joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085c60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x140085e62
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1402ea930]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140085cc6
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1402ea940]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x140085de4
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140085dba
movdqa xmm1, xmmword [0x1402ea940]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
xorps xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x1402ea950], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x140085e80
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140085ae6
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14008b310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x10
movabs rax, 0x100000001b3
mov r8d, dword [rcx + 0xc8]
mov dword [rsp + 4], r8d
mov r8, qword [rdx]
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 4]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 4
jne 0x14008b330
mov r9, qword [rcx + 0xc0]
mov qword [rsp + 8], r9
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 8]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 8
jne 0x14008b355
mov qword [rdx], r8
add rsp, 0x10
jmp 0x14008b564
push rsi
push rdi
push rax
movabs rax, 0x100000001b3
mov qword [rsp], 8
mov r8, qword [rdx]
xor r9d, r9d
movzx r10d, byte [rsp + r9]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 8
jne 0x14008b57f
xor r9d, r9d
lea r10, [r9 + r9*2]
lea r10, [rcx + r10*8]
mov r11, qword [r10]
mov qword [rsp], r11
xor esi, esi
movzx edi, byte [rsp + rsi]
inc rsi
xor r8, rdi
imul r8, rax
cmp rsi, 8
jne 0x14008b5a8
test r11, r11
je 0x14008b601
mov r11, qword [r10 + 8]
mov qword [rsp], r11
xor r11d, r11d
movzx esi, byte [rsp + r11]
inc r11
xor r8, rsi
imul r8, rax
cmp r11, 8
jne 0x14008b5cc
mov r10, qword [r10 + 0x10]
mov qword [rsp], r10
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor r8, r11
imul r8, rax
cmp r10, 8
jne 0x14008b5ec
inc r9
cmp r9, 8
jne 0x14008b597
mov qword [rdx], r8
add rsp, 8
pop rdi
pop rsi
ret

Function at 0x14008b564
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x10
movabs rax, 0x100000001b3
mov r8d, dword [rcx + 0xc8]
mov dword [rsp + 4], r8d
mov r8, qword [rdx]
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 4]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 4
jne 0x14008b330
mov r9, qword [rcx + 0xc0]
mov qword [rsp + 8], r9
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 8]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 8
jne 0x14008b355
mov qword [rdx], r8
add rsp, 0x10
jmp 0x14008b564
push rsi
push rdi
push rax
movabs rax, 0x100000001b3
mov qword [rsp], 8
mov r8, qword [rdx]
xor r9d, r9d
movzx r10d, byte [rsp + r9]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 8
jne 0x14008b57f
xor r9d, r9d
lea r10, [r9 + r9*2]
lea r10, [rcx + r10*8]
mov r11, qword [r10]
mov qword [rsp], r11
xor esi, esi
movzx edi, byte [rsp + rsi]
inc rsi
xor r8, rdi
imul r8, rax
cmp rsi, 8
jne 0x14008b5a8
test r11, r11
je 0x14008b601
mov r11, qword [r10 + 8]
mov qword [rsp], r11
xor r11d, r11d
movzx esi, byte [rsp + r11]
inc r11
xor r8, rsi
imul r8, rax
cmp r11, 8
jne 0x14008b5cc
mov r10, qword [r10 + 0x10]
mov qword [rsp], r10
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor r8, r11
imul r8, rax
cmp r10, 8
jne 0x14008b5ec
inc r9
cmp r9, 8
jne 0x14008b597
mov qword [rdx], r8
add rsp, 8
