joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d5c86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d5c86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d5c86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d5c86
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d5c86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d5c88
xor al, al
add rsp, 0x28
ret

Function at 0x140001070
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x128
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x110], rax
movups xmm1, xmmword [str.bin_win64_love.exe_.]
lea rdx, [r11 - 0x48]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x74], xmm0
xor r9d, r9d
xor r8d, r8d
movups xmmword [rsp + 0x84], xmm0
xor ecx, ecx
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
mov dword [r11 - 0x54], eax
movzx eax, word [0x140003298]
mov word [r11 - 0x20], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
movups xmmword [r11 - 0x74], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [r11 - 0x64], xmm0
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x28], eax
movups xmm0, xmmword [0x140003280]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
movups xmmword [r11 - 0x38], xmm0
movsd xmm0, qword [0x140003290]
movups xmmword [r11 - 0x48], xmm1
movsd qword [r11 - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000116f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_find_bin_win64_love.exe___d_._n
call fcn.140001010
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400011d0
add rsp, 0x128
ret
mov rcx, qword [rsp + 0x50]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400011d0
add rsp, 0x128
ret

Function at 0x140001ac4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b10
xor al, al
add rsp, 0x28
ret
Function at 0x180003130
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
xor esi, esi
mov r15, rdx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800031fd
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x1800031ef
mov qword [rsp + 0x60], rbx
lea ecx, [rdi + 1]
mov qword [rsp + 0x68], rbp
call fcn.1800357a8
mov dword [rsp + 0x70], esi
mov ebx, esi
mov rbp, rax
mov byte [rdi + rax], bl
test edi, edi
je 0x1800031da
nop word [rax + rax]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov qword [rsp + 0x20], rsi
add rdx, rbp
lea r9, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000320a
add ebx, dword [rsp + 0x70]
cmp ebx, edi
jb 0x1800031b0
test r15, r15
je 0x1800031e2
mov dword [r15], edi
mov rsi, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x78]
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
cmp ebx, edi
jae 0x1800031da
test rbp, rbp
je 0x1800031e5
mov rcx, rbp
call fcn.180035794
jmp 0x1800031e5

Function at 0x180003220
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x18006c048]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x105
call fcn.180030140
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x105
call fcn.180030140
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x105
call fcn.180030140
lea rdx, [rsp + 0x240]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, str.gtest_redir
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1800409c0
cmp eax, 0xffffffff
jne 0x180003306
lea r9, [rsp + 0x130]
xor r8d, r8d
lea rdx, str.gtest_redir
lea rcx, str.C:inetpub_tempIIS_Temporary_Compressed_Files_
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.180003350
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.180003130
lea rcx, [rsp + 0x130]
jmp 0x180003324
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180003350
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180003130
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, rbx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.18002e580
add rsp, 0x360
pop rbx
ret
Function at 0x18002335c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18000d5aa
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18000d58d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18000d578

Function at 0x18002d584
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18006e230]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x18002d5af
call qword [0x180054328]
jmp 0x18002d5c4
call fcn.18002d550
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180035a8c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180035963
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180035963
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180035963
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180035963
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180035963
cmp dword [rcx + 0x84], 0xe
jbe 0x180035963
cmp dword [rcx + 0xf8], 0
je 0x180035963
mov ecx, ebx
call fcn.180035a04
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800357f4
cmp dword [rbp + 0x20], 0
je 0x1800359b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800359b8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800358fc

Function at 0x142beaee8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142beaef2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142beaf1b
pop rbp
sub rbp, 0x33
sub rbp, 0x2beaee8
sub rsp, 0x20
jmp 0x142beaf3a
mov rax, 0x2beaee8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb44514a6
xor byte [rax], dl
inc rax
dec rcx
jne 0x142beaf59
jmp 0x142beaf70
out dx, al
invalid
Function at 0x140032df0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.140061c30
sub rsp, rax
mov rax, qword [0x1400e3028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1400e62e0]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140032ea4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140032ee2
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140063db0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400609bc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140063700
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140061c90
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140038030
test al, al
je 0x140032ee5
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140032ee8
mov eax, 0xffffffff
lock cmpxchg dword [0x1400e62e0], ecx
je 0x140032e28
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400e62e0]
mov dword [rsp + 0x2c], ecx
jmp 0x140032e28
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140038030
test al, al
je 0x140032f0d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140032f0d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140032ebb
int3

Function at 0x140038030
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140038045
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14004fb50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400e62e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004fb84
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x14004fb84
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14004fb7e
Function at 0x14000a0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x14000a0e6
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x14000a1ca
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 0
jmp 0x14000a1d9
cmp byte [rax + 0x3a], 0
jne 0x14000a209
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov r8, qword [rax + 0x28]
mov r14b, byte [rax + 0x38]
mov r11d, r14d
xor r11b, 1
test r8, r8
je 0x14000a122
cmp r9, r8
jbe 0x14000a11c
cmp byte [r10 + r8], 0xbf
jg 0x14000a122
jmp 0x14000a219
jne 0x14000a219
cmp r8, r9
je 0x14000a1e0
mov bl, byte [r10 + r8]
movzx esi, bl
test sil, sil
jns 0x14000a186
mov edi, esi
and edi, 0x1f
movzx ebp, byte [r10 + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x14000a178
movzx esi, byte [r10 + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x14000a181
movzx ebx, byte [r10 + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
jmp 0x14000a186
shl edi, 6
or edi, ebp
mov esi, edi
jmp 0x14000a186
shl edi, 0xc
or esi, edi
test r14b, r14b
jne 0x14000a1eb
cmp esi, 0x110000
je 0x14000a201
mov edi, 1
cmp esi, 0x80
jb 0x14000a1bc
mov edi, 2
cmp esi, 0x800
jb 0x14000a1bc
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov r14d, r11d
jmp 0x14000a102
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 1
call fcn.140007ff9
jmp 0x14000a20e
mov byte [rax + 0x38], r11b
test r14b, r14b
jne 0x14000a1f2
jmp 0x14000a205
mov byte [rax + 0x38], r11b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x14000a20b
mov byte [rax + 0x38], r11b
mov byte [rax + 0x3a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rax + 0x38], r11b
lea rax, str._rustc_d5a82bbd26e1ad8b7401f6a718a9c57c96905483librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.1403afdc0
ud2
Function at 0x1400157ee
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
mov qword [rcx + 8], rdx
xor eax, eax
lea rdx, [rsp + 0x40]
mov dword [rdx], eax
mov qword [rdx + 8], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.crypt32.dll_CryptUnprotectData]
test eax, eax
je 0x14001584d
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov qword [rsi], 0
jmp 0x14001587a
call sub.KERNEL32.DLL_GetLastError
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401cfbf4
mov qword [rsi + 8], rax
lea rax, fcn.14007ddf7
mov qword [rsi + 0x10], rax
mov qword [rsi], 1
add rsp, 0x60
pop rsi
ret
Function at 0x140015880
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov r14, rcx
lea rdx, [0x1404baba8]
lea rsi, [rsp + 0x28]
mov r8d, 7
mov rcx, rsi
call fcn.1402434a0
cmp byte [rsi + 0x18], 3
jne 0x140015a89
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x70], xmm0
lea rax, [0x1403b5bde]
lea rdx, [rsp + 0xc0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0xda2aa37f787c8a34
mov qword [rdx], rax
mov rdx, qword [rdx]
call fcn.140204789
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1403be6c0]
mov rbx, qword [rcx + rdx + 8]
xor rbx, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0xa8], rbx
add rcx, 8
cmp rcx, 0x10
jb 0x14001591d
mov al, byte [rax + 0x18]
xor al, 0xea
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x18], al
lea rax, [rsp + 0x108]
mov qword [rax], rcx
mov qword [rax + 8], 0x19
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
lea rcx, [0x1400099b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x140134850]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov qword [rdx], 0
lea rax, str.dest_is_out_of_bounds
mov qword [rdx + 0x10], rax
mov eax, 2
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rsi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x88]
call fcn.140053dd0
cmp qword [rdi], 0
je 0x1400159d5
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r15
mov r8, rbx
xor r9d, r9d
call fcn.140248470
cmp dword [rsi], 2
jne 0x140015a23
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 2
jmp 0x140015a41
lea rax, [rsp + 0x28]
lea rsi, [rsp + 0xc0]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
cmp qword [rax], 2
jne 0x140015a52
lea rcx, [rsp + 0x30]
call fcn.14007ddf7
mov byte [r14 + 0x18], 2
jmp 0x140015a60
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.14025fcc0
test r12, r12
je 0x140015a77
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.DLL_HeapFree]
nop
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
lea r8, [rsp + 0xc0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, str.src_firefox_firefox.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1404ef56b]
lea r9, fcn.140006040
mov edx, 0x2b
call fcn.1403afcb0
ud2
Function at 0x140060c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140060d10
cmp r10, rax
jb 0x140060d84
cmp r10, rdx
ja 0x140060d98
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140060d12
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140060cf0
jmp 0x140060d73
ja 0x140060d1a
mov rax, r10
cmp r11, r8
jne 0x140060cc2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140060d50
mov r15, rbx
sub ecx, edx
jns 0x140060d6a
jmp 0x140060d75
cmp rbx, r14
je 0x140060da9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140060d75
xor al, 1
cmp r15, r14
jne 0x140060d30
jmp 0x140060d75
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.1403afbd0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1403af940
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.Pi__
mov edx, 0x2b
call fcn.1403af950
ud2
Function at 0x140066abb
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
not ecx
cmp r8, 0x40
jb 0x140066bf6
add rdx, 0x10
xor r10d, r10d
lea r11, [0x1403ca6c8]
mov r9d, 0xff
cmp r8, 0xf
jbe 0x140066c28
movzx esi, byte [rdx - 1]
movzx eax, byte [rdx - 2]
mov eax, dword [r11 + rax*4 + 0x400]
xor eax, dword [r11 + rsi*4]
movzx esi, byte [rdx - 3]
xor eax, dword [r11 + rsi*4 + 0x800]
movzx esi, byte [rdx - 4]
xor eax, dword [r11 + rsi*4 + 0xc00]
movzx esi, byte [rdx - 5]
xor eax, dword [r11 + rsi*4 + 0x1000]
movzx esi, byte [rdx - 6]
xor eax, dword [r11 + rsi*4 + 0x1400]
movzx esi, byte [rdx - 7]
xor eax, dword [r11 + rsi*4 + 0x1800]
movzx esi, byte [rdx - 8]
xor eax, dword [r11 + rsi*4 + 0x1c00]
movzx esi, byte [rdx - 9]
xor eax, dword [r11 + rsi*4 + 0x2000]
movzx esi, byte [rdx - 0xa]
xor eax, dword [r11 + rsi*4 + 0x2400]
movzx esi, byte [rdx - 0xb]
xor eax, dword [r11 + rsi*4 + 0x2800]
movzx esi, byte [rdx - 0xc]
xor eax, dword [r11 + rsi*4 + 0x2c00]
movzx esi, byte [rdx - 0xd]
mov edi, ecx
shr edi, 0x18
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3000]
inc r10
movzx esi, byte [rdx - 0xe]
mov edi, ecx
shr edi, 0x10
and edi, r9d
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3400]
movzx esi, byte [rdx - 0xf]
mov edi, ecx
shr edi, 8
and edi, r9d
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3800]
movzx esi, byte [rdx - 0x10]
and ecx, r9d
mov rdi, rcx
xor rdi, rsi
mov ecx, eax
xor ecx, dword [r11 + rdi*4 + 0x3c00]
lea rax, [r8 - 0x10]
cmp r10, 4
jne 0x140066be6
cmp rax, 0x3f
jbe 0x140066bf2
xor r10d, r10d
add rdx, 0x10
mov r8, rax
jmp 0x140066ae1
add r8, 0xfffffffffffffff0
test r8, r8
je 0x140066c1d
xor r10d, r10d
lea r9, [0x1403ca6c8]
mov al, byte [rdx + r10]
xor al, cl
movzx eax, al
shr ecx, 8
xor ecx, dword [r9 + rax*4]
inc r10
cmp r8, r10
jne 0x140066c05
not ecx
mov eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rax, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.3.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r8
mov r8, rax
call fcn.1403af8b0
ud2
Function at 0x140066c41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x140066e44
movdqu xmm4, xmmword [rdx]
movdqu xmm5, xmmword [rdx + 0x10]
movdqu xmm1, xmmword [rdx + 0x20]
movdqu xmm0, xmmword [rdx + 0x30]
not ecx
movd xmm3, ecx
pxor xmm3, xmm4
add r8, 0xffffffffffffffc0
add rdx, 0x40
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm8, xmmword [0x1403bcb60]
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm8, 0x11
movdqu xmm3, xmmword [rdx]
pxor xmm3, xmm6
pxor xmm3, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm9, xmmword [rdx + 0x30]
movdqa xmm2, xmm5
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm6
pclmulqdq xmm5, xmm8, 0x11
pxor xmm5, xmm2
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm7
pclmulqdq xmm1, xmm8, 0x11
pxor xmm1, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm9
pclmulqdq xmm0, xmm8, 0x11
pxor xmm0, xmm2
add r8, 0xffffffffffffffc0
add rdx, 0x40
cmp r8, 0x3f
ja 0x140066ca8
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmmword [0x1403bcb70]
pclmulqdq xmm3, xmm7, 0x11
pxor xmm6, xmm5
pxor xmm6, xmm3
movdqa xmm2, xmm6
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm6, xmm7, 0x11
pxor xmm2, xmm1
pxor xmm2, xmm6
movdqa xmm1, xmm2
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm2, xmm7, 0x11
pxor xmm1, xmm0
pxor xmm1, xmm2
cmp r8, 0x10
jb 0x140066dc6
movdqu xmm0, xmmword [rdx]
add rdx, 0x10
add r8, 0xfffffffffffffff0
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm0
pclmulqdq xmm1, xmm7, 0x11
pxor xmm1, xmm2
cmp r8, 0xf
ja 0x140066d9c
movdqa xmm0, xmmword [0x1403bcb70]
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
pxor xmm0, xmm0
pxor xmm2, xmm2
movss xmm2, xmm1
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm1, 4
pxor xmm1, xmm3
xorps xmm2, xmm2
movss xmm2, xmm1
pclmulqdq xmm2, xmmword [0x1403bcb80], 0x10
pblendw xmm2, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm2, 0
pxor xmm0, xmm1
pextrd ecx, xmm0, 1
not ecx
test r8, r8
je 0x140066e62
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140066abb
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140084ba4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
xor eax, eax
cmp qword [rcx + 0x18], 0
mov rsi, rdx
setne al
lea rdx, [rsp + 0x20]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.140078e87
cmp qword [rdi + 0x18], 0
je 0x140084bec
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140078e87
movzx eax, byte [rdi]
lea rdx, [rsp + 0x20]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.140078e87
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140084c0d
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rax
movabs r8, 0x100000001b3
mov r9, qword [rcx + 0x18]
xor eax, eax
test r9, r9
setne al
mov qword [rsp], rax
mov rax, qword [rdx]
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor rax, r11
imul rax, r8
cmp r10, 8
jne 0x140084c2e
test r9, r9
je 0x140084c70
mov r9, qword [rcx + 8]
test r9, r9
je 0x140084c93
mov r10, qword [rcx]
xor r11d, r11d
movzx ecx, byte [r10 + r11]
xor rcx, rax
imul rcx, r8
inc r11
mov rax, rcx
cmp r9, r11
jne 0x140084c57
jmp 0x140084c96
movzx ecx, byte [rcx]
mov qword [rsp], rcx
xor ecx, ecx
movzx r9d, byte [rsp + rcx]
inc rcx
xor rax, r9
imul rax, r8
cmp rcx, 8
jne 0x140084c79
mov qword [rdx], rax
jmp 0x140084c99
mov rcx, rax
mov qword [rdx], rcx
pop rax
ret