joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14004b492
mov rsi, rcx
add rcx, 0x40
mov qword [rbp - 8], rbx
mov rdx, rbx
call fcn.140049990
mov word [rbp - 0xa], ax
movzx r15d, ax
movzx r12d, word [rsi + 0x58]
and r15d, r12d
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, qword [rsi + 0x18]
mov qword [rbp - 0x20], rax
xor eax, eax
mov qword [rbp - 0x18], rax
xor r13d, r13d
jmp 0x14004b3b6
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x14004b447
nop dword [rax]
inc r13
inc r15
cmp r15, r14
mov eax, 0
cmovae r15, rax
jb 0x14004b3cd
test r14, r14
je 0x14004b490
movzx ecx, word [rbx + r15*4]
cmp rcx, 0xffff
je 0x14004b456
movzx eax, word [rbx + r15*4 + 2]
mov edx, eax
and edx, r12d
mov edi, r15d
sub edi, edx
and edi, r12d
cmp r13, rdi
ja 0x14004b456
cmp ax, word [rbp - 0xa]
jne 0x14004b3b0
cmp qword [rbp - 0x28], rcx
jbe 0x14004b4a3
imul rsi, rcx, 0x68
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + rsi + 0x18]
test rax, rax
sete cl
mov rdx, qword [rbp - 8]
cmp qword [rdx + 0x18], 0
sete dl
xor dl, cl
jne 0x14004b3b0
mov rcx, qword [rbp - 0x20]
add rcx, rsi
test rax, rax
je 0x14004b39e
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x14004b3b0
mov rax, qword [rbp - 0x20]
add rax, rsi
add rax, 0x20
mov qword [rbp - 0x18], rax
mov rbx, qword [rbp - 8]
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14004b471
lea rcx, [rbx + 0x10]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
call qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x14004b490
xor eax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x14004b463
jmp 0x14004b471
lea r8, [0x14021e3b0]
mov rdx, qword [rbp - 0x28]
call fcn.140217c20
ud2
Function at 0x140060bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov qword [rbp - 0x28], rcx
lea rcx, [rbp - 0x40]
mov rdx, r8
mov r8, r9
call fcn.140060db0
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
mov ecx, 0x800
mov edx, 1
call fcn.14001c230
test rax, rax
je 0x140060d13
mov rbx, rax
mov qword [rbp - 0x20], 0x800
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0
mov rsi, qword [rbp - 0x38]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov r14, qword [rbp - 0x20]
mov r13, qword [rbp - 0x10]
sub r14, r13
nop word [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140060c7d
mov r8d, dword [rbp - 4]
cmp r14, r8
jae 0x140060c40
lea rcx, [rbp - 0x20]
mov rdx, r13
call fcn.14020b1c0
mov rbx, qword [rbp - 0x18]
jmp 0x140060c2c
test eax, eax
jne 0x140060c9c
mov eax, dword [rbp - 4]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
jbe 0x140060cf2
movabs rax, 0xde00000002
jmp 0x140060ca4
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp - 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 0xc
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x140060cc6
mov r8d, 1
mov rcx, rbx
call fcn.14001c240
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x140060ce0
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.14001c240
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x28]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x140060ccf
jmp 0x140060ce0
mov ecx, 0x800
mov edx, 1
call fcn.1402179b0
ud2
Function at 0x1400ba610
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
xor ecx, ecx
call fcn.1401e6760
test rax, rax
je 0x1400ba7a6
mov rcx, qword [rax]
mov r8, qword [rax + 8]
lea rdx, [rcx + 1]
movabs r11, 0x736f6d6570736575
xor r11, rcx
movabs r12, 0x646f72616e646f6d
xor r12, r8
add r11, r12
rol r12, 0xd
mov qword [rax], rdx
xor r12, r11
rol r11, 0x20
movabs r9, 0x6c7967656e657261
mov r10, r12
rol r10, 0x11
xor r9, rcx
mov edx, 1
movabs r14, 0x7465646279746573
movabs r15, 0x800000000000000
mov rcx, r8
xor rcx, rdx
xor rcx, r14
lea rbx, [rcx + r9]
rol rcx, 0x10
xor rcx, rbx
lea rsi, [rcx + r11]
rol rcx, 0x15
xor rcx, rsi
add rbx, r12
mov rax, rbx
xor rax, r10
rol rbx, 0x20
xor rsi, rdx
add rsi, rax
rol rax, 0xd
mov rdi, rcx
xor rax, rsi
rol rsi, 0x20
xor rdi, r15
add rbx, rdi
shrd rdi, rcx, 0x30
xor rdi, rbx
add rsi, rdi
rol rdi, 0x15
add rbx, rax
rol rax, 0x11
xor rdi, rsi
xor rax, rbx
rol rbx, 0x20
xor rsi, r15
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
xor rbx, 0xff
add rbx, rdi
rol rdi, 0x10
xor rdi, rbx
add rsi, rdi
rol rdi, 0x15
add rbx, rax
rol rax, 0x11
xor rax, rbx
rol rbx, 0x20
xor rdi, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
add rbx, rdi
rol rdi, 0x10
xor rdi, rbx
add rsi, rdi
rol rdi, 0x15
add rbx, rax
rol rax, 0x11
xor rax, rbx
rol rbx, 0x20
xor rdi, rsi
add rsi, rax
rol rax, 0xd
add rbx, rdi
rol rdi, 0x10
xor rdi, rbx
rol rdi, 0x15
xor rax, rsi
add rbx, rax
rol rax, 0x11
mov rcx, rbx
rol rcx, 0x20
xor rax, rbx
xor rax, rdi
inc rdx
xor rax, rcx
je 0x1400ba690
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [0x140223718]
mov qword [rsp + 0x20], rax
lea rcx, [0x140223680]
lea r9, fcn.140008810
lea r8, [rsp + 0x30]
mov edx, 0x46
call fcn.140217f90
ud2
Function at 0x140122ab0
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x140122ae4
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret

Function at 0x14012f240
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r15, rdx
mov rbx, rcx
movzx esi, byte [rcx + 0x10]
xor eax, eax
cmp sil, 2
setne al
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, r15
call fcn.140020510
cmp sil, 2
jne 0x14012f2a8
movzx eax, byte [rbx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, r15
call fcn.140020510
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [rbx]
mov rbx, qword [rbx + 8]
test sil, sil
je 0x14012f2cf
mov rcx, r15
mov rdx, rdi
mov r8, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140020510
test rbx, rbx
je 0x14012f299
xor esi, esi
lea r12, [0x140234af8]
lea r14, [rsp + 0x20]
nop word cs:[rax + rax]
movzx eax, byte [rdi + rsi]
movzx eax, byte [rax + r12]
mov byte [rsp + 0x20], al
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.140020510
inc rsi
cmp rbx, rsi
jne 0x14012f2f0
jmp 0x14012f299
Function at 0x1401404f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140140652
mov rbx, rcx
add rcx, 0x40
mov qword [rbp - 8], rdi
mov rdx, rdi
call fcn.140049990
mov word [rbp - 0xa], ax
movzx r15d, ax
movzx r12d, word [rbx + 0x58]
and r15d, r12d
mov rdi, qword [rbx]
mov r13, qword [rbx + 8]
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x20], rax
xor ebx, ebx
xor r14d, r14d
jmp 0x140140576
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x140140608
nop dword [rax]
inc r14
inc r15
cmp r15, r13
cmovae r15, rbx
jb 0x140140588
test r13, r13
je 0x140140620
movzx ecx, word [rdi + r15*4]
cmp rcx, 0xffff
je 0x140140622
movzx eax, word [rdi + r15*4 + 2]
mov edx, eax
and edx, r12d
mov esi, r15d
sub esi, edx
and esi, r12d
cmp r14, rsi
ja 0x140140622
cmp ax, word [rbp - 0xa]
jne 0x140140570
cmp qword [rbp - 0x18], rcx
jbe 0x14014065f
imul rcx, rcx, 0x68
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + rcx + 0x18]
test rax, rax
sete dl
mov rbx, qword [rbp - 8]
cmp qword [rbx + 0x18], 0
sete bl
xor bl, dl
mov ebx, 0
jne 0x140140570
add rcx, qword [rbp - 0x20]
test rax, rax
je 0x14014055a
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x140140570
mov sil, 1
mov rdi, qword [rbp - 8]
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x140140631
jmp 0x14014063f
jmp 0x140140620
xor esi, esi
mov rdi, qword [rbp - 8]
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14014063f
lea rcx, [rdi + 0x10]
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
call qword [rax + 0x10]
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor esi, esi
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x140140631
jmp 0x14014063f
lea r8, [0x14023d850]
mov rdx, qword [rbp - 0x18]
call fcn.140217c20
ud2
Function at 0x140141050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1401411b2
mov rsi, rcx
add rcx, 0x40
mov qword [rbp - 8], rbx
mov rdx, rbx
call fcn.140049990
mov word [rbp - 0xa], ax
movzx r15d, ax
movzx r12d, word [rsi + 0x58]
and r15d, r12d
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, qword [rsi + 0x18]
mov qword [rbp - 0x20], rax
xor eax, eax
mov qword [rbp - 0x18], rax
xor r13d, r13d
jmp 0x1401410d6
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x140141167
nop dword [rax]
inc r13
inc r15
cmp r15, r14
mov eax, 0
cmovae r15, rax
jb 0x1401410ed
test r14, r14
je 0x1401411b0
movzx ecx, word [rbx + r15*4]
cmp rcx, 0xffff
je 0x140141176
movzx eax, word [rbx + r15*4 + 2]
mov edx, eax
and edx, r12d
mov edi, r15d
sub edi, edx
and edi, r12d
cmp r13, rdi
ja 0x140141176
cmp ax, word [rbp - 0xa]
jne 0x1401410d0
cmp qword [rbp - 0x28], rcx
jbe 0x1401411c3
imul rsi, rcx, 0x68
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + rsi + 0x18]
test rax, rax
sete cl
mov rdx, qword [rbp - 8]
cmp qword [rdx + 0x18], 0
sete dl
xor dl, cl
jne 0x1401410d0
mov rcx, qword [rbp - 0x20]
add rcx, rsi
test rax, rax
je 0x1401410be
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x1401410d0
mov rax, qword [rbp - 0x20]
add rax, rsi
add rax, 0x20
mov qword [rbp - 0x18], rax
mov rbx, qword [rbp - 8]
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140141191
lea rcx, [rbx + 0x10]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
call qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x1401411b0
xor eax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x140141183
jmp 0x140141191
lea r8, [0x14023d850]
mov rdx, qword [rbp - 0x28]
call fcn.140217c20
ud2
Function at 0x140144410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r11, rdx
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x140144559
mov qword [rsp + 0x28], rcx
lea rcx, [r11 + 0x40]
mov rdx, r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r11
call fcn.140049990
mov r11, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov edi, eax
movzx r13d, ax
movzx r14d, word [r11 + 0x58]
and r13d, r14d
mov r15, qword [r11 + 8]
xor r9d, r9d
xor r12d, r12d
jmp 0x140144496
movzx eax, byte [rcx]
cmp al, byte [r10]
je 0x140144536
nop word cs:[rax + rax]
inc r12
inc r13
cmp r13, r15
cmovae r13, r9
jb 0x1401444a8
test r15, r15
je 0x140144550
mov rax, qword [r11]
movzx ebx, word [rax + r13*4]
cmp rbx, 0xffff
je 0x140144552
movzx eax, word [rax + r13*4 + 2]
mov ecx, eax
and ecx, r14d
mov ebp, r13d
sub ebp, ecx
and ebp, r14d
cmp r12, rbp
ja 0x140144552
cmp ax, di
jne 0x140144490
cmp rdx, rbx
jbe 0x14014457b
mov rcx, qword [r11 + 0x18]
lea rbp, [rbx + rbx*2]
shl rbp, 5
mov rsi, qword [rcx + rbp + 0x18]
test rsi, rsi
sete r8b
cmp qword [r10 + 0x18], 0
sete al
xor al, r8b
jne 0x140144490
add rcx, rbp
test rsi, rsi
je 0x140144479
mov rdx, r10
call fcn.1401d1c80
mov r11, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
xor r9d, r9d
mov rdx, qword [rsp + 0x40]
test al, al
je 0x140144490
movzx eax, bx
mov r9d, 1
mov rcx, qword [rsp + 0x28]
jmp 0x14014455c
jmp 0x140144550
mov rcx, qword [rsp + 0x28]
jmp 0x14014455c
xor r9d, r9d
mov qword [rcx + 0x10], r11
mov qword [rcx], r9
mov qword [rcx + 8], rax
mov rax, rcx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x14023d850]
mov rcx, rbx
call fcn.140217c20
ud2
Function at 0x140144590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r10, rdx
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x1401446d9
mov qword [rsp + 0x28], rcx
lea rcx, [r10 + 0x40]
mov rdx, r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r8
call fcn.140049990
mov r11, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov word [rsp + 0x26], ax
movzx r13d, ax
movzx r14d, word [r10 + 0x58]
and r13d, r14d
mov r15, qword [r10 + 8]
xor r8d, r8d
xor r12d, r12d
jmp 0x140144616
movzx eax, byte [rcx]
cmp al, byte [r11]
je 0x1401446b4
nop dword [rax + rax]
inc r12
inc r13
cmp r13, r15
cmovae r13, r8
jb 0x140144628
test r15, r15
je 0x1401446d0
mov rax, qword [r10]
movzx ebx, word [rax + r13*4]
cmp rbx, 0xffff
je 0x1401446d2
movzx eax, word [rax + r13*4 + 2]
mov ecx, eax
and ecx, r14d
mov ebp, r13d
sub ebp, ecx
and ebp, r14d
cmp r12, rbp
ja 0x1401446d2
cmp ax, word [rsp + 0x26]
jne 0x140144610
cmp rdx, rbx
jbe 0x1401446fb
mov rcx, qword [r10 + 0x18]
imul rdi, rbx, 0x68
mov rsi, qword [rcx + rdi + 0x18]
test rsi, rsi
sete r9b
cmp qword [r11 + 0x18], 0
sete al
xor al, r9b
jne 0x140144610
add rcx, rdi
test rsi, rsi
je 0x1401445fc
mov rdx, r11
call fcn.1401d1c80
mov r11, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
test al, al
je 0x140144610
movzx eax, bx
mov r8d, 1
mov rcx, qword [rsp + 0x28]
jmp 0x1401446dc
jmp 0x1401446d0
mov rcx, qword [rsp + 0x28]
jmp 0x1401446dc
xor r8d, r8d
mov qword [rcx + 0x10], r10
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov rax, rcx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x14023d850]
mov rcx, rbx
call fcn.140217c20
ud2
Function at 0x140144710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r13, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x20]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14014483c
mov qword [rbp - 0x18], rsi
lea rcx, [r13 + 0x40]
mov qword [rbp - 8], r8
mov rdx, r8
call fcn.140049990
mov word [rbp - 0xa], ax
movzx esi, ax
movzx r14d, word [r13 + 0x58]
and esi, r14d
mov r15, qword [r13 + 8]
xor edi, edi
xor r12d, r12d
jmp 0x140144798
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x140144821
nop word cs:[rax + rax]
inc r12
inc rsi
xor edi, edi
cmp rsi, r15
cmovae rsi, rdi
jb 0x1401447aa
test r15, r15
je 0x140144830
mov rax, qword [r13]
movzx ebx, word [rax + rsi*4]
cmp rbx, 0xffff
je 0x140144832
movzx eax, word [rax + rsi*4 + 2]
mov ecx, eax
and ecx, r14d
mov edx, esi
sub edx, ecx
and edx, r14d
cmp r12, rdx
ja 0x140144832
cmp ax, word [rbp - 0xa]
jne 0x140144790
cmp qword [rbp - 0x20], rbx
jbe 0x140144874
mov rcx, qword [r13 + 0x18]
imul r8, rbx, 0x68
mov rdi, qword [rcx + r8 + 0x18]
test rdi, rdi
sete al
mov rdx, qword [rbp - 8]
cmp qword [rdx + 0x18], 0
sete dl
xor dl, al
jne 0x140144790
add rcx, r8
test rdi, rdi
je 0x140144772
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x140144790
mov edi, 1
jmp 0x140144832
jmp 0x140144830
mov r8, qword [rbp - 8]
mov rsi, qword [rbp - 0x18]
jmp 0x14014483e
xor edi, edi
mov qword [rsi + 0x10], r13
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov rax, qword [r8 + 0x18]
test rax, rax
je 0x140144860
lea rcx, [r8 + 0x10]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
call qword [rax + 0x10]
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x14023d850]
mov rcx, rbx
mov rdx, qword [rbp - 0x20]
call fcn.140217c20
ud2
Function at 0x14014ee50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14014eee8
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14021bb10]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
xor eax, eax
cmp qword [rsi + 0x18], 0
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140020510
cmp qword [rsi + 0x18], 0
je 0x14014ef74
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x14014ef8c
mov rdx, qword [rsi + 0x18]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14014f081
mov r8, qword [rsi + 8]
test r8, r8
je 0x14014f100
mov r10, qword [rsi]
movabs r11, 0x100000001b3
lea r9, [r8 - 1]
mov rsi, r8
and rsi, 7
je 0x14014f08d
mov rdx, rax
mov rcx, r10
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
xor rax, rdx
imul rax, r11
mov rdx, rax
dec rsi
jne 0x14014ef50
cmp r9, 7
jae 0x14014f096
jmp 0x14014f100
movzx eax, byte [rsi]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140020510
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
shl r8, 0x38
or r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
add rsi, rax
rol rax, 0xd
xor rcx, r8
xor rax, rsi
rol rsi, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, rsi
xor rax, rdx
rol rdx, 0x20
xor rsi, r8
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
rol rsi, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rsi, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, rsi
add rsi, rax
rol rax, 0xd
xor rax, rsi
add rdx, rcx
shl rcx, 0x10
xor rcx, rdx
shr rcx, 0x2b
add rdx, rax
shr rax, 0x2f
xor rax, rdx
shr rdx, 0x20
xor rax, rcx
xor rax, rdx
jmp 0x14014f100
movzx edx, byte [rsi]
xor rax, rdx
imul rax, rcx
jmp 0x14014f100
mov rcx, r10
cmp r9, 7
jb 0x14014f100
add r10, r8
nop dword [rax]
movzx edx, byte [rcx]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 1]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 2]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 3]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 4]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 5]
xor rax, rdx
imul rax, r11
movzx edx, byte [rcx + 6]
xor rdx, rax
imul rdx, r11
movzx eax, byte [rcx + 7]
add rcx, 8
xor rax, rdx
imul rax, r11
cmp rcx, r10
jne 0x14014f0a0
and eax, 0x7fff
add rsp, 0x80
pop rsi
ret
Function at 0x14014f110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14014f272
mov rbx, rcx
add rcx, 0x40
mov qword [rbp - 8], rdi
mov rdx, rdi
call fcn.14014ee50
mov word [rbp - 0xa], ax
movzx r15d, ax
movzx r12d, word [rbx + 0x58]
and r15d, r12d
mov rdi, qword [rbx]
mov r13, qword [rbx + 8]
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x20], rax
xor ebx, ebx
xor r14d, r14d
jmp 0x14014f196
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x14014f228
nop dword [rax]
inc r14
inc r15
cmp r15, r13
cmovae r15, rbx
jb 0x14014f1a8
test r13, r13
je 0x14014f240
movzx ecx, word [rdi + r15*4]
cmp rcx, 0xffff
je 0x14014f242
movzx eax, word [rdi + r15*4 + 2]
mov edx, eax
and edx, r12d
mov esi, r15d
sub esi, edx
and esi, r12d
cmp r14, rsi
ja 0x14014f242
cmp ax, word [rbp - 0xa]
jne 0x14014f190
cmp qword [rbp - 0x18], rcx
jbe 0x14014f27f
imul rcx, rcx, 0x68
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + rcx + 0x18]
test rax, rax
sete dl
mov rbx, qword [rbp - 8]
cmp qword [rbx + 0x18], 0
sete bl
xor bl, dl
mov ebx, 0
jne 0x14014f190
add rcx, qword [rbp - 0x20]
test rax, rax
je 0x14014f17a
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x14014f190
mov sil, 1
mov rdi, qword [rbp - 8]
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x14014f251
jmp 0x14014f25f
jmp 0x14014f240
xor esi, esi
mov rdi, qword [rbp - 8]
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14014f25f
lea rcx, [rdi + 0x10]
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
call qword [rax + 0x10]
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor esi, esi
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x14014f251
jmp 0x14014f25f
lea r8, str.C:UsersAdministrator.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rdx, qword [rbp - 0x18]
call fcn.140217c20
ud2
Function at 0x14014f930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14014fa92
mov rsi, rcx
add rcx, 0x40
mov qword [rbp - 8], rbx
mov rdx, rbx
call fcn.14014ee50
mov word [rbp - 0xa], ax
movzx r15d, ax
movzx r12d, word [rsi + 0x58]
and r15d, r12d
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, qword [rsi + 0x18]
mov qword [rbp - 0x20], rax
xor eax, eax
mov qword [rbp - 0x18], rax
xor r13d, r13d
jmp 0x14014f9b6
movzx eax, byte [rcx]
mov rcx, qword [rbp - 8]
cmp al, byte [rcx]
je 0x14014fa47
nop dword [rax]
inc r13
inc r15
cmp r15, r14
mov eax, 0
cmovae r15, rax
jb 0x14014f9cd
test r14, r14
je 0x14014fa90
movzx ecx, word [rbx + r15*4]
cmp rcx, 0xffff
je 0x14014fa56
movzx eax, word [rbx + r15*4 + 2]
mov edx, eax
and edx, r12d
mov edi, r15d
sub edi, edx
and edi, r12d
cmp r13, rdi
ja 0x14014fa56
cmp ax, word [rbp - 0xa]
jne 0x14014f9b0
cmp qword [rbp - 0x28], rcx
jbe 0x14014faa3
imul rsi, rcx, 0x68
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + rsi + 0x18]
test rax, rax
sete cl
mov rdx, qword [rbp - 8]
cmp qword [rdx + 0x18], 0
sete dl
xor dl, cl
jne 0x14014f9b0
mov rcx, qword [rbp - 0x20]
add rcx, rsi
test rax, rax
je 0x14014f99e
mov rdx, qword [rbp - 8]
call fcn.1401d1c80
test al, al
je 0x14014f9b0
mov rax, qword [rbp - 0x20]
add rax, rsi
add rax, 0x20
mov qword [rbp - 0x18], rax
mov rbx, qword [rbp - 8]
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14014fa71
lea rcx, [rbx + 0x10]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
call qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x14014fa90
xor eax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x14014fa63
jmp 0x14014fa71
lea r8, str.C:UsersAdministrator.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rdx, qword [rbp - 0x28]
call fcn.140217c20
ud2