pop rdi
pop rsi
ret

Function at 0x14008c275
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x10
movabs rax, 0x100000001b3
mov r8d, dword [rcx + 0xc8]
mov dword [rsp + 4], r8d
mov r8, qword [rdx]
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 4]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 4
jne 0x14008c295
mov r9, qword [rcx + 0xc0]
mov qword [rsp + 8], r9
xor r9d, r9d
movzx r10d, byte [rsp + r9 + 8]
inc r9
xor r8, r10
imul r8, rax
cmp r9, 8
jne 0x14008c2ba
mov qword [rdx], r8
add rsp, 0x10
jmp 0x14008b564
Function at 0x14008c81b
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rax
movabs r8, 0x100000001b3
mov qword [rsp], rcx
movabs rax, 0xcbf29ce484222325
xor ecx, ecx
movzx r9d, byte [rsp + rcx]
inc rcx
xor rax, r9
imul rax, r8
cmp rcx, 8
jne 0x14008c836
mov qword [rsp], rdx
xor ecx, ecx
movzx edx, byte [rsp + rcx]
inc rcx
xor rax, rdx
imul rax, r8
cmp rcx, 8
jne 0x14008c851
pop rcx
ret
Function at 0x1400970c9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r8
movaps xmm6, xmm1
mov rdi, rcx
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
movabs r14, 0x100000001b3
test rcx, rcx
je 0x14009712b
movabs rbx, 0xcbf29ce484222325
xor edx, edx
movzx r8d, byte [r9 + rdx]
xor rbx, r8
imul rbx, r14
inc rdx
cmp rcx, rdx
jne 0x14009710a
xor rbx, 0xff
imul rbx, r14
jmp 0x140097135
movabs rbx, 0xaf64724c8602eb6e
cmp eax, 1
jne 0x14009717c
movss xmm0, dword [rsp + 0xa0]
call fcn.1402e5b90
cvttss2si eax, xmm0
ucomiss xmm0, dword [0x1402eac88]
mov ecx, 0x7fffffff
cmovbe ecx, eax
xor eax, eax
ucomiss xmm0, xmm0
cmovp ecx, eax
mov dword [rsp + 0x2c], ecx
movzx ecx, byte [rsp + rax + 0x2c]
inc rax
xor rbx, rcx
imul rbx, r14
cmp rax, 4
jne 0x140097167
mulss xmm6, dword [0x1402eac8c]
movaps xmm0, xmm6
call fcn.1402e5b90
cvttss2si rax, xmm0
xor ecx, ecx
xorps xmm1, xmm1
ucomiss xmm0, xmm1
cmovae ecx, eax
ucomiss xmm0, dword [0x1402eac90]
mov eax, 0xffffffff
cmovbe eax, ecx
mov dword [rdi + 0xc8], eax
mov qword [rdi + 0xc0], rbx
mov r8d, 0xc0
mov rcx, rdi
mov rdx, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.msvcrt.dll_memcpy
Function at 0x1400978e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rcx, qword [rsp + 0xf0]
movabs rax, 0x100000001b3
mov qword [rsp + 0x60], r9
movabs r8, 0xcbf29ce484222325
xor edx, edx
movzx r10d, byte [rsp + rdx + 0x60]
inc rdx
xor r8, r10
imul r8, rax
cmp rdx, 8
jne 0x14009791c
mov qword [rsp + 0x60], rcx
xor edx, edx
movzx r10d, byte [rsp + rdx + 0x60]
inc rdx
xor r8, r10
imul r8, rax
cmp rdx, 8
jne 0x140097939
mov rax, qword [rdi + 0x328]
mov rdx, qword [rdi + 0x330]
mov r10, rdx
and r10, r8
shr r8, 0x39
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r11d, r11d
pcmpeqd xmm1, xmm1
movdqu xmm2, xmmword [rax + r10]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb ebp, xmm3
test bp, bp
je 0x1400979ca
mov r8d, ebp
lea ebp, [r8 - 1]
and ebp, r8d
bsf r14d, r8d
add r14, r10
and r14, rdx
mov r8, r14
neg r8
lea r8, [r8 + r8*4]
shl r8, 4
cmp qword [rax + r8 - 0x50], r9
jne 0x140097993
cmp qword [rax + r8 - 0x48], rcx
jne 0x140097993
jmp 0x1400979ec
pcmpeqb xmm2, xmm1
pmovmskb r8d, xmm2
test r8d, r8d
jne 0x140097aea
add r10, r11
add r10, 0x10
add r11, 0x10
and r10, rdx
jmp 0x140097981
shl r14, 4
lea r9, [r14 + r14*4]
sar r9, 4
movabs rcx, 0xcccccccccccccccd
imul rcx, r9
lea r9, [rcx - 0x10]
and r9, rdx
movdqu xmm0, xmmword [rax + r9]
pcmpeqd xmm1, xmm1
pcmpeqb xmm0, xmm1
psllw xmm0, 7
pmovmskb r10d, xmm0
movdqu xmm0, xmmword [rax + rcx]
pcmpeqb xmm0, xmm1
