joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400087d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp qword [rdx], 0
je 0x140008816
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x14000890b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x14000891a
mov r11b, byte [rdx + 0x1a]
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov bl, byte [rdx + 0x18]
xor r10d, r10d
test r11b, r11b
jne 0x14000893f
mov esi, ebx
xor sil, 1
mov byte [rdx + 0x18], sil
mov rsi, r9
test r8, r8
je 0x140008861
mov rsi, r9
sub rsi, r8
jbe 0x14000885b
cmp byte [rax + r8], 0xbf
jg 0x140008861
jmp 0x14000894d
jne 0x14000894d
test rsi, rsi
je 0x140008924
movzx esi, byte [rax + r8]
test sil, sil
jns 0x1400088c8
mov edi, esi
and edi, 0x1f
movzx r14d, byte [rax + r8 + 1]
and r14d, 0x3f
cmp sil, 0xdf
jbe 0x1400088b7
movzx ebp, byte [rax + r8 + 2]
shl r14d, 6
and ebp, 0x3f
or ebp, r14d
cmp sil, 0xf0
jb 0x1400088c1
movzx esi, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl ebp, 6
and esi, 0x3f
or esi, ebp
or esi, edi
jmp 0x1400088c8
shl edi, 6
or edi, r14d
mov esi, edi
jmp 0x1400088c8
shl edi, 0xc
or ebp, edi
mov esi, ebp
test bl, bl
jne 0x140008928
cmp esi, 0x110000
je 0x140008938
mov edi, 1
cmp esi, 0x80
jb 0x1400088fd
mov edi, 2
cmp esi, 0x800
jb 0x1400088fd
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx + 8], r8
mov bl, 1
jmp 0x14000882c
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.140006ba9
jmp 0x140008942
test bl, bl
je 0x140008938
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov r10d, 1
jmp 0x14000893f
mov byte [rdx + 0x1a], 1
xor r10d, r10d
mov qword [rcx], r10
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.14005a340
ud2

Function at 0x1400102ca
Capabilities:
Get token membership

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rcx, [rsp + 0x68]
mov word [rcx + 4], 0x500
and dword [rcx], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x58]
and dword [rsp + 0x28], 0
mov qword [rsp + 0x50], rax
and dword [rsp + 0x20], 0
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x140010351
mov rsi, qword [rsp + 0x58]
lea rdi, [rsp + 0x64]
and dword [rdi], 0
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call sub.advapi32.dll_CheckTokenMembership
mov ebx, eax
mov rcx, rsi
call sub.advapi32.dll_FreeSid
test ebx, ebx
setne cl
cmp dword [rdi], 0
setne al
and al, cl
jmp 0x140010353
xor eax, eax
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005ab90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14005ac20
cmp r11, r10
ja 0x14005ac96
cmp r10, rdx
ja 0x14005acaa
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14005ac22
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14005ac00
jmp 0x14005ac84
ja 0x14005ac2a
mov r11, r10
cmp rax, r8
jne 0x14005abc4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14005ac60
mov rdi, r8
sub ecx, edx
jns 0x14005ac7b
jmp 0x14005ac86
cmp r8, rsi
je 0x14005acbb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14005ac86
xor al, 1
cmp rdi, rsi
jne 0x14005ac40
jmp 0x14005ac86
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140055d90
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140051130
ud2
lea rcx, [0x1404ee977]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400519b0
ud2
Function at 0x140060d55
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
not ecx
lea rax, [0x1403c0ba8]
mov r9d, 0xff
cmp r8, 0x40
jb 0x140060e6b
mov r10, r8
shr r10, 4
xor r11d, r11d
cmp r11, 4
je 0x140060d6b
cmp r10, r11
je 0x140060e96
movzx edi, byte [rdx + 0xf]
movzx esi, byte [rdx + 0xe]
mov esi, dword [rax + rsi*4 + 0x400]
xor esi, dword [rax + rdi*4]
movzx edi, byte [rdx + 0xd]
xor esi, dword [rax + rdi*4 + 0x800]
movzx edi, byte [rdx + 0xc]
xor esi, dword [rax + rdi*4 + 0xc00]
movzx edi, byte [rdx + 0xb]
xor esi, dword [rax + rdi*4 + 0x1000]
movzx edi, byte [rdx + 0xa]
xor esi, dword [rax + rdi*4 + 0x1400]
movzx edi, byte [rdx + 9]
xor esi, dword [rax + rdi*4 + 0x1800]
movzx edi, byte [rdx + 8]
xor esi, dword [rax + rdi*4 + 0x1c00]
movzx edi, byte [rdx + 7]
xor esi, dword [rax + rdi*4 + 0x2000]
movzx edi, byte [rdx + 6]
xor esi, dword [rax + rdi*4 + 0x2400]
movzx edi, byte [rdx + 5]
xor esi, dword [rax + rdi*4 + 0x2800]
movzx edi, byte [rdx + 4]
xor esi, dword [rax + rdi*4 + 0x2c00]
mov edi, ecx
shr edi, 0x18
movzx ebx, byte [rdx + 3]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3000]
mov edi, ecx
shr edi, 0x10
and edi, r9d
movzx ebx, byte [rdx + 2]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3400]
mov edi, ecx
shr edi, 8
and edi, r9d
movzx ebx, byte [rdx + 1]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3800]
and ecx, r9d
movzx edi, byte [rdx]
xor edi, ecx
xor esi, dword [rax + rdi*4 + 0x3c00]
inc r11
add r8, 0xfffffffffffffff0
add rdx, 0x10
mov ecx, esi
jmp 0x140060d7f
xor r9d, r9d
cmp r8, r9
je 0x140060e8a
mov r10b, byte [rdx + r9]
xor r10b, cl
movzx r10d, r10b
shr ecx, 8
xor ecx, dword [rax + r10*4]
inc r9
jmp 0x140060e6e
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rax, str.__v__
mov ecx, 0xf
mov rdx, r8
mov r8, rax
call fcn.1400500f0
ud2

