joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005ce7c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180049c30
sub rsp, rax
mov rax, qword [0x180087100]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1800571fc
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18005cecb
mov rax, rbp
jmp 0x18005cfd3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xd7df0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18005e89c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xd7df0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18005cfcf
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005cfcf
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18005e89c
test rax, rax
js 0x18005cfcf
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18005cfcf
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18005cfc1
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18005cfc1
cmp byte [rcx], 0xd
jne 0x18005cfa7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18005cfb6
cmp byte [rcx + 1], 0xa
jne 0x18005cfb6
inc rcx
jmp 0x18005cfb6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x87530]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18005cf89
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18005cfd3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180049b80
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005dc3c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800d7df0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18005dc93
cmp word [rdx], r13w
jne 0x18005dc93
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18005dc98
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18005ddbd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18005ddde
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18005dcd1
mov rdx, r9
mov word [rbx], cx
jmp 0x18005dcf8
cmp r9, r8
jae 0x18005dd08
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18005dcb2
jmp 0x18005ddbd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005ddb2
cmp dword [rsp + 0x80], esi
je 0x18005ddb2
lea r8, [0x1800d7df0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18005dd8a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18005dd5a
mov word [rbx], r13w
jmp 0x18005ddba
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18005dd67
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18005ddba
cmp word [rsp + 0x70], r13w
jne 0x18005dd97
cmp rbx, r14
je 0x18005dd54
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18005e8a4
cmp word [rsp + 0x70], r13w
je 0x18005ddbd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800d7df0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18005ddb7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18005ddbd
Function at 0x180061b9c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180061bcc
xor eax, eax
jmp 0x180061c8f
mov rbp, rbx
cmp word [rax], si
je 0x180061bf1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180061bd8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180061bd4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800602b4
movsxd r14, eax
test eax, eax
jne 0x180061c2f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180061bc5
mov rcx, r14
call fcn.18005b658
mov rdi, rax
test rax, rax
jne 0x180061c48
xor ecx, ecx
call fcn.18005a4d4
jmp 0x180061c24
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800602b4
test eax, eax
jne 0x180061c79
mov rcx, rdi
call fcn.18005a4d4
jmp 0x180061c83
xor ecx, ecx
call fcn.18005a4d4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180064a04
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180057820
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180064aa5
cmp ebx, dword [rsp + 0x30]
je 0x180064a9e
test esi, esi
je 0x180064a9e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180064a79
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180064a86
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180064a63
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180064a8a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180064aa7
mov eax, 1
jmp 0x180064aa7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180069438
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18005e8a4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18005e8a4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180069588
cmp rax, 0xffffffffffffffff
je 0x180069588
xor edi, edi
test rbp, rbp
jle 0x180069533
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180059674
mov rbx, rax
test rax, rax
jne 0x1800694c0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180069529
mov edx, 0x8000
mov ecx, r14d
call fcn.1800692bc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18005a1cc
cmp eax, 0xffffffff
je 0x180069509
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800694d0
mov edx, r15d
mov ecx, r14d
call fcn.1800692bc
jmp 0x180069529
cmp byte [rsi + 0x38], dil
je 0x180069520
cmp dword [rsi + 0x34], 5
jne 0x180069520
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180069529
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18005a4d4
jmp 0x18006959c
jns 0x18006959c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18005e8a4
cmp rax, 0xffffffffffffffff
jne 0x180069554
cmp byte [rsi + 0x30], dil
je 0x18006959c
mov edi, dword [rsi + 0x2c]
jmp 0x18006959c
mov ecx, r14d
call fcn.180062358
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18006959c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18006959c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180069595
mov eax, dword [rsi + 0x2c]
jmp 0x18006959a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18005e8a4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180069dc0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180069de8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180069de8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400034ad
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x1400039b0
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp fcn.14013738f
Function at 0x1400166fc
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
mov eax, dword [rdx + 0x10]
mov rsi, qword [rdx + 8]
lea rcx, [rsp + 0x50]
mov dword [rcx], eax
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rcx + 8], rsi
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov qword [rbx], rcx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rcx
mov rcx, qword [rdi]
mov rdx, rsi
call fcn.14006f3b3
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140016784
Capabilities:
Encrypt data using dpapi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x448
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x10]
cmp r14, 0xf
jae 0x1400167b7
mov rcx, rdi
mov rdx, rsi
add rsp, 0x448
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400166fc
mov rbx, r8
mov rcx, r9
call fcn.140002e40
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.140014e82
mov rbx, qword [rsi + 8]
lea r9, str.src_browser_crypto.rs
mov r8d, 0xf
mov rcx, rbx
mov rdx, r14
call fcn.140012be6
lea r8, [rbx + 3]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov r9, rax
call fcn.140003348
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x48], rax
jne 0x14001683d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1400166fc
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov al, byte [0x14022f258]
jmp 0x140016869
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rdi + 0x10], rax
movups xmmword [rdi], xmm0
mov al, byte [0x14022f258]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.14006f3b3
nop
add rsp, 0x448
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140032d4c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14003c740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14003c7c0
cmp r11, r10
ja 0x14003c837
cmp r10, rdx
ja 0x14003c849
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14003c7c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14003c7a0
jmp 0x14003c824
ja 0x14003c7ca
mov r11, r10
cmp rax, r8
jne 0x14003c76e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14003c800
mov rdi, r8
sub ecx, edx
jns 0x14003c81b
jmp 0x14003c826
cmp r8, rsi
je 0x14003c858
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14003c826
xor al, 1
cmp rdi, rsi
jne 0x14003c7e0
jmp 0x14003c826
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14003a410
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140036a50
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14003a940
int3
Function at 0x140041e12
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x140243198]
mov ebx, 0xff
lea rsi, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.4.2_src_baseline.rs
cmp r9, 0x40
jb 0x140041f42
mov r14d, 4
sub r14, 1
jb 0x140041e37
cmp r9, 0xf
jbe 0x140041f6f
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.140042455
mov r9, rdx
mov ecx, ebp
jmp 0x140041e47
xor edx, edx
cmp r9, rdx
je 0x140041f60
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140041f44
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.4.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.140036180
int3
Function at 0x140042532
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140042553
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401381ac
mov rcx, rax
call fcn.1400dba40
mov ecx, eax
jmp 0x140042546

Function at 0x140042ffc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14022f070]
test ecx, ecx
je 0x140043015
dec ecx
add rsp, 0x28
jmp fcn.1401381a4
lea rcx, [0x14022f058]
call fcn.1400dba40
mov ecx, eax
jmp 0x14004300c

Function at 0x14004346a
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
call fcn.14004353a
cmp rax, 1
jbe 0x14004348a
mov rsi, rax
add rsi, 8
jmp 0x14004350d
je 0x14004350b
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
mov rcx, rsi
call sub.bcryptprimitives.dll_ProcessPrng
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov ecx, 8
mov edx, 0x18
call fcn.1400d676b
test rax, rax
je 0x14004352a
mov rsi, rax
mov rbx, rax
lea rax, [0x14022f1e0]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
call fcn.14004353a
mov rdi, rax
mov ecx, dword [0x14022f1f8]
test ecx, ecx
je 0x14004351a
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.1401381ac
test rdi, rdi
je 0x14004350d
mov edx, 8
mov rcx, rdi
call fcn.1400436f0
jmp 0x14004350d
xor esi, esi
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14022f1e0]
call fcn.1400dba40
mov ecx, eax
jmp 0x1400434eb
mov ecx, 8
mov edx, 0x18
call fcn.140032df0
int3
jmp 0x14004346a

Function at 0x14004353a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14022f1f8]
test ecx, ecx
je 0x140043553
dec ecx
add rsp, 0x28
jmp fcn.1401381a4
lea rcx, [0x14022f1e0]
call fcn.1400dba40
mov ecx, eax
jmp 0x14004354a

Function at 0x14004db8c
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14004dbd7
test rbx, rbx
je 0x14004dbc5
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14004dc02
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14004dbfa

Function at 0x14004dc02
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14004dc28
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14004dc12
mov qword [rcx], rax
ret
Function at 0x14005d5f7
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
call fcn.14004353a
cmp rax, 1
jbe 0x14005d617
mov rsi, rax
add rsi, 8
jmp 0x14005d68d
je 0x14005d68b
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
mov rcx, rsi
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsi]
mov ecx, 0x18
mov edx, 8
call fcn.14011dfe2
mov rsi, rax
mov rbx, rax
lea rax, [0x14022f1e0]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
call fcn.14004353a
mov rdi, rax
mov ecx, dword [0x14022f1f8]
test ecx, ecx
je 0x14005d69d
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.1401381ac
test rdi, rdi
je 0x14005d68d
mov edx, 8
mov rcx, rdi
call fcn.1400436f0
jmp 0x14005d68d
xor esi, esi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14022f1e0]
call fcn.1400dba40
mov ecx, eax
jmp 0x14005d66b
Function at 0x140074f65
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14022f028]
test ecx, ecx
je 0x140074f7e
dec ecx
add rsp, 0x28
jmp fcn.1401381a4
lea rcx, str.cL_a_
call fcn.1400dba40
mov ecx, eax
jmp 0x140074f75

Function at 0x140074f8e
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov r14, qword [0x140320060]
test r14, r14
jne 0x1400750b5
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140074ff5
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074ff5
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074ff5
mov r15, rax
xor ebx, ebx
jmp 0x140075076
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1400750c9
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400750c9
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400750c9
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400750c9
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400750c9
mov r15, qword [rsp + 0x20]
mov ecx, 0x18
call fcn.1400d6beb
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x140320060], r14
je 0x1400750b5
mov rdi, rax
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
call fcn.140075124
mov rcx, r14
call fcn.14004ebfd
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._home_ellie_.cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.10_src_thread_parker_windows_mod.rs
call fcn.1400360d0
mov rsi, rax
mov rcx, r14
call fcn.14004ebfd
jmp 0x140075116
mov rcx, rsi
call fcn.1401386b0
call fcn.14003ad80
int3