pmovmskb edx, xmm0
test r10d, r10d
je 0x140097a42
bsr r10w, r10w
xor r10d, 0xf
jmp 0x140097a47
mov r10w, 0x10
add r8, rax
or edx, 0x10000
bsf edx, edx
add r10d, edx
mov dl, pe_nt_image_headers64
cmp r10w, 0xf
ja 0x140097a68
inc qword [rdi + 0x338]
mov dl, 0xff
mov byte [rax + rcx], dl
mov byte [r9 + rax + 0x10], dl
dec qword [rdi + 0x340]
mov rax, qword [r8 - 0x40]
mov rcx, qword [r8 - 8]
mov qword [rsp + 0x50], rcx
movups xmm0, xmmword [r8 - 0x18]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [r8 - 0x28]
movaps xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [r8 - 0x38]
movdqa xmmword [rsp + 0x20], xmm0
movabs rcx, 0x800000000000001a
cmp rax, rcx
je 0x140097aea
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
movdqa xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmmword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
movdqu xmmword [rcx + 8], xmm0
movdqu xmmword [rcx + 0x18], xmm1
movdqu xmmword [rcx + 0x28], xmm2
mov rax, qword [rsp + 0x50]
mov qword [rcx + 0x38], rax
call fcn.14008d173
test bl, bl
je 0x140097b11
mov rax, qword [rdi + 0x348]
mov dword [rsp + 0x60], esi
mov rax, qword [rax + 0x468]
test rax, rax
je 0x140097b20
lea rdx, [rsp + 0x60]
mov ecx, 1
call rax
nop
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, str.glDeleteTexturesglDeleteTextures
mov edx, 0x10
call fcn.1400a5f9a
int3
Function at 0x1400b3972
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1402e8648]
test ecx, ecx
je 0x1400b3a47
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400b39a6
cmp qword [rax + 8], 0
je 0x1400b39a6
add rax, 0x10
jmp 0x1400b3a40
mov ecx, dword [0x1402e8648]
test ecx, ecx
je 0x1400b3a5a
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b3a2a
mov rdi, rax
test rax, rax
jne 0x1400b3a10
mov al, byte [0x1403f9274]
mov ecx, 0x18
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400b3a7d
mov rdi, rax
lea rax, [0x1402e8630]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1402e8648]
test ecx, ecx
je 0x1400b3a6d
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x1400b3a2e
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x1400b3a30
mov rcx, qword [rsi + 8]
jmp 0x1400b3a30
xor eax, eax
jmp 0x1400b3a40
xor ecx, ecx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402e8630]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b398b
lea rcx, [0x1402e8630]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b39b6
lea rcx, [0x1402e8630]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b3a08
mov ecx, 8
mov edx, 0x18
call fcn.140077010
int3
Function at 0x1400b7c32
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rcx
mov ecx, dword [0x1402e8608]
test ecx, ecx
je 0x1400b7dbc
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400b7c67
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x1400b7da7
mov ecx, dword [0x1402e8608]
test ecx, ecx
je 0x1400b7dcf
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400b7dad
mov rsi, rax
test rax, rax
jne 0x1400b7cd9
mov al, byte [0x1403f9274]
mov ecx, 0x48
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400b7e1e
mov rsi, rax
lea rax, [0x1402e85f0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e8608]
test ecx, ecx
je 0x1400b7de2
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400b7d0b
cmp qword [rdi], 0
mov qword [rdi], 0
je 0x1400b7d0b
mov rax, qword [rdi + 8]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x38]
jmp 0x1400b7d41
call fcn.140234fc0
test rax, rax
je 0x1400b7df5
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lea r8, [rcx + 1]
mov qword [rax], r8
movups xmm0, xmmword [0x1403b5170]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.PQ__]
movaps xmmword [rsp + 0x30], xmm0
xor eax, eax
lea r8, [rsi + 8]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmm2, xmmword [r8 + 0x20]
movups xmm3, xmmword [r8 + 0x30]
movaps xmmword [rsp + 0x80], xmm3
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov qword [rsi + 0x38], rcx
mov qword [rsi + 0x40], rdx
cmp qword [rsp + 0x50], 0
je 0x1400b7da7
lea rcx, [rsp + 0x60]
call fcn.1400b8166
add rsi, 0x10
jmp 0x1400b7daf
xor esi, esi
mov rax, rsi
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, [0x1402e85f0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b7c4e
lea rcx, [0x1402e85f0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b7c77
lea rcx, [0x1402e85f0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400b7cd1
lea rax, str.J__
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadlocal.rs
lea r9, [0x140345f40]
lea r8, [rsp + 0x50]
mov edx, 0x46
call fcn.14007f9a0
mov ecx, 8
mov edx, 0x48
call fcn.140077010
int3
Function at 0x1400b7f8a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
mov rax, rcx
add qword [rcx + 0x30], 8
mov qword [rsp], rdx
mov r10, qword [rcx + 0x40]
test r10, r10
je 0x1400b8031
mov esi, 8
mov r9d, 8
sub r9, r10
cmp r9, 8
cmovb rsi, r9
xor r11d, r11d
xor r8d, r8d
cmp rsi, 4
mov ecx, edx
cmovae r11, rcx
setae r8b
lea rcx, [r8*4 + 1]
shl r8, 2
cmp rcx, rsi
jae 0x1400b7ff8
movzx edx, word [rsp + r8]
lea ecx, [r8*8]
shl rdx, cl
or r11, rdx
or r8, 2
cmp r8, rsi
jae 0x1400b800f
movzx edx, byte [rsp + r8]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r11, rdx
lea ecx, [r10*8]
shl r11, cl
or r11, qword [rax + 0x38]
mov qword [rax + 0x38], r11
cmp r10, 8
jbe 0x1400b8036
add r10, 8
jmp 0x1400b815b
xor r9d, r9d
jmp 0x1400b808a
mov r8, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, rdx
rol rdx, 0xd
xor r8, r11
xor rdx, rcx
rol rcx, 0x20
mov r10, qword [rax + 8]
add r10, r8
rol r8, 0x10
xor r8, r10
add rcx, r8
rol r8, 0x15
xor r8, rcx
add r10, rdx
rol rdx, 0x11
mov qword [rax + 0x18], r8
xor rdx, r10
rol r10, 0x20
mov qword [rax + 0x10], rdx
mov qword [rax + 8], r10
xor rcx, r11
mov qword [rax], rcx
mov ecx, 8
sub rcx, r9
mov r10d, ecx
and r10d, 7
and rcx, 0xfffffffffffffff8
cmp r9, rcx
jae 0x1400b8103
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov r11, qword [rax + 0x10]
add rdx, r11
rol r11, 0xd
mov rdi, qword [rsp + r9]
xor r11, rdx
rol rdx, 0x20
xor rsi, rdi
add r8, rsi
rol rsi, 0x10
xor rsi, r8
add rdx, rsi
rol rsi, 0x15
add r8, r11
rol r11, 0x11
xor r11, r8
rol r8, 0x20
xor rsi, rdx
xor rdx, rdi
add r9, 8
cmp r9, rcx
jb 0x1400b80b1
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], r11
mov qword [rax + 8], r8
mov qword [rax], rdx
cmp r10d, 3
jbe 0x1400b8114
mov r8d, dword [rsp + r9]
mov edx, 4
jmp 0x1400b8119
xor r8d, r8d
xor edx, edx
mov rcx, rdx
or rcx, 1
cmp rcx, r10
jae 0x1400b813f
lea rcx, [rdx + r9]
movzx r11d, word [rsp + rcx]
lea ecx, [rdx*8]
shl r11, cl
or r8, r11
or rdx, 2
cmp rdx, r10
jae 0x1400b8157
add r9, rdx
movzx r9d, byte [rsp + r9]
shl edx, 3
mov ecx, edx
shl r9, cl
or r8, r9
mov qword [rax + 0x38], r8
mov qword [rax + 0x40], r10
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x1400cdb9e
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402e8be0]
cmp rax, 2
jne 0x1400cdd36
lea r14, [0x1402e8bf0]
mov rcx, r14
call sub.kernel32.dll_AcquireSRWLockExclusive
mov rax, qword [0x1403f9258]
shl rax, 1
test rax, rax
jne 0x1400cdd40
xor ebx, ebx
mov al, byte [0x1402e8bf8]
test al, al
jne 0x1400cdd4f
lea rcx, [0x1402e8c00]
call fcn.1402defc3
cmp byte [rdx + 0x98], 0
je 0x1400cdc1e
mov ecx, 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
setns r15b
jmp 0x1400cdc21
mov r15b, 1
mov ecx, 0x10
call sub.user32.dll_GetKeyState
mov ebp, eax
mov ecx, 0x11
call sub.user32.dll_GetKeyState
mov r14d, eax
mov ecx, 0x12
call sub.user32.dll_GetKeyState
movzx ecx, bp
shr ecx, 0xf
lea edx, [rcx*4]
test r14w, r14w
lea ecx, [rcx*4 + 0x20]
cmovns ecx, edx
test r15b, r15b
cmove ecx, edx
lea ebp, [rcx + 0x100]
test ax, ax
cmovns ebp, ecx
test r15b, r15b
cmove ebp, ecx
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
js 0x1400cdc9d
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
js 0x1400cdc9d
and ebp, 0xf7ff
jmp 0x1400cdca3
or ebp, 0x800
lea rcx, [0x1402e8bf0]
mov edx, ebx
call fcn.1400d2632
mov rdx, qword [rdi + 0x10]
add rdx, 0x10
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.1402d836a
cmp qword [rbx], 0
jne 0x1400cdd81
mov rcx, qword [rsp + 0x40]
mov dl, byte [rsp + 0x48]
cmp dword [rcx + 0xd0], ebp
jne 0x1400cdcf5
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400d2632
mov dword [rcx + 0xd0], ebp
call fcn.1400d2632
mov rcx, qword [rdi + 0x18]
add rcx, 0x10
lea rdx, [rsp + 0x38]
mov word [rdx], 0xe
mov dword [rdx + 4], ebp
mov byte [rdx + 8], 0
mov qword [rdx + 0x88], rsi
call fcn.1400cd835
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1402d90fd
jmp 0x1400cdbc4
call fcn.1402113f0
mov ebx, eax
xor bl, 1
jmp 0x1400cdbe8
lea r8, [rsp + 0x38]
mov qword [r8], r14
mov byte [r8 + 8], bl
lea rax, str._home_janus_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winit_0.29.10_src_platform_impl_windows_event_loop.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x140345fc0]
mov edx, 0x2b
call fcn.14007f9a0
jmp 0x1400cddba
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x48]
lea r8, [rsp + 0x28]
mov qword [r8], rax
mov byte [r8 + 8], cl
lea rax, str._home_janus_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winit_0.29.10_src_platform_impl_windows_event_loop.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x140345fe0]
mov edx, 0x2b
call fcn.14007f9a0
ud2
Function at 0x1400e3335
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov rsi, rcx
mov ecx, dword [0x1402e8628]
test ecx, ecx
je 0x1400e348a
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e3371
mov rbx, rax
cmp qword [rax + 8], 0
jne 0x1400e346e
mov ecx, dword [0x1402e8628]
test ecx, ecx
je 0x1400e349d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400e3474
mov rbx, rax
test rax, rax
jne 0x1400e33e3
mov al, byte [0x1403f9274]
mov ecx, 0x90
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400e34c3
mov rbx, rax
lea rax, [0x1402e8610]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x1402e8628]
test ecx, ecx
je 0x1400e34b0
dec ecx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
lea rdx, [rbx + 8]
mov r15d, 3
test rsi, rsi
je 0x1400e341d
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x1400e341d
mov r12, qword [rsi + 8]
mov r15, qword [rsi + 0x10]
add rsi, 0x18
lea rdi, [rsp + 0xa8]
mov ecx, 0xe
rep movsq qword [rdi], qword [rsi]
jmp 0x1400e3420
xor r12d, r12d
lea r14, [rsp + 0x20]
mov r8d, 0x88
mov rcx, r14
call sub.msvcrt.dll_memcpy
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r15
lea rdi, [rbx + 0x20]
lea rsi, [rsp + 0xa8]
mov ecx, 0xe
rep movsq qword [rdi], qword [rsi]
cmp qword [r14], 0
je 0x1400e346e
cmp dword [rsp + 0x30], 3
je 0x1400e346e
lea rcx, [rsp + 0x30]
call fcn.1400d4781
add rbx, 0x10
jmp 0x1400e3476
xor ebx, ebx
mov rax, rbx
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1402e8610]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400e3358
lea rcx, [0x1402e8610]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400e3381
lea rcx, [0x1402e8610]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400e33db
mov ecx, 8
mov edx, 0x90
call fcn.140077010
int3
Function at 0x1400f0703
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1402e8718]
test ecx, ecx
je 0x1400f07e0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400f0737
cmp qword [rax + 8], 0
je 0x1400f0737
add rax, 0x10
jmp 0x1400f07d9
mov ecx, dword [0x1402e8718]
test ecx, ecx
je 0x1400f07f3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400f07bf
mov rdi, rax
test rax, rax
jne 0x1400f07a1
mov al, byte [0x1403f9274]
mov ecx, 0x20
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400f0816
mov rdi, rax
lea rax, [0x1402e8700]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1402e8718]
test ecx, ecx
je 0x1400f0806
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x1400f07c3
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
test rcx, rcx
je 0x1400f07c5
mov rcx, qword [rsi + 8]
jmp 0x1400f07c5
xor eax, eax
jmp 0x1400f07d9
xor ecx, ecx
mov qword [rdi + 8], 1
lea rax, [rdi + 0x10]
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rdx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402e8700]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f071c
lea rcx, [0x1402e8700]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f0747
lea rcx, [0x1402e8700]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f0799
mov ecx, 8
mov edx, 0x20
call fcn.140077010
int3

Function at 0x1400f3c51
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov ecx, dword [0x1402e86b8]
test ecx, ecx
je 0x1400f3d6d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400f3c8e
mov rbx, rax
cmp qword [rax + 8], 0
je 0x1400f3c8e
add rbx, 8
jmp 0x1400f3d5d
mov ecx, dword [0x1402e86b8]
test ecx, ecx
je 0x1400f3d80
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400f3d5b
mov rdi, rax
test rax, rax
jne 0x1400f3d00
mov al, byte [0x1403f9274]
mov ecx, 0x18
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400f3db7
mov rdi, rax
lea rax, [0x1402e86a0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1402e86b8]
test ecx, ecx
je 0x1400f3d93
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x1400f3d1e
mov rax, qword [rsi]
mov dl, byte [rsi + 8]
mov qword [rsi], 0
test rax, rax
jne 0x1400f3d45
xor ecx, ecx
call fcn.1400f3e12
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov al, byte [0x1403f9274]
mov ecx, 0x10
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1400f3da6
movups xmmword [rax], xmm6
xor edx, edx
lea rbx, [rdi + 8]
mov rcx, qword [rdi + 8]
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], dl
call fcn.1400f3e12
jmp 0x1400f3d5d
xor ebx, ebx
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402e86a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f3c70
lea rcx, [0x1402e86a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f3c9e
lea rcx, [0x1402e86a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x1400f3cf8
mov ecx, 8
mov edx, 0x10
call fcn.140077010
jmp 0x1400f3dc6
mov ecx, 8
mov edx, 0x18
call fcn.140077010
ud2