Function at 0x140060f19
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403a0068]
test ecx, ecx
je 0x140060f32
dec ecx
add rsp, 0x28
jmp fcn.14029819c
lea rcx, [0x1403a0050]
call fcn.1402332b0
mov ecx, eax
jmp 0x140060f29

Function at 0x14006121f
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140061240
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1402981a4
mov rcx, rax
call fcn.1402332b0
mov ecx, eax
jmp 0x140061233
Function at 0x1400612fd
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.140060f19
cmp rax, 1
jbe 0x140061322
mov rdi, rax
mov rax, qword [rax + 8]
add rdi, 0x10
test rax, rax
cmove rdi, rax
jne 0x140061390
call fcn.140060f19
cmp rax, 1
je 0x14006138e
mov rsi, rax
test rax, rax
jne 0x140061365
mov ecx, 0x18
call fcn.140060f42
mov rsi, rax
lea rax, [0x1403a0050]
mov qword [rsi], rax
and qword [rsi + 8], 0
mov ecx, dword [0x1403a0068]
test ecx, ecx
je 0x14006139a
dec ecx
mov rdx, rsi
call fcn.1402981a4
call fcn.140061176
call fcn.14006142b
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
call fcn.1400611ef
jmp 0x140061390
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1403a0050]
call fcn.1402332b0
mov ecx, eax
jmp 0x14006135d

Function at 0x14006ae7b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403a0088]
test ecx, ecx
je 0x14006ae94
dec ecx
lea rcx, [0x1403a0070]
call fcn.1402332b0
mov ecx, eax
jmp 0x14006ae8b

Function at 0x14006cd82
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
call fcn.14006ae7b
cmp rax, 1
jbe 0x14006cdaf
mov rbx, rax
mov rax, qword [rax + 8]
add rbx, 0x10
test rax, rax
cmove rbx, rax
jne 0x14006ce8e
call fcn.14006ae7b
cmp rax, 1
je 0x14006ce42
mov rdi, rax
test rax, rax
jne 0x14006ce0b
mov ecx, 8
mov edx, 0x28
xor r8d, r8d
call fcn.14026db03
test rax, rax
je 0x14006ceac
mov rdi, rax
lea rax, [0x1403a0070]
mov qword [rdi], rax
and qword [rdi + 8], 0
mov ecx, dword [0x1403a0088]
test ecx, ecx
je 0x14006ce99
dec ecx
xor ebx, ebx
jmp 0x14006ce8e
lea rcx, [0x1403a0070]
call fcn.1402332b0
mov ecx, 8
mov edx, 0x28
call fcn.14004a180
ud2

