joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bbd4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000bc04
xor eax, eax
jmp 0x14000bcc7
mov rbp, rbx
cmp word [rax], si
je 0x14000bc29
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000bc10
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000bc0c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000baf4
movsxd r14, eax
test eax, eax
jne 0x14000bc67
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000bbfd
mov rcx, r14
call fcn.14000cab0
mov rdi, rax
test rax, rax
jne 0x14000bc80
xor ecx, ecx
call fcn.140008c1c
jmp 0x14000bc5c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000baf4
test eax, eax
jne 0x14000bcb1
mov rcx, rdi
call fcn.140008c1c
jmp 0x14000bcbb
xor ecx, ecx
call fcn.140008c1c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000fa08
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140009acc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000fa92
cmp byte [rbp - 0x21], r15b
je 0x14000fa8d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000fac8
call fcn.14000d2c0
test eax, eax
jne 0x14000fab4
cmp byte [rbp - 0x21], r15b
je 0x14000faac
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000fac8
cmp byte [rbp - 0x21], r15b
je 0x14000fac5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140009950
test eax, eax
jne 0x14000fb68
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140009acc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000fb07
cmp byte [rbp - 0x21], r15b
je 0x14000fb3c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000fb3c
call fcn.14000d2c0
test eax, eax
jne 0x14000fb28
cmp byte [rbp - 0x21], r15b
je 0x14000fb21
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000fb3c
cmp byte [rbp - 0x21], r15b
je 0x14000fb39
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140009950
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000fb68
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000fb6b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000fb79
mov rcx, rdi
call fcn.140008c1c
cmp byte [rbp + 0x3f], r15b
je 0x14000fb88
mov rcx, qword [rbp + 0x27]
call fcn.140008c1c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400129b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400129d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400129d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000114c
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rax, 0xb2d05e00
mov rbx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, rbx
jb 0x140001165
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x14000118c
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001185
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret
Function at 0x140003212
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x140003715
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp fcn.140127b42
Function at 0x1400139fa
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov eax, 9
lea ecx, [rax - 2]
cmp ecx, 0x64
ja 0x140013a1d
mov dword [rsp + 0x40], eax
add eax, 2
jmp 0x140013a0c
mov eax, dword [rsi + 0x10]
mov rbx, qword [rsi + 8]
lea rcx, [rsp + 0x50]
mov dword [rcx], eax
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rcx + 8], rbx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.140066589
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140013a98
Capabilities:
Encrypt data using dpapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4c8
mov rsi, rdx
mov rdi, rcx
mov eax, 5
cmp eax, 0x66
je 0x140013ac6
mov dword [rsp + 0xe0], eax
inc eax
jmp 0x140013ab6
mov r14, qword [rsi + 0x10]
cmp r14, 0xe
ja 0x140013aee
mov rcx, rdi
mov rdx, rsi
add rsp, 0x4c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400139fa
mov qword [rsp + 0x60], r9
cmp r9, 0x20
jne 0x140013cdc
lea rcx, [rsp + 0xe0]
mov rdx, r8
call fcn.1400121b4
mov rbx, qword [rsi + 8]
lea r9, str.src_browser_crypto.rs
mov r8d, 0xf
mov rcx, rbx
mov rdx, r14
call fcn.140010c9a
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14000a0ec
mov r13, qword [rsp + 0x40]
cmp r13, 0xf
ja 0x140013b4e
mov r14, qword [rsp + 0x38]
jmp 0x140013c97
lea r15, [r13 - 0x10]
mov r14, qword [rsp + 0x38]
movabs rax, 0x1000000011
cmp r15, rax
jae 0x140013c97
lea r8, [rbx + 3]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xe0]
call fcn.14000e32a
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmm2, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
lea r8, [rsp + 0xd0]
movaps xmmword [r8], xmm2
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xe0]
mov r9, r14
call fcn.14000e19f
add r13, r14
add r13, 0xfffffffffffffff0
mov bpl, 1
xor r12d, r12d
cmp r12, 0x10
je 0x140013c03
mov al, byte [r13 + r12]
xor al, byte [rsp + r12 + 0xa0]
mov ecx, eax
neg cl
or cl, al
not cl
shr cl, 7
call fcn.14006cac9
inc r12
and bpl, al
jmp 0x140013bd8
mov ecx, ebp
call fcn.14006cac9
test al, al
je 0x140013c97
lea rdx, [rsp + 0x60]
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], r15
lea rcx, [rsp + 0xb0]
call fcn.14000c491
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x90], xmm0
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140013ca4
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 8], rax
mov al, byte [0x14021f238]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.140066589
jmp 0x140013cc8
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call fcn.140066589
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.1400139fa
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdi], xmm0
mov al, byte [0x14021f238]
add rsp, 0x4c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rsp + 0xe0]
and qword [r8], 0
lea rdx, [0x1402284c0]
lea r9, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_generic_array_0.14.7_src_lib.rsOS_Error:
lea rcx, [rsp + 0x60]
call fcn.140041a01
ud2
Function at 0x14003116c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14003ab00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14003ab80
cmp r11, r10
ja 0x14003abf7
cmp r10, rdx
ja 0x14003ac09
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14003ab82
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14003ab60
jmp 0x14003abe4
ja 0x14003ab8a
mov r11, r10
cmp rax, r8
jne 0x14003ab2e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14003abc0
mov rdi, r8
sub ecx, edx
jns 0x14003abdb
jmp 0x14003abe6
cmp r8, rsi
je 0x14003ac18
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14003abe6
xor al, 1
cmp rdi, rsi
jne 0x14003aba0
jmp 0x14003abe6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400387d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140034e10
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140038d00
int3
Function at 0x1400401d2
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x140232448]
mov ebx, 0xff
lea rsi, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.4.2_src_baseline.rs
cmp r9, 0x40
jb 0x140040302
mov r14d, 4
sub r14, 1
jb 0x1400401f7
cmp r9, 0xf
jbe 0x14004032f
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.140040815
mov r9, rdx
mov ecx, ebp
jmp 0x140040207
xor edx, edx
cmp r9, rdx
je 0x140040320
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140040304
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.4.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.140034540
int3
Function at 0x1400408f2
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140040913
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14012895c
mov rcx, rax
call fcn.1400ccbe0
mov ecx, eax
jmp 0x140040906

Function at 0x1400413bc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021f070]
test ecx, ecx
je 0x1400413d5
dec ecx
add rsp, 0x28
jmp fcn.140128954
lea rcx, [0x14021f058]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x1400413cc

Function at 0x14004182a
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
call fcn.1400418fa
cmp rax, 1
jbe 0x14004184a
mov rsi, rax
add rsi, 8
jmp 0x1400418cd
je 0x1400418cb
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
mov rcx, rsi
call sub.bcryptprimitives.dll_ProcessPrng
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov ecx, 8
mov edx, 0x18
call fcn.1400c7864
test rax, rax
je 0x1400418ea
mov rsi, rax
mov rbx, rax
lea rax, [0x14021f1c0]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
call fcn.1400418fa
mov rdi, rax
mov ecx, dword [0x14021f1d8]
test ecx, ecx
je 0x1400418da
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.14012895c
test rdi, rdi
je 0x1400418cd
mov edx, 8
mov rcx, rdi
call fcn.14002f3f0
jmp 0x1400418cd
xor esi, esi
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14021f1c0]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x1400418ab
mov ecx, 8
mov edx, 0x18
call fcn.140031210
int3
jmp 0x14004182a

Function at 0x1400418fa
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021f1d8]
test ecx, ecx
je 0x140041913
dec ecx
add rsp, 0x28
jmp fcn.140128954
lea rcx, [0x14021f1c0]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x14004190a

Function at 0x140045ed3
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140045ef9
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140045ee3
mov qword [rcx], rax
ret

Function at 0x140045fe1
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14005d46d
test rbx, rbx
je 0x14004601a
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140045ed3
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140045ecb
Function at 0x140055947
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
call fcn.1400418fa
cmp rax, 1
jbe 0x140055967
mov rsi, rax
add rsi, 8
jmp 0x1400559dd
je 0x1400559db
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
mov rcx, rsi
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsi]
mov ecx, 0x18
mov edx, 8
call fcn.14010f040
mov rsi, rax
mov rbx, rax
lea rax, [0x14021f1c0]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
call fcn.1400418fa
mov rdi, rax
mov ecx, dword [0x14021f1d8]
test ecx, ecx
je 0x1400559ed
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.14012895c
test rdi, rdi
je 0x1400559dd
mov edx, 8
mov rcx, rdi
call fcn.14002f3f0
jmp 0x1400559dd
xor esi, esi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14021f1c0]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x1400559bb
Function at 0x14006c165
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021f028]
test ecx, ecx
je 0x14006c17e
dec ecx
add rsp, 0x28
jmp fcn.140128954
lea rcx, [0x14021f010]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x14006c175

Function at 0x14006c18e
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov r14, qword [0x1402ec060]
test r14, r14
jne 0x14006c2b5
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14006c1f5
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14006c1f5
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14006c1f5
mov r15, rax
xor ebx, ebx
jmp 0x14006c276
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14006c2c9
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14006c2c9
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14006c2c9
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14006c2c9
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x14006c2c9
mov r15, qword [rsp + 0x20]
mov ecx, 0x18
call fcn.1400c7ce4
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1402ec060], r14
je 0x14006c2b5
mov rdi, rax
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
call fcn.14006c324
mov rcx, r14
call fcn.14008ef54
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.10_src_thread_parker_windows_mod.rs
call fcn.140034490
mov rsi, rax
mov rcx, r14
call fcn.14008ef54
jmp 0x14006c316
mov rcx, rsi
call fcn.140128e60
call fcn.140039140
int3
Function at 0x14006ed3c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021f050]
test ecx, ecx
je 0x14006ed55
dec ecx
add rsp, 0x28
jmp fcn.140128954
lea rcx, [0x14021f038]
call fcn.1400ccbe0
mov ecx, eax
jmp 0x14006ed4c

Function at 0x14006ed87
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov r14d, 0x20
mov r15d, 0xffffffff
test r14, r14
je 0x14006edcb
cmp r14, r15
mov ebx, 0xffffffff
cmovb rbx, r14
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x14006edcf
sub r14, rbx
add rdi, rbx
jmp 0x14006eda4
mov al, 5
jmp 0x14006ee18
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rsp + 0x28], rdi
mov ecx, 8
mov edx, 8
call fcn.14000ab99
mov qword [rax], rdi
lea rcx, str.couldnt_generate_random_bytesNoTimerCoarseTimerNotMonotonicTinyVariantionsTooManyStuck_home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rand_0.5.6_src_rngs_thread.rscould_not_initialize_thread_rng:
mov qword [rsi], rcx
mov qword [rsi + 8], 0x1e
mov qword [rsi + 0x10], rax
lea rax, fcn.14006d2fe
mov qword [rsi + 0x18], rax
xor eax, eax
mov byte [rsi + 0x20], al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14006ffcd
Capabilities:
Encrypt data using hc-128 via wolfssl

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x1030
call fcn.140128330
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rcx + 0x1018]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006d6f6
cmp qword [rbx], 0
je 0x140070031
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
movzx eax, byte [rsp + 0x48]
cmp eax, 2
je 0x14007005b
cmp eax, 5
je 0x140070052
mov r8, qword [rdi + 0x1008]
mov rbx, r8
sar rbx, 8
test al, al
cmove rbx, r8
call fcn.14006ed1c
jmp 0x140070062
lea rdx, [rsp + 0x28]
mov rax, qword [rdi + 0x1008]
mov qword [rdi + 0x1010], rax
mov r8d, 0x1008
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov rbx, qword [rdi + 0x1008]
jmp 0x140070062
call fcn.14006ed1c
xor ebx, ebx
add rbx, 0xffffffffffffffc0
mov qword [rdi + 0x1010], rbx
mov rcx, rdi
mov rdx, rsi
add rsp, 0x1030
pop rbx
pop rdi
pop rsi
jmp fcn.14006f24b
Function at 0x140093b40
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x70]
lea r9, [0x140264ed0]
call fcn.1400938ef
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x140093c8d
test eax, eax
je 0x140093c1b
cmp eax, 0x90317
je 0x140093c87
cmp eax, 0x90321
jne 0x140093cab
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140093aea
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x140093cb9
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x40]
and qword [rdi + 0x50], 0
call fcn.140093cc3
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14011abdc
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140093aea
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x140093cb9
mov byte [rsi + 1], 1
jmp 0x140093ca7
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x140093cb9
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret