joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a17f0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400a1810
test al, 1
je 0x1400a195f
test al, 2
jne 0x1400a1977
test al, 8
jne 0x1400a185f
mov rdi, qword [rsi + 0x28]
call fcn.140104150
test rax, rax
je 0x1400a1879
mov rbx, qword [rax + 0x30]
mov qword [rax + 0x30], rdi
mov eax, dword [rsi + 0x30]
cmp eax, 1
je 0x1400a1883
test eax, eax
jne 0x1400a18c7
lea rcx, [rsi + 0x38]
call fcn.1400a01b0
jmp 0x1400a18c7
test al, 0x10
je 0x1400a18dc
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400a19fe
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
jmp 0x1400a18dc
xor ebx, ebx
mov eax, dword [rsi + 0x30]
cmp eax, 1
jne 0x1400a1850
cmp qword [rsi + 0x38], 0
je 0x1400a18c7
mov rdi, qword [rsi + 0x40]
test rdi, rdi
je 0x1400a18c7
mov r14, qword [rsi + 0x48]
mov rax, qword [r14]
test rax, rax
je 0x1400a18a4
mov rcx, rdi
call rax
cmp qword [r14 + 8], 0
je 0x1400a18c7
cmp qword [r14 + 0x10], 0x11
jb 0x1400a18b6
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401b2100]
xor edx, edx
mov r8, rdi
call fcn.14011d4ec
mov dword [rsi + 0x30], 2
call fcn.140104150
test rax, rax
je 0x1400a18dc
mov qword [rax + 0x30], rbx
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x1400a1913
mov r8, qword [rsi + 0x88]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140109f00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400a198f
jne 0x1400a1951
mov rcx, rsi
call fcn.1400a15d0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x14017d980]
lea rcx, [rsp + 0x30]
call fcn.14001a380
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.src_index.crates.io_6f17d22bba15001f_tokio_1.41.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x30]
call fcn.14001a380
int3
Function at 0x1400a6c30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400a6c40
test al, 1
je 0x1400a6da0
test al, 2
jne 0x1400a6db8
test al, 8
jne 0x1400a6c7a
mov rbx, qword [rsi + 0x28]
call fcn.140104150
test rax, rax
je 0x1400a6c9a
mov rdi, qword [rax + 0x30]
mov qword [rax + 0x30], rbx
jmp 0x1400a6c9c
test al, 0x10
je 0x1400a6cba
mov rax, qword [rsi + 0xf0]
test rax, rax
je 0x1400a6e3c
mov rcx, qword [rsi + 0xf8]
call qword [rax + 0x10]
jmp 0x1400a6cba
xor edi, edi
lea rcx, [rsi + 0x30]
call fcn.1400a6b60
mov dword [rsi + 0x30], 2
call fcn.140104150
test rax, rax
je 0x1400a6cba
mov qword [rax + 0x30], rdi
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x1400a6cf1
mov r8, qword [rsi + 0x108]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.14010bbf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400a6dd0
jne 0x1400a6d94
mov rax, qword [rsi + 0x20]
lock dec qword [rax]
jne 0x1400a6d3e
mov rcx, qword [rsi + 0x20]
call fcn.14007d380
lea rcx, [rsi + 0x30]
call fcn.1400a6b60
mov rax, qword [rsi + 0xf0]
test rax, rax
je 0x1400a6d5d
mov rcx, qword [rsi + 0xf8]
call qword [rax + 0x18]
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x1400a6d82
lock dec qword [rax]
jne 0x1400a6d82
mov rcx, qword [rsi + 0x100]
mov rdx, qword [rsi + 0x108]
call fcn.140102f90
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401b2100]
xor edx, edx
call fcn.14011d4ec
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov dword [rsp + 0x30], 2
Function at 0x1400a7620
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400a7630
test al, 1
je 0x1400a7790
test al, 2
jne 0x1400a77a8
test al, 8
jne 0x1400a766a
mov rbx, qword [rsi + 0x28]
call fcn.140104150
test rax, rax
je 0x1400a768a
mov rdi, qword [rax + 0x30]
mov qword [rax + 0x30], rbx
jmp 0x1400a768c
test al, 0x10
je 0x1400a76aa
mov rax, qword [rsi + 0xf0]
test rax, rax
je 0x1400a782c
mov rcx, qword [rsi + 0xf8]
call qword [rax + 0x10]
jmp 0x1400a76aa
xor edi, edi
lea rcx, [rsi + 0x30]
