joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016c400
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x110]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov r14, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
mov rbx, qword [rbp + 0x58]
cmp byte [rbp + 0x30], 0
jne 0x14016c44a
xor r15d, r15d
jmp 0x14016c450
mov r15d, 1
test rcx, rcx
je 0x14016c45b
add rcx, 0xc
jmp 0x14016c45d
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov r12, rcx
mov qword [rbp - 0x48], r8
mov r13, r8
mov qword [rbp - 0x58], r9
mov rax, r9
mov qword [rbp - 0x50], rax
test r14, r14
je 0x14016c481
add r14, 0xc
jmp 0x14016c484
xor r14d, r14d
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov dword [rsp + 0x20], r15d
mov r15d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r15d
mov r15, qword [rbp + 0x40]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov rcx, r12
mov qword [rbp - 0x78], rcx
mov rdx, rsi
mov qword [rbp - 0x80], rdx
mov r8, r13
mov qword [rbp - 0x88], r8
mov r9, qword [rbp - 0x50]
mov qword [rbp - 0x90], r9
lea rcx, [rbp - 0xb8]
call fcn.140004640
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x88]
mov r9, qword [rbp - 0x90]
call sub.KERNEL32.dll_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0xb8]
call fcn.140004690
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.14000301f
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14016d000
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movups xmmword [rbp - 0x68], xmm4
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rsi, r8
mov edi, r9d
xor edx, edx
mov dword [rbp - 0x3c], edx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x50], rdx
lea rcx, [0x140235f28]
call fcn.140004210
mov rbx, rax
mov rcx, rbx
call fcn.1400ad6f0
mov qword [rbp - 0x60], rbx
lea rcx, [0x140235f28]
call fcn.140004210
mov r14, rax
mov rcx, r14
call fcn.1400ad6f0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x74], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x7c], rdx
mov r8, rsi
mov qword [rbp - 0x84], r8
mov r9d, edi
mov dword [rbp - 0x6c], r9d
lea rcx, [rbp - 0xb0]
call fcn.140004640
mov rcx, qword [rbp - 0x74]
mov rdx, qword [rbp - 0x7c]
mov r8, qword [rbp - 0x84]
mov r9d, dword [rbp - 0x6c]
call sub.KERNEL32.dll_CreatePipe
mov esi, eax
lea rcx, [rbp - 0xb0]
call fcn.140004690
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor edx, edx
mov qword [rbp - 0x58], rdx
mov dword [rbp - 0x3c], 1
test esi, esi
setne sil
movzx esi, sil
mov rbx, qword [rbp - 0x50]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 8], rbx
mov rcx, qword [rbp + 0x18]
mov rdx, r14
call fcn.140004510
mov r15, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
mov qword [rbx + 8], r15
mov rcx, qword [rbp + 0x10]
mov rdx, rbx
call fcn.140004510
call fcn.14000301f
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140173bb0
Capabilities:
Enumerate process modules

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400014d7
mov rcx, rsi
call fcn.140173710
test eax, eax
jne 0x140173bd3
add rsp, 0x20
pop rsi
jmp fcn.140174f70
mov rcx, rsi
mov edx, 1
add rsp, 0x20
pop rsi
jmp 0x140174f00
push rdi
push rsi
sub rsp, 0x28
movzx edx, dl
call fcn.1401750d0
mov rsi, rax
mov edi, dword [rsi + 8]
mov edx, edi
lea rcx, [0x1402813c8]
call fcn.1400042f0
xor edx, edx
test edi, edi
jle 0x140174f63
cmp dword [rax + 8], edi
jl 0x140174f45
mov ecx, edx
mov r8, qword [rsi + rcx*8 + 0x10]
mov r8d, dword [r8 + 0x64]
mov dword [rax + rcx*4 + 0x10], r8d
inc edx
cmp edi, edx
jg 0x140174f2d
jmp 0x140174f63
mov r8d, edx
mov rcx, qword [rsi + r8*8 + 0x10]
mov r8d, dword [rcx + 0x64]
cmp edx, dword [rax + 8]
jae 0x140174f6a
mov ecx, edx
mov dword [rax + rcx*4 + 0x10], r8d
inc edx
cmp edi, edx
jg 0x140174f45
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140159920
int3
Function at 0x140180ab0
Capabilities:
Get token membership

