joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400114e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140011527
mov r15d, 8
sub r15, r11
cmp r8, r15
mov rax, r15
cmovb rax, r8
cmp rax, 3
jbe 0x14001152f
mov r14d, dword [rdx]
mov r10d, 4
mov rcx, r10
or rcx, 1
cmp rcx, rax
jb 0x140011541
jmp 0x140011558
xor r15d, r15d
jmp 0x1400115e5
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140011558
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x14001156f
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x14001158f
add r11, r8
jmp 0x1400116ca
mov rdi, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x30], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rcx
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140011663
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
nop dword [rax + rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140011610
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 3
jbe 0x140011681
mov esi, dword [rdx + r15]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r11
jb 0x140011692
jmp 0x1400116ac
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x1400116ac
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x1400116c6
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002f4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x14002f560
cmp r10, rax
jb 0x14002f5d4
cmp r10, rdx
ja 0x14002f5e8
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x14002f562
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x14002f540
jmp 0x14002f5c3
ja 0x14002f56a
mov rax, r10
cmp r11, r8
jne 0x14002f512
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x14002f5a0
mov r15, rbx
sub ecx, edx
jns 0x14002f5ba
jmp 0x14002f5c5
cmp rbx, r14
je 0x14002f5f9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x14002f5c5
xor al, 1
cmp r15, r14
jne 0x14002f580
jmp 0x14002f5c5
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14002d000
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002c6f0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valueC:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823untrusted_0.9.0_src_reader.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14002cb80
ud2
Function at 0x14004a000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x14004a116
mov rsi, r8
mov qword [rsp + 0x20], rcx
lea rcx, [r8 + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
call fcn.140064a60
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r10d, eax
movzx edi, word [rsi + 0x58]
mov eax, edi
and eax, r10d
mov r13, qword [rsi]
mov r14, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
xor r12d, r12d
nop dword [rax]
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x14004a060
movzx esi, word [r13 + r15*4]
cmp rsi, 0xffff
je 0x14004a111
movzx eax, word [r13 + r15*4 + 2]
mov ecx, eax
and ecx, edi
mov ebx, r15d
sub ebx, ecx
and ebx, edi
cmp r12, rbx
ja 0x14004a111
cmp ax, r10w
jne 0x14004a101
cmp rdx, rsi
jbe 0x14004a15a
imul rax, rsi, 0x68
mov rbp, qword [r11 + rax + 0x18]
test rbp, rbp
sete cl
cmp qword [r9 + 0x18], 0
sete bl
xor bl, cl
jne 0x14004a101
add rax, r11
test rbp, rbp
je 0x14004a0f9
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x14004a101
mov rdx, qword [r9]
mov rcx, qword [rax]
mov ebx, r10d
mov rbp, r11
call sub.msvcrt.dll_memcmp
mov r11, rbp
mov r10d, ebx
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
test eax, eax
jne 0x14004a101
jmp 0x14004a12c
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x14004a12c
inc r12
je 0x14004a140
inc r15
mov rax, r15
jmp 0x14004a060
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], rsi
mov eax, 1
jmp 0x14004a118
lea rcx, [0x140247700]
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov edx, 0x1c
call fcn.14002cb80
ud2
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov rcx, rsi
call fcn.14002ba50
ud2
Function at 0x1400648f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x140064a06
mov rsi, rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rdx + 0x40]
mov rdx, r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
call fcn.140064a60
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r10d, eax
movzx edi, word [rsi + 0x58]
mov eax, edi
and eax, r10d
mov r13, qword [rsi]
mov r14, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
xor r12d, r12d
nop
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x140064950
movzx esi, word [r13 + r15*4]
cmp rsi, 0xffff
je 0x140064a01
movzx eax, word [r13 + r15*4 + 2]
mov ecx, eax
and ecx, edi
mov ebx, r15d
sub ebx, ecx
and ebx, edi
cmp r12, rbx
ja 0x140064a01
cmp ax, r10w
jne 0x1400649f1
cmp rdx, rsi
jbe 0x140064a4a
imul rax, rsi, 0x68
mov rbp, qword [r11 + rax + 0x18]
test rbp, rbp
sete cl
cmp qword [r9 + 0x18], 0
sete bl
xor bl, cl
jne 0x1400649f1
add rax, r11
test rbp, rbp
je 0x1400649e9
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x1400649f1
mov rdx, qword [r9]
mov rcx, qword [rax]
mov ebx, r10d
mov rbp, r11
call sub.msvcrt.dll_memcmp
mov r11, rbp
mov r10d, ebx
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
test eax, eax
jne 0x1400649f1
jmp 0x140064a1c
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x140064a1c
inc r12
je 0x140064a30
inc r15
mov rax, r15
jmp 0x140064950
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], rsi
mov eax, 1
jmp 0x140064a08
lea rcx, [0x14025d560]
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov edx, 0x1c
call fcn.14002cb80
ud2
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov rcx, rsi
call fcn.14002ba50
ud2
Function at 0x140064a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140064af8
movdqu xmm0, xmmword [rcx + 8]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14021f520]
movdqu xmmword [rsp + 0x48], xmm1
pshufd xmm0, xmm0, 0xee
pxor xmm0, xmmword [0x14021f530]
movdqu xmmword [rsp + 0x58], xmm0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
xor eax, eax
cmp qword [rsi + 0x18], 0
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400114e0
cmp qword [rsi + 0x18], 0
je 0x140064b84
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x140064b9c
mov rdx, qword [rsi + 0x18]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140064c91
mov r8, qword [rsi + 8]
test r8, r8
je 0x140064d10
mov r10, qword [rsi]
movabs r11, 0x100000001b3
lea r9, [r8 - 1]
mov rsi, r8
and rsi, 7
je 0x140064c9d
mov rdx, rax
mov rcx, r10
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
xor rax, rdx
imul rax, r11
mov rdx, rax
dec rsi
jne 0x140064b60
cmp r9, 7
jae 0x140064ca6
jmp 0x140064d10
movzx eax, byte [rsi]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400114e0
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
shl r8, 0x38
or r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
add rsi, rax
rol rax, 0xd
xor rcx, r8
xor rax, rsi
rol rsi, 0x20
mov rdx, qword [rsp + 0x50]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, rsi
xor rax, rdx
rol rdx, 0x20
xor rsi, r8
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
add rdx, rcx
shl rcx, 0x10
xor rcx, rdx
shr rcx, 0x2b
add rdx, rax
shr rax, 0x2f
xor rax, rdx
shr rdx, 0x20
xor rax, rcx
xor rax, rdx
jmp 0x140064d10
movzx edx, byte [rsi]
xor rax, rdx
imul rax, rcx
jmp 0x140064d10
mov rcx, r10
cmp r9, 7
jb 0x140064d10
add r10, r8
nop dword [rax]
movzx edx, byte [rcx]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 1]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 2]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 3]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 4]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 5]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 6]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 7]
add rcx, 8
xor rax, rdx
imul rax, r11
cmp rcx, r10
jne 0x140064cb0
and eax, 0x7fff
add rsp, 0x80
pop rsi
ret
Function at 0x140071320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140071340
test al, 1
je 0x140071454
test al, 2
jne 0x14007146e
test al, 8
jne 0x140071395
mov qword [rsp + 0x28], 4
mov rdi, qword [rsi + 0x20]
call fcn.1401b1020
test rax, rax
je 0x1400713af
mov rbx, qword [rax + 0x30]
mov r15, qword [rax + 0x38]
mov qword [rax + 0x30], 1
mov qword [rax + 0x38], rdi
cmp rbx, 2
je 0x1400713af
jmp 0x1400713b1
test al, 0x10
je 0x1400713e9
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140071508
mov rcx, qword [rsi + 0x60]
call qword [rax + 0x10]
jmp 0x1400713e9
xor ebx, ebx
lea rdi, [rsi + 0x28]
mov rcx, rdi
call fcn.140070330
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x20], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
call fcn.1401b1020
test rax, rax
je 0x1400713e9
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], r15
mov qword [rsp + 0x20], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140071488
jne 0x140071444
lea rcx, [rsi + 0x28]
call fcn.140070330
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140071424
mov rcx, qword [rsi + 0x60]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14031a128]
xor edx, edx
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1401f903c
nop
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140298d68]
mov edx, 0x23
call fcn.14002cb80
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140298da8]
mov edx, 0x25
call fcn.14002cb80
ud2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.14002bad0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:__r__
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 2
lea rdx, [0x140298df0]
lea rcx, [rsp + 0x80]
call fcn.14002ba10
ud2
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0
lea rax, [0x1402be068]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x28]
call fcn.14002ba10
ud2
Function at 0x140083e00
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140083e68
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140083e68
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140083e68
mov rsi, rax
mov r14d, 1
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x140083f13
jmp 0x140083eff
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140083f79
mov rbx, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140083f79
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140083f79
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140083f79
mov r15, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x140083f79
mov rdi, qword [rsp + 0x28]
xor r14d, r14d
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x140083f13
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140083f80
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140083f80
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r15
xor eax, eax
lock cmpxchg qword [0x14031a068], rbx
je 0x140083f6a
mov rsi, rax
cmp qword [rbx], 0
jne 0x140083f56
mov rcx, qword [rbx + 8]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [0x14031a128]
xor edx, edx
mov r8, rbx
call fcn.1401f903c
mov rbx, rsi
mov rax, rbx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140083fc0
ud2
mov ecx, 0x20
mov edx, 8
call fcn.1400270c0
ud2
Function at 0x140084220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x60
mov ecx, dword [0x14021e028]
test ecx, ecx
je 0x14008431b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14008424e
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14008435c
mov ecx, dword [0x14021e028]
test ecx, ecx
je 0x14008433d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14008435a
mov rsi, rax
test rax, rax
jne 0x1400842dd
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x140084299
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140084378
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x40
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140084378
mov rsi, rax
mov qword [rax + 8], 0
lea rax, [0x14021e010]
mov qword [rsi + 0x38], rax
mov ecx, dword [0x14021e028]
test ecx, ecx
je 0x140084365
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rcx, [rsp + 0x28]
call fcn.140083430
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm2
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x30], rax
cmp qword [rsi + 8], 0
movups xmmword [rsi], xmm0
je 0x14008435c
lock dec qword [0x14031a058]
jmp 0x14008435c
lea rcx, [0x14021e010]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140084240
jmp 0x14008424e
lea rcx, [0x14021e010]
call fcn.140188b70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14008426d
xor esi, esi
mov rax, rsi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14021e010]
call fcn.140188b70
mov ecx, eax
jmp 0x1400842d5
mov ecx, 0x40
mov edx, 8
call fcn.1400270c0
ud2
Function at 0x140089530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400895c6
movdqu xmm0, xmmword [rcx + 8]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14021f890]
movdqu xmmword [rsp + 0x48], xmm1
pshufd xmm0, xmm0, 0xee
pxor xmm0, xmmword [0x14021f8a0]
movdqu xmmword [rsp + 0x58], xmm0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov rdi, qword [rsi + 0x18]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1401481e0
test rdi, rdi
je 0x140089654
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x14008966c
mov rdx, qword [rsi + 0x18]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140089761
mov r8, qword [rsi + 8]
test r8, r8
je 0x1400897e0
mov r10, qword [rsi]
movabs r11, 0x100000001b3
lea r9, [r8 - 1]
mov rsi, r8
and rsi, 7
je 0x14008976d
mov rdx, rax
mov rcx, r10
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor rax, rdx
imul rax, r11
mov rdx, rax
dec rsi
jne 0x140089630
cmp r9, 7
jae 0x140089776
jmp 0x1400897e0
movzx eax, byte [rsi]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1401481e0
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
shl r8, 0x38
or r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
add rsi, rax
rol rax, 0xd
xor rcx, r8
xor rax, rsi
rol rsi, 0x20
mov rdx, qword [rsp + 0x50]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, rsi
xor rax, rdx
rol rdx, 0x20
xor rsi, r8
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
add rdx, rcx
shl rcx, 0x10
xor rcx, rdx
shr rcx, 0x2b
add rdx, rax
shr rax, 0x2f
xor rax, rdx
shr rdx, 0x20
xor rax, rcx
xor rax, rdx
jmp 0x1400897e0
movzx edx, byte [rsi]
xor rax, rdx
imul rax, rcx
jmp 0x1400897e0
mov rcx, r10
cmp r9, 7
jb 0x1400897e0
add r10, r8
nop dword [rax]
movzx edx, byte [rcx]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 1]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 2]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 3]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 4]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 5]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 6]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 7]
add rcx, 8
xor rax, rdx
imul rax, r11
cmp rcx, r10
jne 0x140089780
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140096fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x1400970c6
mov rsi, rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rdx + 0x40]
mov rdx, r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
call fcn.140089530
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r10d, eax
movzx edi, word [rsi + 0x58]
mov eax, edi
and eax, r10d
mov r13, qword [rsi]
mov r14, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
xor r12d, r12d
nop
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x140097010
movzx esi, word [r13 + r15*4]
cmp rsi, 0xffff
je 0x1400970c1
movzx eax, word [r13 + r15*4 + 2]
mov ecx, eax
and ecx, edi
mov ebx, r15d
sub ebx, ecx
and ebx, edi
cmp r12, rbx
ja 0x1400970c1
cmp ax, r10w
jne 0x1400970b1
cmp rdx, rsi
jbe 0x14009710a
imul rax, rsi, 0x68
mov rbp, qword [r11 + rax + 0x18]
test rbp, rbp
sete cl
cmp qword [r9 + 0x18], 0
sete bl
xor bl, cl
jne 0x1400970b1
add rax, r11
test rbp, rbp
je 0x1400970a9
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x1400970b1
mov rdx, qword [r9]
mov rcx, qword [rax]
mov ebx, r10d
mov rbp, r11
call sub.msvcrt.dll_memcmp
mov r11, rbp
mov r10d, ebx
mov r9, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
test eax, eax
jne 0x1400970b1
jmp 0x1400970dc
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x1400970dc
inc r12
je 0x1400970f0
inc r15
mov rax, r15
jmp 0x140097010
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], rsi
mov eax, 1
jmp 0x1400970c8
lea rcx, str.attempt_to_add_with_overflowMissing_scheme
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov edx, 0x1c
call fcn.14002cb80
ud2
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.12_srcheadermap.rs
mov rcx, rsi
call fcn.14002ba50
ud2
Function at 0x14009acd0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov r14, rcx
lea rcx, [rsp + 0x58]
mov r8d, 0xb
mov rdx, rax
call fcn.14009a920
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
mov rcx, qword [0x14031a128]
test rcx, rcx
jne 0x14009ad2f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14009ae5d
mov rcx, rax
mov qword [0x14031a128], rax
mov r8d, 0x800
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14009ae5d
mov rdi, rax
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [0x14021f9a0]
movups xmmword [rsp + 0x48], xmm0
mov r15, qword [rsp + 0x58]
lea r13, [rsp + 0x38]
lea rsi, [rsp + 0x3c]
lea r12, [rsp + 0x40]
nop dword [rax]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
mov r9, rsi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14009adb8
mov r8d, dword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
cmp rax, r8
jae 0x14009ad70
mov rcx, r12
call fcn.14006f3b0
mov rdi, qword [rsp + 0x40]
jmp 0x14009ad70
test eax, eax
jne 0x14009adea
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14009ae3d
movabs rax, 0xde00000002
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
cmp qword [rsp + 0x48], 0
jne 0x14009ae02
jmp 0x14009ae13
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
cmp qword [rsp + 0x48], 0
je 0x14009ae13
mov rcx, qword [0x14031a128]
xor edx, edx
mov r8, rdi
call fcn.1401f903c
cmp qword [rsp + 0x60], 0
je 0x14009ae2c
mov rcx, qword [0x14031a128]
xor edx, edx
mov r8, r15
call fcn.1401f903c
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x14009ae1b
jmp 0x14009ae2c
mov ecx, 0x800
mov edx, 1
call fcn.1400270c0
ud2