Function at 0x14007a211
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14007a237
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14007a221
mov qword [rcx], rax
ret
Function at 0x14013bd7d
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, rcx
mov rsi, qword [rcx]
mov r8, qword [rcx + 0x10]
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.140235270
mov rax, qword [rbx]
mov rbx, qword [rbx + 8]
test rax, rax
je 0x14013be25
lea rdx, [rsp + 0x20]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov r8b, 1
call fcn.140251260
mov r14, qword [rbx]
mov rbx, qword [rbx + 8]
test r14, r14
je 0x14013be25
mov rcx, r14
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x14013be00
test rbx, rbx
je 0x14013bdfc
mov edx, 2
mov rcx, r14
call fcn.140026d90
xor ebx, ebx
jmp 0x14013be25
call sub.kernel32.dll_GetLastError
mov r15d, eax
shl r15, 0x20
or r15, 2
test rbx, rbx
je 0x14013be22
mov edx, 2
mov rcx, r14
call fcn.140026d90
mov rbx, r15
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.14015e77d
mov rax, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14013be75
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
mov cl, 1
jmp fcn.140256ab0

Function at 0x140143b89
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140144a9c
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rcx + 8], rdx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
test eax, eax
je 0x140144af7
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov al, 0x1a
jmp 0x140144b01
call sub.kernel32.dll_GetLastError
mov dword [rsi + 4], eax
mov al, 0x14
mov byte [rsi], al
add rsp, 0x60
pop rsi
ret