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov rsi, r8
xor edx, edx
mov dword [rbp - 0x40], edx
mov dword [rbp - 0x48], edx
lea rdx, [rbp - 0x48]
cmp dword [rcx], ecx
call fcn.140132f10
mov rcx, qword [rbp + 0x10]
mov rbx, qword [rcx + 8]
mov qword [rbp + 0x20], rsi
cmp byte [rsi], 0
jne 0x140180b00
xor eax, eax
jmp 0x140180b05
mov eax, 1
mov dword [rbp - 0x40], eax
test rdi, rdi
jne 0x140180b12
xor r14d, r14d
jmp 0x140180b16
lea r14, [rdi + 0x10]
mov qword [rbp - 0x50], r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea r8, [rbp - 0x40]
mov qword [rbp - 0x58], r8
mov rcx, rbx
mov qword [rbp - 0x60], rcx
mov rdx, r14
mov qword [rbp - 0x68], rdx
lea rcx, [rbp - 0x90]
call fcn.140004640
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
call sub.ADVAPI32.dll_CheckTokenMembership
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140004690
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
test esi, esi
setne sil
movzx esi, sil
cmp dword [rbp - 0x40], 0
setne cl
mov rbx, qword [rbp + 0x20]
mov byte [rbx], cl
cmp byte [rbp - 0x48], 0
je 0x140180b97
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140132f80
call fcn.14000301f
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401b8d00
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1401b8d3e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x1401b8d23
xor r10d, r10d
jmp 0x1401b8d27
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x1401b8d0b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1401bc7d0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.14000116a
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1401bf270
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401bf2a4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401bf286
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1401bf2c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401bf2f4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401bf2d6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x140001370
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000147c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000147c
mov qword [rsp + 0x288], rsi
lea rsi, [0x1400034a0]
mov qword [rsp + 0x280], rbx
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
or rax, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140001451
add rax, 2
cmp rax, 0xf
je 0x140001422
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x140001400
jmp 0x140001451
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001451
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400013f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001740
add rsp, 0x270
pop rdi
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
and ah, 0xf3
mov eax, 0x73975f60
sub bl, byte [rsi - 0x47]
xlatb
ret 0xfdda
Function at 0x140017f16
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov rax, qword [0x1403b0098]
cmp rax, 3
jbe 0x140017f95
lea rsi, [rsp + 0x28]
lea rax, [rsp + 0x38]
mov qword [rax], rsi
lea rdx, str._b1__
lea rcx, [rsp + 0x50]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rdx, [fcn.1400c0130]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
lea r8, str.hoster::cleanupsrc_cleanup.rs
mov edx, 4
mov r9d, 0xc
call fcn.1400b6fa0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140009844
test al, al
je 0x140018019
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140180090
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
test rax, rax
je 0x140018011
lea rdx, [rsp + 0x50]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8b, 1
call fcn.14019e0f0
mov rsi, qword [rdi]
mov rbx, qword [rdi + 8]
test rsi, rsi
je 0x140018011
mov rcx, rsi
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x140018026
test rbx, rbx
je 0x140018019
mov edx, 2
mov rcx, rsi
call fcn.140030e40
jmp 0x140018019
mov rdi, rbx
test rbx, rbx
jne 0x140018047
xor eax, eax
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
je 0x140018047
mov edx, 2
mov rcx, rsi
call fcn.140030e40
mov rcx, rdi
call fcn.1400127f6
jmp 0x14001801b
Function at 0x140062130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, rdx
mov r15, rcx
mov r9, qword [rdx]
mov rsi, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
cmp r9, rsi
je 0x1400621b4
lea r14, [r9 + 0x10]
mov qword [rdi], r14
mov rcx, qword [rbx + 0x90]
mov rdx, qword [rbx + 0xa0]
mov r8, qword [r9]
mov r9, qword [r9 + 8]
call fcn.14005c80d
mov r9, r14
test rax, rax
je 0x140062154
cmp qword [rax + 0x1f8], 0
jne 0x1400621cc
cmp dword [rax + 0x218], 0x110000
jne 0x1400621cc
mov rdi, qword [rax + 0x178]
cmp rdi, 1
je 0x1400621ea
test rdi, rdi
jne 0x140062213
mov rdx, qword [rax + 0x68]
mov r8, qword [rax + 0x70]
jmp 0x1400621f8
and qword [r15], 0
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
mov rdx, rax
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14005d52b
mov rax, qword [rax + 0x168]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r15
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140059924
mov qword [rsp + 0x30], r15
mov r12, qword [rax + 0x168]
mov rcx, rdi
call fcn.140065f50
lea r14, [rsp + 0xa0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
mov rcx, r14
mov rdx, rdi
call fcn.14005b42e
mov rax, qword [r14 + 0x10]
imul r13, rax, 0x18
add r13, qword [r14]
add rax, rdi
mov qword [rsp + 0x28], rax
lea rbx, [0x140059a02]
lea rsi, [0x14029be38]
lea rbp, [rsp + 0x40]
lea r14, [rsp + 0x88]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 2
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], 1
mov rcx, r14
mov rdx, r15
call fcn.1400598dd
mov rax, qword [rsp + 0x98]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [r13], xmm0
add r13, 0x18
add r12, 0x10
dec rdi
jne 0x140062279
movups xmm0, xmmword [rsp + 0xa0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov r8, qword [rsp + 0x28]
mov qword [rdi + 0x10], r8
mov rdx, qword [rdi]
mov qword [rsp + 0x20], 1
lea r9, [0x140369957]
mov rcx, qword [rsp + 0x30]
call fcn.140061e36
mov rcx, rdi
call fcn.14005b3ba
jmp 0x1400621b8
Function at 0x1400852b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140085340
cmp r11, r10
ja 0x1400853b6
cmp r10, rdx
ja 0x1400853ca
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140085342
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140085320
jmp 0x1400853a4
ja 0x14008534a
mov r11, r10
cmp rax, r8
jne 0x1400852e4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140085380
mov rdi, r8
sub ecx, edx
jns 0x14008539b
jmp 0x1400853a6
cmp r8, rsi
je 0x1400853db
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400853a6
xor al, 1
cmp rdi, rsi
jne 0x140085360
jmp 0x1400853a6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400800f0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14007f360
ud2
lea rcx, [0x140368231]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14007f700
ud2

Function at 0x14008abb8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140285038]
test ecx, ecx
je 0x14008abd1
dec ecx
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue
lea rcx, [0x140285020]
call fcn.14017e120
mov ecx, eax
jmp 0x14008abc8

Function at 0x14008abe1
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14008ac02
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue
mov rcx, rax
call fcn.14017e120
mov ecx, eax
jmp 0x14008abf5

Function at 0x140096cb9
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x140096d23
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140096cd5
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140096cd5
add ebp, 0x80000000
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140098f36
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140098f5c
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140098f46
mov qword [rcx], rax
ret
Function at 0x140099044
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.140098f0b
test rbx, rbx
je 0x14009907d
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140098f36
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140098f2e
Function at 0x1400bd68a
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x1403b0090]
test r14, r14
jne 0x1400bd7b9
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400bd6f1
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400bd6f1
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400bd6f1
mov r15, rax
xor ebx, ebx
jmp 0x1400bd772
lea rcx, str.ntdll.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400bd7cd
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400bd7cd
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400bd7cd
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400bd7cd
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400bd7cd
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.1400ba13b
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1403b0090], r14
je 0x1400bd7b9
mov rdi, rax
cmp qword [r14], 0
je 0x1400bd7a9
mov rcx, qword [r14 + 0x10]
call fcn.1401d11a4
mov edx, 8
mov rcx, r14
call fcn.140030e40
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8__usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.9_src_thread_parker_windows_mod.rs
lea r8, [0x1402cf598]
mov edx, 0x5b
call fcn.1400bd7e7
ud2

Function at 0x1400bddae
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140285068]
test ecx, ecx
je 0x1400bddc7
dec ecx
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue
lea rcx, [0x140285050]
call fcn.14017e120
mov ecx, eax
jmp 0x1400bddbe
Function at 0x1400be038
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.1401a5a50
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call fcn.1401a5a50
mov rbx, qword [rbx + 8]
mov r14, qword [r14 + 8]
cmp rbx, r14
jne 0x1400be0e6
mov al, byte [rsp + 0x98]
cmp al, byte [rsp + 0xd8]
jne 0x1400be0e6
cmp byte [rsp + 0x99], 2
jne 0x1400be0e6
cmp byte [rsp + 0xd9], 2
jne 0x1400be0e6
cmp byte [rsp + 0x70], 3
setb al
cmp byte [rsp + 0xb0], 3
setb cl
xor cl, al
jne 0x1400be0e6
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0xa0]
mov rdx, rbx
mov r9, rbx
call fcn.14017cc12
mov ecx, eax
mov al, 1
test cl, cl
jne 0x1400be37e
mov al, byte [rsp + 0x70]
cmp al, 6
je 0x1400be112
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x3f], rcx
movups xmm0, xmmword [rsp + 0x71]
movups xmm1, xmmword [rsp + 0x81]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov r11, qword [rsp + 0x60]
mov cl, byte [rsp + 0x9a]
mov dl, byte [rsp + 0x98]
mov r8b, byte [rsp + 0x99]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
mov r9, qword [rsp + 0x3f]
mov qword [rsp + 0xff], r9
mov r10, qword [rsp + 0xa0]
mov r9b, byte [rsp + 0xb0]
cmp r9b, 6
je 0x1400be19a
mov rsi, qword [rsp + 0xd0]
mov qword [rsp + 0x19f], rsi
movups xmm0, xmmword [rsp + 0xb1]
movups xmm1, xmmword [rsp + 0xc1]
movaps xmmword [rsp + 0x190], xmm1
movaps xmmword [rsp + 0x180], xmm0
mov bpl, byte [rsp + 0xda]
movzx r15d, word [rsp + 0xd8]
lea rsi, [rsp + 0x180]
mov r12, qword [rsi + 0x1f]
lea rdi, [rsp + 0x20]
jl 0x1400be1df
and byte [rcx + rcx*4 + 0x67], cl
xor byte [rdi], cl
sub byte [rsi], al