call fcn.1400a6b60
mov dword [rsi + 0x30], 2
call fcn.140104150
test rax, rax
je 0x1400a76aa
mov qword [rax + 0x30], rdi
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x1400a76e1
mov r8, qword [rsi + 0x108]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140109f00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400a77c0
jne 0x1400a7784
mov rax, qword [rsi + 0x20]
lock dec qword [rax]
jne 0x1400a772e
mov rcx, qword [rsi + 0x20]
call fcn.140049020
lea rcx, [rsi + 0x30]
call fcn.1400a6b60
mov rax, qword [rsi + 0xf0]
test rax, rax
je 0x1400a774d
mov rcx, qword [rsi + 0xf8]
call qword [rax + 0x18]
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x1400a7772
lock dec qword [rax]
jne 0x1400a7772
mov rcx, qword [rsi + 0x100]
mov rdx, qword [rsi + 0x108]
call fcn.140102f90
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401b2100]
xor edx, edx
call fcn.14011d4ec
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x14017d980]
lea rcx, [rsp + 0x28]
call fcn.14001a380
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.src_index.crates.io_6f17d22bba15001f_tokio_1.41.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.14001a380
int3
Function at 0x1400ab4b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400ab4c0
test al, 1
je 0x1400ab597
test al, 2
jne 0x1400ab5af
test al, 8
jne 0x1400ab4fa
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
call fcn.1400abc50
jmp 0x1400ab518
test al, 0x10
je 0x1400ab518
mov rax, qword [rsi + 0x240]
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
lea eax, [0x14017d8f8]

Function at 0x1400abd40
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400abd50
test al, 1
je 0x1400abe27
test al, 2
jne 0x1400abe3f
test al, 8
jne 0x1400abd8a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
call fcn.1400abc50
jmp 0x1400abda8
test al, 0x10
je 0x1400abda8
mov rax, qword [rsi + 0x240]
test rax, rax
je 0x1400abec3
mov rcx, qword [rsi + 0x248]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x250]
test rax, rax
je 0x1400abddf
mov r8, qword [rsi + 0x258]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140109f00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400abe57
jne 0x1400abe1d
mov rcx, rsi
call fcn.1400abb70
nop
add rsp, 0x250
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x38], rax
and al, 0x38
Function at 0x1400bdf10
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400bdf30
test al, 1
je 0x1400be085
test al, 2
jne 0x1400be09d
test al, 8
jne 0x1400bdf7f
mov rdi, qword [rsi + 0x28]
call fcn.140104150
test rax, rax
je 0x1400bdf9f
mov rbx, qword [rax + 0x30]
mov qword [rax + 0x30], rdi
mov eax, dword [rsi + 0x30]
cmp eax, 1
je 0x1400bdfa9
test eax, eax
jne 0x1400bdfed
lea rcx, [rsi + 0x38]
call fcn.140090a70
jmp 0x1400bdfed
test al, 0x10
je 0x1400be002
mov rax, qword [rsi + 0x1010]
test rax, rax
je 0x1400be124
mov rcx, qword [rsi + 0x1018]
call qword [rax + 0x10]
jmp 0x1400be002
xor ebx, ebx
mov eax, dword [rsi + 0x30]
cmp eax, 1
jne 0x1400bdf70
cmp qword [rsi + 0x38], 0
je 0x1400bdfed
mov rdi, qword [rsi + 0x40]
test rdi, rdi
je 0x1400bdfed
mov r14, qword [rsi + 0x48]
mov rax, qword [r14]
test rax, rax
je 0x1400bdfca
mov rcx, rdi
call rax
cmp qword [r14 + 8], 0
je 0x1400bdfed
cmp qword [r14 + 0x10], 0x11
jb 0x1400bdfdc
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401b2100]
xor edx, edx
mov r8, rdi
call fcn.14011d4ec
mov dword [rsi + 0x30], 2
call fcn.140104150
test rax, rax
je 0x1400be002
mov qword [rax + 0x30], rbx
mov rax, qword [rsi + 0x1020]
test rax, rax
je 0x1400be039
mov r8, qword [rsi + 0x1028]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.14010bbf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400be0b5
jne 0x1400be077
mov rcx, rsi
call fcn.1400bde40
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x14017d980]
lea rcx, [rsp + 0x30]
call fcn.14001a380
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.src_index.crates.io_6f17d22bba15001f_tokio_1.41.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x30]
call fcn.14001a380
int3
Function at 0x1400bea90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400beab0
test al, 1
je 0x1400bec05
test al, 2
jne 0x1400bec1d
test al, 8
jne 0x1400beaff
mov rdi, qword [rsi + 0x28]
call fcn.140104150
test rax, rax
je 0x1400beb1f
mov rbx, qword [rax + 0x30]
mov qword [rax + 0x30], rdi
mov eax, dword [rsi + 0x30]
cmp eax, 1
je 0x1400beb29
test eax, eax
jne 0x1400beb6d
lea rcx, [rsi + 0x38]
call fcn.140090a70
jmp 0x1400beb6d
test al, 0x10
je 0x1400beb82
mov rax, qword [rsi + 0x1010]
test rax, rax
je 0x1400beca4
mov rcx, qword [rsi + 0x1018]
call qword [rax + 0x10]
jmp 0x1400beb82
xor ebx, ebx
mov eax, dword [rsi + 0x30]
cmp eax, 1
jne 0x1400beaf0
cmp qword [rsi + 0x38], 0
je 0x1400beb6d
mov rdi, qword [rsi + 0x40]
test rdi, rdi
je 0x1400beb6d
mov r14, qword [rsi + 0x48]
mov rax, qword [r14]
test rax, rax
je 0x1400beb4a
mov rcx, rdi
call rax
cmp qword [r14 + 8], 0
je 0x1400beb6d
cmp qword [r14 + 0x10], 0x11
jb 0x1400beb5c
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401b2100]
xor edx, edx
mov r8, rdi
call fcn.14011d4ec
mov dword [rsi + 0x30], 2
call fcn.140104150
test rax, rax
je 0x1400beb82
mov qword [rax + 0x30], rbx
mov rax, qword [rsi + 0x1020]
test rax, rax
je 0x1400bebb9
mov r8, qword [rsi + 0x1028]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140109f00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400bec35
jne 0x1400bebf7
mov rcx, rsi
call fcn.1400be870
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14017d8f8]
mov edx, 0x23
call fcn.14001b280
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14017d938]
mov edx, 0x25
call fcn.14001b280
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.14001a490]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:_P
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x14017d980]
lea rcx, [rsp + 0x30]
call fcn.14001a380
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.src_index.crates.io_6f17d22bba15001f_tokio_1.41.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x30]
call fcn.14001a380
int3
Function at 0x1400c4e20
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x1400c4e5d
movabs rdi, 0x8000000000000000
jmp 0x1400c4ea5
mov r14, qword [rsp + 0x28]
mov r15, qword [r14 + 8]
mov edi, dword [r14 + 0x10]
test rdi, rdi
je 0x1400c4e8a
movzx eax, byte [0x1401b2168]
xor ecx, ecx
mov rdx, rdi
call fcn.1400ff580
test rax, rax
je 0x1400c4ebc
mov rbx, rax
jmp 0x1400c4e8f
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, r14
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.140017699
int3
Function at 0x1400c87a0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x1400c87dd
movabs rdi, 0x8000000000000000
jmp 0x1400c8825
mov r14, qword [rsp + 0x28]
mov r15, qword [r14 + 8]
mov edi, dword [r14 + 0x10]
test rdi, rdi
je 0x1400c880a
movzx eax, byte [0x1401b2168]
xor ecx, ecx
mov rdx, rdi
call fcn.1400ff580
test rax, rax
je 0x1400c883c
mov rbx, rax
jmp 0x1400c880f
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, r14
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.140017699
int3
Function at 0x1400d3f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400d3f95
cmp rax, rcx
je 0x1400d3f9b
cmp rdx, 4
jae 0x1400d3f9f
xor eax, eax
xor r8d, r8d
jmp 0x1400d4030
pop rbp
jmp fcn.14001a840
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140124d10]
movdqa xmm3, xmmword [0x140124d20]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400d3fc0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400d4047
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400d4030
pop rbp
ret
Function at 0x1400d8900
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400d8995
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x1400d89d4
cmp dword [rbp], 0
je 0x1400d89b8
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400d89f7
mov edi, eax
mov rax, qword [0x1401b5038]
mov rax, qword [0x1401b2108]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401b2108], rsi
jne 0x1400d8970
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1400d89c9
call sub.kernel32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x1400d8a39
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400d89bd
mov edi, dword [rbp + 4]
jmp 0x1400d89c9
mov edi, dword [rsi + 0x18]
jmp 0x1400d89c7
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rdx, [0x14017a388]
lea r9, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 4]
lea r8, [rbp - 0x38]
call fcn.1400d9fd7
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call fcn.14001a380
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.1400da013
int3
Function at 0x1400d9ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140120090]
test esi, esi
je 0x1400d9f2e
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400d9f25
je 0x1400d9f23
movzx eax, byte [0x1401b2168]
mov edx, 0x18
xor ecx, ecx
call fcn.1400ff580
test rax, rax
je 0x1400d9f4f
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400d9f1e
mov rcx, qword [0x1401b2100]
xor edx, edx
mov r8, rdi
call fcn.14011d4ec
mov rax, rsi
jmp 0x1400d9f25
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140120078]
call fcn.1400d8900
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400d9ec6
jmp 0x1400d9f25
mov ecx, 8
mov edx, 0x18
call fcn.140017699
int3

Function at 0x1400dac40
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x1401b20e0]
nop word cs:[rax + rax]
cmp rax, 0xffffffffffffffff
je 0x1400daca3
lea rsi, [rax + 1]
lock cmpxchg qword [0x1401b20e0], rsi
jne 0x1400dac60
mov ecx, dword [0x1401b2128]
test ecx, ecx
je 0x1400dac93
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1401b2110]
call fcn.1400d8900
mov ecx, eax
jmp 0x1400dac81
call fcn.1400db720
int3
Function at 0x1400dacb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rcx
lea rsi, [rbp - 8]
mov qword [rbp - 8], rdx
mov ecx, dword [0x1401b2148]
test ecx, ecx
je 0x1400daceb
dec ecx
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x1400dad03
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
jmp 0x1400dadac
lea rcx, [0x1401b2130]
call fcn.1400d8900
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x1400dacde
mov ecx, dword [0x1401b2128]
test ecx, ecx
je 0x1400dad33
dec ecx
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x1400dad4b
mov r8, rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov rdx, rax
shl rdx, 4
cmp qword [rcx + rdx], r8
je 0x1400dad8c
jmp 0x1400dadac
lea rcx, [0x1401b2110]
call fcn.1400d8900
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x1400dad19
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
shl rax, 4
mov rdi, qword [rcx + rax]
mov ecx, dword [0x1401b2128]
test ecx, ecx
je 0x1400dad69
dec ecx
jmp 0x1400dad77
lea rcx, [0x1401b2110]
call fcn.1400d8900
mov ecx, eax
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
mov edx, dword [rbp - 0x10]
mov rcx, qword [rbp - 8]
and edx, 1
shl edx, 4
add rdx, rcx
mov rax, qword [0x1401b5038]
mov ecx, dword [0x1401b2148]
test ecx, ecx
je 0x1400dadb7
dec ecx
call sub.kernel32.dll_TlsSetValue
mov eax, 2
mov rdx, rcx
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401b2130]
mov rsi, rdx
call fcn.1400d8900
mov rdx, rsi
mov ecx, eax
jmp 0x1400dada2