fcn.140092df0
lea rcx, [rsi + 0x30]
call fcn.14007fb10
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140082b47
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14019f258]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x208
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140165b78]
mov edx, 0x23
call fcn.140121b80
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140165bb8]
mov edx, 0x25
call fcn.140121b80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008da0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140165c00]
lea rcx, [rsp + 0x50]
call fcn.140121ad0
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140121ad0
int3