Function at 0x1401677fd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403a00e0]
test ecx, ecx
je 0x140167816
dec ecx
add rsp, 0x28
jmp fcn.14029819c
lea rcx, [0x1403a00c8]
call fcn.1402332b0
mov ecx, eax
jmp 0x14016780d
Function at 0x1401683d8
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.14016a789
test rax, rax
je 0x140168416
lea rdx, [0x140452f90]
mov rcx, rax
call fcn.14016787b
mov rax, qword [rdi + 0x30]
jmp 0x140168453
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.1401677bb
mov rax, qword [rdi + 0x30]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
and qword [rdi + 0x40], 0
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.1401678aa
Function at 0x140168477
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rdi, rcx
call fcn.1401677fd
cmp rax, 1
jbe 0x1401684a7
mov rsi, rax
add rsi, 8
mov rax, qword [rax + 8]
test rax, rax
cmove rsi, rax
jne 0x14016862f
call fcn.1401677fd
cmp rax, 1
je 0x14016862d
mov rsi, rax
test rax, rax
jne 0x1401684f7
mov ecx, 0x10
mov edx, 8
call fcn.1400073ab
mov rsi, rax
lea rax, [0x1403a00c8]
mov qword [rsi], rax
and qword [rsi + 8], 0
mov ecx, dword [0x1403a00e0]
test ecx, ecx
je 0x14016863d
dec ecx
mov rdx, rsi
call fcn.1402981a4
test rdi, rdi
je 0x140168513
mov rbx, qword [rdi]
and qword [rdi], 0
test rbx, rbx
jne 0x14016861c
xor ecx, ecx
call fcn.1401677b1
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.14016a789
test rax, rax
jne 0x140168650
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdi, [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
lea rbx, [rsp + 0x90]
mov rcx, rbx
mov rdx, rdi
call fcn.1401677bb
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
movups xmmword [rbx + 0x18], xmm2
movups xmmword [rbx + 8], xmm1
movups xmmword [rbx - 8], xmm0
movups xmm0, xmmword [rbx - 0x10]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x30], rax
mov ecx, 0x170
mov edx, 0x10
call fcn.1400073ab
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x10]
mov r8d, 0x100
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rbx + 0x110], 0x40
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x118], xmm0
movups xmmword [rbx + 0x128], xmm1
movups xmmword [rbx + 0x138], xmm2
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x148], rax
mov eax, 0x10000
mov qword [rbx + 0x150], rax
mov qword [rbx + 0x158], rax
and qword [rbx + 0x160], 0
add rsi, 8
mov rcx, qword [rsi]
mov qword [rsi], rbx
call fcn.1401677b1
jmp 0x14016862f
xor esi, esi
mov rax, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1403a00c8]
call fcn.1402332b0
mov ecx, eax
jmp 0x1401684ef
mov qword [rsp + 0x20], rax
lea rax, [0x140452f90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rax], rdi
lea rdx, str.could_not_initialize_thread_rng:
lea rcx, [rsp + 0x80]
mov qword [rcx], rdx
mov edx, 1
mov qword [rcx + 8], rdx
and qword [rcx + 0x20], 0
lea r8, [0x14016a73a]
mov qword [rax + 8], r8
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
lea rdx, str._Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rand_0.8.5_src_rngs_thread.rs
call fcn.14004fdf0
ud2
Function at 0x14016a789
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x14016a81a
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x14016a7a9
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x14016a7a9
xor ebx, 0x80000000
je 0x14016a818
mov al, byte [0x140545270]
mov ecx, 4
mov edx, 4
call fcn.140026d00
test rax, rax
je 0x14016a82d
mov rsi, rax
mov dword [rax], ebx
jmp 0x14016a81a
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.14004a180
ud2
Function at 0x14017f84a
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x14017f8bd
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x14017f88c
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14017fa11
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x14017f92a
cmp qword [rax + r12 + 0x10], r8
jne 0x14017f92a
lea rdx, [rax + r12]
mov rbx, qword [rdx]
xor edx, edx
cmp r8, rdx
je 0x14017fa01
mov r9b, byte [rbx + rdx*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x14017f92a
mov r9b, byte [r15 + rdx*8 + 5]
cmp byte [rbx + rdx*8 + 5], r9b
jne 0x14017f92a
mov r9d, dword [rbx + rdx*8]
lea r10, [rdx + 1]
cmp r9d, dword [r15 + rdx*8]
mov rdx, r10
je 0x14017f8f8
mov qword [rsp + 0x28], r14
mov rbx, rcx
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, r15
mov r14, r11
call fcn.140173ce2
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r14
mov r8, r13
call fcn.1401c6998
mov eax, dword [rbp]
cmp eax, 0x2a
jne 0x14017f9c4
mov rdx, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x14017fa2b
mov edi, dword [rsp + 0x4c]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.1401c66d0
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], edi
mov word [rsi + r12 + 0x1c], bp
mov dword [rbx + 4], edi
mov dword [rbx], 0x2a
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov edx, dword [rsi - 4]
lea rdi, [rbx + 8]
mov ecx, 0xf
rep movsq qword [rdi], qword [rsi]
mov dword [rbx], eax
mov dword [rbx + 4], edx
mov r14, qword [rsp + 0x28]
mov rdx, qword [r14 + 8]
mov rcx, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1401c66d0
mov eax, dword [rax + r12 + 0x18]
mov dword [rcx + 4], eax
mov dword [rcx], 0x2a
jmp 0x14017f9e2
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero_Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompson_literal_trie.rs
lea r8, str._Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompson_map.rs
mov edx, 0x39
call fcn.1400519b0
ud2
lea r8, str._Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompson_map.rs
mov rcx, rdi
call fcn.1400500f0
ud2
Function at 0x1401bf2cb
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403a0140]
test ecx, ecx
je 0x1401bf2e4
dec ecx
add rsp, 0x28
jmp fcn.14029819c
lea rcx, [0x1403a0128]
call fcn.1402332b0
mov ecx, eax
jmp 0x1401bf2db
Function at 0x1401e3138
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str._Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.1401e3064
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x1401e3215
test eax, eax
je 0x1401e3231
cmp eax, 0x90317
je 0x1401e32a9
cmp eax, 0x90321
jne 0x1401e32b1
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401e30d8
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x1401e32bf
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x1401e32ad
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.1401e32d3
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14027a491
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401e30d8
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x1401e32bf
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x1401e32bf
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401e4486
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
lea r9, str._Users_spectrum_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.1401e3064
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x1401e4569
test eax, eax
je 0x1401e4588
cmp eax, 0x90317
je 0x1401e4609
cmp eax, 0x90321
jne 0x1401e4611
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401e4426
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x1401e461f
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x1401e460d
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.1401e32d3
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14027a491
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401e4426
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x1401e461f
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x1401e461f
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret