joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140022167
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140022046
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140021980
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140020fc0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140022037
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140016680
mov dword [rbx + 0x80], 0
jmp 0x140022153
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001fdf0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400327e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x14004822c]
movsxd rax, dword [0x140047d60]
xor r9d, r9d
cmp eax, 0x7b
ja 0x140032820
lea r9, [0x1400471b0]
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test r9, r9
jne 0x140032866
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x140040ad8]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], r9b
jmp 0x1400328a2
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140032870
lea rcx, [rbp - 0x28]
cmp rbx, 0xf
ja 0x14003289a
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x28], 0
jmp 0x1400328a2
mov rdx, rbx
call fcn.140035ca0
cmp edi, 1
jne 0x1400328f4
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x1400328df
lea rbx, [rbp - 0x28]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0xd
lea r8d, [rdi + 0xc]
lea rdx, str.Press_the_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x1400328f4
lea r9, str.Press_the_key
mov edx, 0xd
lea rcx, [rbp - 0x28]
call fcn.140035ca0
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140029470
test al, al
je 0x140032943
test edi, edi
jne 0x140032943
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140032790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140032981
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003297c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003297c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400365c4
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400361a0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400342b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov rcx, qword [rsp + 0x278]
call fcn.140036090
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140034345
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140034345
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140034392
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140034320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10d, dword [0x140048220]
xor r8d, r8d
mov r9, qword [rsp + 0x278]
test r10d, r10d
jle 0x140034419
lea rax, [0x140047d78]
mov rdx, qword [rax - 8]
cmp rdx, r9
ja 0x140034381
add rdx, qword [rax]
cmp rdx, r9
jae 0x1400343f9
inc r8d
add rax, 0x18
cmp r8d, r10d
jl 0x140034370
jmp 0x140034419
mov r10d, dword [0x140048220]
xor r8d, r8d
mov r9, qword [rsp + 0x278]
test r10d, r10d
jle 0x1400343f3
lea rax, [0x140047d78]
mov rdx, qword [rax - 8]
cmp rdx, r9
ja 0x1400343c1
add rdx, qword [rax]
cmp rdx, r9
jae 0x1400343d3
inc r8d
add rax, 0x18
cmp r8d, r10d
jl 0x1400343b0
mov eax, dword [rsp + 0x28]
jmp 0x14003441b
cmp r8d, 0xffffffff
jle 0x1400343f3
movsxd rax, r8d
lea rcx, [rax + rax*2]
lea rax, [0x140047d70]
cmp byte [rax + rcx*8 + 0x11], 1
jne 0x1400343f3
mov byte [rax + rcx*8 + 0x11], 0
mov eax, dword [rsp + 0x28]
jmp 0x14003441b
cmp r8d, 0xffffffff
jle 0x140034419
movsxd rax, r8d
lea rcx, [rax + rax*2]
lea rax, [0x140047d70]
cmp byte [rax + rcx*8 + 0x11], 1
jne 0x140034419
mov byte [rax + rcx*8 + 0x11], 0
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400361a0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140035050
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x1f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x11
jb 0x140035060
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140036db4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140036dfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140036dfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140036dfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140036dfe
cmp dword [rcx + 0x84], 0xe
jbe 0x140036dfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140036e00
xor al, al
add rsp, 0x28
ret
Function at 0x14005f790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x14005f810
cmp r10, rax
jb 0x14005f884
cmp r10, rdx
ja 0x14005f898
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x14005f812
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x14005f7f0
jmp 0x14005f873
ja 0x14005f81a
mov rax, r10
cmp r11, r8
jne 0x14005f7c2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x14005f850
mov r15, rbx
sub ecx, edx
jns 0x14005f86a
jmp 0x14005f875
cmp rbx, r14
je 0x14005f8a9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x14005f875
xor al, 1
cmp r15, r14
jne 0x14005f830
jmp 0x14005f875
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14016f5e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14016f3c0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_84c898d65adf2f39a5a98507f1fe0ce10a2b8dbclibrarycore_src_strpattern.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14016f3d0
ud2
Function at 0x14006ee70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14006ef08
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140176670]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
xor eax, eax
cmp qword [rsi + 0x18], 0
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14006f130
cmp qword [rsi + 0x18], 0
je 0x14006ef94
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x14006efac
mov rdx, qword [rsi + 0x18]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14006f0a1
mov r8, qword [rsi + 8]
test r8, r8
je 0x14006f120
mov r10, qword [rsi]
movabs r11, 0x100000001b3
lea r9, [r8 - 1]
mov rsi, r8
and rsi, 7
je 0x14006f0ad
mov rdx, rax
mov rcx, r10
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
xor rax, rdx
imul rax, r11
mov rdx, rax
dec rsi
jne 0x14006ef70
cmp r9, 7
jae 0x14006f0b6
jmp 0x14006f120
movzx eax, byte [rsi]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14006f130
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
shl r8, 0x38
or r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
add rsi, rax
rol rax, 0xd
xor rcx, r8
xor rax, rsi
rol rsi, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, rsi
xor rax, rdx
rol rdx, 0x20
xor rsi, r8
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
add rdx, rcx
shl rcx, 0x10
xor rcx, rdx
shr rcx, 0x2b
add rdx, rax
shr rax, 0x2f
xor rax, rdx
shr rdx, 0x20
xor rax, rcx
xor rax, rdx
jmp 0x14006f120
movzx edx, byte [rsi]
xor rax, rdx
imul rax, rcx
jmp 0x14006f120
mov rcx, r10
cmp r9, 7
jb 0x14006f120
add r10, r8
nop dword [rax]
movzx edx, byte [rcx]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 1]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 2]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 3]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 4]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 5]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 6]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 7]
add rcx, 8
xor rax, rdx
imul rax, r11
cmp rcx, r10
jne 0x14006f0c0
and eax, 0x7fff
add rsp, 0x80
pop rsi
ret
Function at 0x14006f130
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14006f177
mov r15d, 8
sub r15, r11
cmp r8, r15
mov rax, r15
cmovb rax, r8
cmp rax, 3
jbe 0x14006f17f
mov r14d, dword [rdx]
mov r10d, 4
mov rcx, r10
or rcx, 1
cmp rcx, rax
jb 0x14006f191
jmp 0x14006f1a8
xor r15d, r15d
jmp 0x14006f233
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x14006f1a8
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x14006f1bf
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x14006f1df
add r11, r8
jmp 0x14006f319
mov rdi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 8]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x18], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x10], rcx
mov qword [r9 + 8], rsi
xor rax, r14
mov qword [r9], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x14006f2b2
mov rax, qword [r9 + 0x18]
mov rsi, qword [r9]
mov rcx, qword [r9 + 8]
mov rdi, qword [r9 + 0x10]
nop word cs:[rax + rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x14006f260
mov qword [r9 + 0x18], rax
mov qword [r9], rsi
mov qword [r9 + 0x10], rdi
mov qword [r9 + 8], rcx
cmp r11d, 3
jbe 0x14006f2d0
mov esi, dword [rdx + r15]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r11
jb 0x14006f2e1
jmp 0x14006f2fb
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x14006f2fb
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x14006f315
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140072a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov r9, r8
mov r8, qword [rdx + 8]
mov eax, dword [rdx]
mov r11d, dword [rdx + 4]
mov dword [rsp + 0x20], eax
lea r10, [rsp + 0x24]
mov dword [rsp + 0x24], r11d
cmp qword [r8 + 0x20], rax
jbe 0x140072abe
mov rdx, qword [r8 + 0x18]
imul rsi, rax, 0x130
cmp dword [rdx + rsi + 0x88], 2
je 0x140072abe
add rdx, rsi
cmp dword [rdx + 0xb8], r11d
jne 0x140072abe
mov edi, dword [rdx + 0x4c]
xor edx, edx
test edi, edi
cmovg edx, edi
jle 0x140072ab6
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], r11d
cmp qword [r8 + 0x20], rax
jbe 0x140072b09
mov rax, qword [r8 + 0x18]
cmp dword [rax + rsi + 0x88], 2
je 0x140072b09
add rax, rsi
cmp dword [rax + 0xb8], r11d
jne 0x140072b09
mov esi, dword [rax + 0x4c]
sub esi, edx
jo 0x140072aab
mov dword [rax + 0x4c], esi
add rsp, 0x68
pop rdi
pop rsi
jmp fcn.1400725e0
nop
add rsp, 0x68
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], r10
lea rax, [0x14006b6a0]
mov qword [rsp + 0x30], rax
lea rax, str.dangling_store_key_for_stream_id
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823h2_0.3.21_srcproto_streams_store.rsassertion_failed:_N::next_stream_.is_none__
jmp 0x140072b52
mov qword [rsp + 0x28], r10
lea rax, [0x14006b6a0]
mov qword [rsp + 0x30], rax
lea rax, str.dangling_store_key_for_stream_id
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823h2_0.3.21_srcproto_streams_store.rsassertion_failed:_N::next_stream_.is_none__
lea rcx, [rsp + 0x38]
call fcn.14016f2f0
ud2
Function at 0x140073d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r9, rdx
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x140073e5d
mov rdi, rcx
add rcx, 0x40
mov rdx, r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rax
call fcn.14006ee70
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10d, eax
movzx r15d, ax
movzx r12d, word [rdi + 0x58]
and r15d, r12d
mov rbp, qword [rdi]
mov r13, qword [rdi + 8]
mov r11, qword [rdi + 0x18]
xor r14d, r14d
jmp 0x140073d96
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x140073e4a
nop
inc r14
inc r15
mov rax, r15
nop dword [rax]
mov r15, rax
mov eax, 0
cmp r15, r13
jae 0x140073da0
movzx ecx, word [rbp + r15*4]
cmp rcx, 0xffff
je 0x140073e5d
movzx edi, word [rbp + r15*4 + 2]
mov eax, edi
and eax, r12d
mov esi, r15d
sub esi, eax
and esi, r12d
cmp r14, rsi
ja 0x140073e5d
cmp di, r10w
jne 0x140073d90
cmp rdx, rcx
jbe 0x140073e8a
imul rdi, rcx, 0x68
mov rcx, qword [r11 + rdi + 0x18]
test rcx, rcx
sete al
cmp qword [r9 + 0x18], 0
sete bl
xor bl, al
jne 0x140073d90
lea rax, [r11 + rdi]
test rcx, rcx
je 0x140073d82
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x140073d90
mov rdx, qword [r9]
mov rcx, qword [rax]
mov esi, r10d
mov rbx, r11
call sub.VCRUNTIME140.dll_memcmp
mov r11, rbx
mov r10d, esi
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
test eax, eax
jne 0x140073d90
lea rsi, [r11 + rdi]
add rsi, 0x20
mov rax, qword [r9 + 0x18]
test rax, rax
jne 0x140073e68
jmp 0x140073e76
xor esi, esi
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140073e76
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
call fcn.14016f330
ud2
Function at 0x14008a1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x14008a31c
mov qword [rsp + 0x30], rcx
lea rcx, [rsi + 0x40]
mov rdx, r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], rax
call fcn.14006ee70
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov ebp, eax
movzx r12d, ax
movzx edi, word [rsi + 0x58]
and r12d, edi
mov r14, qword [rsi]
mov r15, qword [rsi + 8]
mov qword [rsp + 0x28], rsi
mov r10, qword [rsi + 0x18]
xor r13d, r13d
jmp 0x14008a256
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x14008a2fd
nop word cs:[rax + rax]
inc r13
inc r12
mov rax, r12
nop dword [rax]
mov r12, rax
mov eax, 0
cmp r12, r15
jae 0x14008a260
movzx ebx, word [r14 + r12*4]
cmp rbx, 0xffff
je 0x14008a30e
movzx eax, word [r14 + r12*4 + 2]
mov ecx, eax
and ecx, edi
mov esi, r12d
sub esi, ecx
and esi, edi
cmp r13, rsi
ja 0x14008a30e
cmp ax, bp
jne 0x14008a250
cmp rdx, rbx
jbe 0x14008a366
imul rax, rbx, 0x68
mov rsi, qword [r10 + rax + 0x18]
test rsi, rsi
sete r8b
cmp qword [r9 + 0x18], 0
sete cl
xor cl, r8b
jne 0x14008a250
add rax, r10
test rsi, rsi
je 0x14008a23a
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x14008a250
mov rdx, qword [r9]
mov rcx, qword [rax]
mov rsi, r10
call sub.VCRUNTIME140.dll_memcmp
mov r10, rsi
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
test eax, eax
jne 0x14008a250
mov eax, 1
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
jmp 0x14008a31e
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
xor eax, eax
jmp 0x14008a31e
xor eax, eax
mov qword [rcx + 0x10], rsi
mov qword [rcx], rax
mov qword [rcx + 8], rbx
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x14008a354
mov rax, qword [rax + 0x10]
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rcx, rbx
call fcn.14016f330
ud2
Function at 0x14008a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x30], rcx
mov rcx, rdx
call fcn.14008a7d0
lea rcx, [rdi + 0x40]
mov qword [rsp + 0x38], rcx
mov rdx, rsi
call fcn.14006ee70
mov r9, rsi
mov r10d, eax
movzx eax, ax
movzx r14d, word [rdi + 0x58]
mov r13d, r14d
mov dword [rsp + 0x24], eax
and r13d, eax
mov r12, qword [rdi]
mov rbx, qword [rdi + 8]
mov r11, qword [rdi + 0x20]
mov qword [rsp + 0x28], rdi
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x40], rax
xor esi, esi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r11
jmp 0x14008a4c6
movzx eax, byte [rax]
cmp al, byte [r9]
je 0x14008a57b
nop
inc rsi
inc r13
mov rax, r13
nop dword [rax]
mov r13, rax
mov eax, 0
cmp r13, rbx
jae 0x14008a4d0
movzx edi, word [r12 + r13*4]
cmp rdi, 0xffff
je 0x14008a592
movzx eax, word [r12 + r13*4 + 2]
mov ecx, r14d
and ecx, eax
mov edx, r13d
sub edx, ecx
and edx, r14d
cmp rdx, rsi
jb 0x14008a592
cmp ax, r10w
jne 0x14008a4c0
cmp r11, rdi
jbe 0x14008a626
imul rax, rdi, 0x68
mov rcx, qword [rsp + 0x40]
mov rbp, qword [rcx + rax + 0x18]
test rbp, rbp
sete dl
mov r15, qword [r9 + 0x18]
test r15, r15
sete cl
xor cl, dl
jne 0x14008a4c0
add rax, qword [rsp + 0x40]
test rbp, rbp
je 0x14008a4b3
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x14008a4c0
mov rdx, qword [r9]
mov rcx, qword [rax]
mov ebp, r10d
call sub.VCRUNTIME140.dll_memcmp
mov r11, qword [rsp + 0x48]
mov r10d, ebp
mov r9, qword [rsp + 0x50]
test eax, eax
jne 0x14008a4c0
mov al, 2
xor r8d, r8d
mov rdx, r13
mov rbp, qword [rsp + 0x28]
mov rsi, rbp
mov rbx, qword [rsp + 0x30]
jmp 0x14008a5c6
cmp rsi, 0x200
setae cl
mov rax, qword [rsp + 0x38]
cmp qword [rax], 2
setne al
and al, cl
mov rdx, qword [r9]
mov rdi, qword [r9 + 8]
mov rsi, qword [r9 + 0x10]
mov r15, qword [r9 + 0x18]
mov r8b, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
mov qword [rbx], rdx
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x28], rbp
mov word [rbx + 0x30], cx
mov byte [rbx + 0x32], al
test r8b, r8b
jne 0x14008a614
test r15, r15
je 0x14008a614
mov rax, qword [r15 + 0x10]
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rcx, rdi
mov rdx, r11
call fcn.14016f330
ud2