joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065890
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14006a150
sub rsp, rax
mov rax, qword [0x1400aa3c0]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140065952
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140079124
cmp rax, 1
jne 0x1400659ae
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14006592f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140065923
cmp rcx, 1
jb 0x1400659ae
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400658f0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140065983
lea rcx, [rsp + 0x80]
call fcn.14007bba0
jmp 0x140065985
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140069e80
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14006d640
int3
Function at 0x140066800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400add8e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140066885
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400adbe0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x1400adbe0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x1400adbe0], rdx
call fcn.140064750
cmp eax, ebx
jne 0x1400669ed
mov byte [0x1400add8e], 1
lea rdx, [0x14008a598]
mov rcx, rsi
call fcn.140078bd0
test eax, eax
je 0x140066910
cmp byte [0x1400add8d], 1
je 0x140066910
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeae0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeae8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeaf0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeaf8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeb00], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeb08], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeb10], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400aeb18], rax
mov byte [0x1400add8d], 1
mov r8, qword [0x1400adbe0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140066937
inc rax
test cl, cl
jne 0x140066920
mov ecx, r9d
jmp 0x14006693c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140066943
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1400669a8
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140066985
inc rax
test cl, cl
jne 0x140066970
mov ecx, r9d
jmp 0x14006698a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140066991
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140066960
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1400669d8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140062d20
add rdi, 8
sub rbx, 1
jne 0x1400669c0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1400758e4
call fcn.14006d640
int3
Function at 0x140069a30
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1400aa3c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140069ae1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140079124
cmp rax, 1
jne 0x140069b17
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x140069abd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140069ab0
cmp rcx, 1
jb 0x140069b17
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140069a80
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140069e80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14006d640
int3

Function at 0x140069d00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400aa3c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x140069daf
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140079124
cmp rax, 1
jne 0x140069de5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140069d8c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140069d80
cmp rcx, 1
jb 0x140069de5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140069d50
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140069e80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14006d640
int3

Function at 0x14006a8e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006a932
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006a932
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006a932
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006a932
cmp dword [rcx + 0x84], 0xe
jbe 0x14006a932
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006a934
xor al, al
add rsp, 0x28
ret
Function at 0x14006ecb4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006ed23
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006ed23
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ed23
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006ed23
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006ed23
cmp dword [rcx + 0x84], 0xe
jbe 0x14006ed23
cmp dword [rcx + 0xf8], 0
je 0x14006ed23
mov ecx, ebx
call fcn.14006edd4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14006ebb0
nop
cmp dword [rbp + 0x20], 0
je 0x14006ed71
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14006ed7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14006ecb4

Function at 0x14006eeb8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006ed23
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006ed23
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ed23
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006ed23
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006ed23
cmp dword [rcx + 0x84], 0xe
jbe 0x14006ed23
cmp dword [rcx + 0xf8], 0
je 0x14006ed23
mov ecx, ebx
call fcn.14006edd4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14006ebb0
nop
cmp dword [rbp + 0x20], 0
je 0x14006ed71
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14006ed7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14006ecb4
Function at 0x140080a10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140080a97
mov rsi, rbx
cmp word [rax], bp
je 0x140080a56
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140080a40
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140080a3c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14007c078
mov rdi, rax
test rax, rax
je 0x140080a84
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400866d0
mov rbp, rdi
xor ecx, ecx
call fcn.14007cbc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140082d40
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140082d56
mov al, 1
jmp 0x140082db6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140082d67
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140082db4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140080d58
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140082db4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140082db4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140082db4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140082db6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140086520
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140086548
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140086548
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140006002
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14000b399
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, rdx
add rdx, 0x28
cmp qword [rax + 0x20], 0
je 0x14000b3df
cmp qword [rax + 0x58], 0xffffffffffffffff
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
je 0x14000b4c3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 0
jmp 0x14000b4d2
cmp byte [rax + 0x3a], 0
jne 0x14000b502
mov r10, qword [rax]
mov r9, qword [rax + 8]
mov r8, qword [rax + 0x28]
mov r14b, byte [rax + 0x38]
mov r11d, r14d
xor r11b, 1
test r8, r8
je 0x14000b41b
cmp r9, r8
jbe 0x14000b415
cmp byte [r10 + r8], 0xbf
jg 0x14000b41b
jmp 0x14000b512
jne 0x14000b512
cmp r8, r9
je 0x14000b4d9
mov bl, byte [r10 + r8]
movzx esi, bl
test sil, sil
jns 0x14000b47f
mov edi, esi
and edi, 0x1f
movzx ebp, byte [r10 + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x14000b471
movzx esi, byte [r10 + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x14000b47a
movzx ebx, byte [r10 + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
jmp 0x14000b47f
shl edi, 6
or edi, ebp
mov esi, edi
jmp 0x14000b47f
shl edi, 0xc
or esi, edi
test r14b, r14b
jne 0x14000b4e4
cmp esi, 0x110000
je 0x14000b4fa
mov edi, 1
cmp esi, 0x80
jb 0x14000b4b5
mov edi, 2
cmp esi, 0x800
jb 0x14000b4b5
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r8, rdi
mov qword [rdx], r8
mov r14d, r11d
jmp 0x14000b3fb
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x30], 1
call fcn.140005c0a
jmp 0x14000b507
mov byte [rax + 0x38], r11b
test r14b, r14b
jne 0x14000b4eb
jmp 0x14000b4fe
mov byte [rax + 0x38], r11b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x14000b504
mov byte [rax + 0x38], r11b
mov byte [rax + 0x3a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rax + 0x38], r11b
lea rax, str._rustc_9eb3afe9ebe9c7d2b84b71002d44f4a0edac95e0librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.1402a69f0
ud2
Function at 0x14000e713
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
mov qword [rcx + 8], rdx
xor eax, eax
lea rdx, [rsp + 0x40]
mov dword [rdx], eax
mov qword [rdx + 8], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
test eax, eax
je 0x14000e76d
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
mov byte [rsi], 0x1a
jmp 0x14000e778
call sub.kernel32.dll_GetLastError
mov byte [rsi], 0x14
mov dword [rsi + 4], eax
add rsp, 0x60
pop rsi
ret
Function at 0x14000ee37
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov r14, rcx
lea rdx, str.APPDATA
lea rsi, [rsp + 0x28]
mov r8d, 7
mov rcx, rsi
call fcn.14014ced0
cmp byte [rsi + 0x18], 3
jne 0x14000f040
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x70], xmm0
lea rax, [0x1402a8760]
lea rdx, [rsp + 0xc0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0xf0847322ba2f114
mov qword [rdx], rax
mov rdx, qword [rdx]
call fcn.140009572
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1402aefe8]
mov rbx, qword [rcx + rdx + 8]
xor rbx, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0xa8], rbx
add rcx, 8
cmp rcx, 0x10
jb 0x14000eed4
mov al, byte [rax + 0x18]
xor al, 0xce
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x18], al
lea rax, [rsp + 0x108]
mov qword [rax], rcx
mov qword [rax + 8], 0x19
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
lea rcx, [0x140006df0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x140037710]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov qword [rdx], 0
lea rax, [0x140371678]
mov qword [rdx + 0x10], rax
mov eax, 2
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rsi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x88]
call fcn.140030660
cmp qword [rdi], 0
je 0x14000ef8c
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r15
mov r8, rbx
xor r9d, r9d
call fcn.140151c10
cmp dword [rsi], 2
jne 0x14000efda
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 2
jmp 0x14000eff8
lea rax, [rsp + 0x28]
lea rsi, [rsp + 0xc0]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
cmp qword [rax], 2
jne 0x14000f009
lea rcx, [rsp + 0x30]
call fcn.14006467d
mov byte [r14 + 0x18], 2
jmp 0x14000f017
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1401674f0
test r12, r12
je 0x14000f02e
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
lea r8, [rsp + 0xc0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, str.src_firefox_firefox.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1403a0f2b]
lea r9, fcn.140004660
mov edx, 0x2b
call fcn.1402a68e0
ud2
Function at 0x1400183f8
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x70
xor esi, esi
lea rcx, [rsp + 0x68]
mov dword [rcx], esi
mov word [rcx + 4], 0x500
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [rsp + 0x5c], eax
test eax, eax
je 0x14001847a
mov rsi, qword [rsp + 0x60]
lea r8, [rsp + 0x5c]
xor ecx, ecx
mov rdx, rsi
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
jne 0x140018469
mov dword [rsp + 0x5c], 0
mov rcx, rsi
call sub.advapi32.dll_FreeSid
cmp dword [rsp + 0x5c], 0
setne sil
mov eax, esi
add rsp, 0x70
pop rsi
ret
Function at 0x14003dc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x14003dcb0
cmp r10, rax
jb 0x14003dd24
cmp r10, rdx
ja 0x14003dd38
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x14003dcb2
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x14003dc90
jmp 0x14003dd13
ja 0x14003dcba
mov rax, r10
cmp r11, r8
jne 0x14003dc62
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x14003dcf0
mov r15, rbx
sub ecx, edx
jns 0x14003dd0a
jmp 0x14003dd15
cmp rbx, r14
je 0x14003dd49
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x14003dd15
xor al, 1
cmp r15, r14
jne 0x14003dcd0
jmp 0x14003dd15
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.1402a67e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1402a6550
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.xO_
mov edx, 0x2b
call fcn.1402a6560
ud2
Function at 0x1400436fb
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
not ecx
cmp r8, 0x40
jb 0x140043836
add rdx, 0x10
xor r10d, r10d
lea r11, [0x1402be3a0]
mov r9d, 0xff
cmp r8, 0xf
jbe 0x140043868
movzx esi, byte [rdx - 1]
movzx eax, byte [rdx - 2]
mov eax, dword [r11 + rax*4 + 0x400]
xor eax, dword [r11 + rsi*4]
movzx esi, byte [rdx - 3]
xor eax, dword [r11 + rsi*4 + 0x800]
movzx esi, byte [rdx - 4]
xor eax, dword [r11 + rsi*4 + 0xc00]
movzx esi, byte [rdx - 5]
xor eax, dword [r11 + rsi*4 + 0x1000]
movzx esi, byte [rdx - 6]
xor eax, dword [r11 + rsi*4 + 0x1400]
movzx esi, byte [rdx - 7]
xor eax, dword [r11 + rsi*4 + 0x1800]
movzx esi, byte [rdx - 8]
xor eax, dword [r11 + rsi*4 + 0x1c00]
movzx esi, byte [rdx - 9]
xor eax, dword [r11 + rsi*4 + 0x2000]
movzx esi, byte [rdx - 0xa]
xor eax, dword [r11 + rsi*4 + 0x2400]
movzx esi, byte [rdx - 0xb]
xor eax, dword [r11 + rsi*4 + 0x2800]
movzx esi, byte [rdx - 0xc]
xor eax, dword [r11 + rsi*4 + 0x2c00]
movzx esi, byte [rdx - 0xd]
mov edi, ecx
shr edi, 0x18
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3000]
inc r10
movzx esi, byte [rdx - 0xe]
mov edi, ecx
shr edi, 0x10
and edi, r9d
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3400]
movzx esi, byte [rdx - 0xf]
mov edi, ecx
shr edi, 8
and edi, r9d
xor rdi, rsi
xor eax, dword [r11 + rdi*4 + 0x3800]
movzx esi, byte [rdx - 0x10]
and ecx, r9d
mov rdi, rcx
xor rdi, rsi
mov ecx, eax
xor ecx, dword [r11 + rdi*4 + 0x3c00]
lea rax, [r8 - 0x10]
cmp r10, 4
jne 0x140043826
cmp rax, 0x3f
jbe 0x140043832
xor r10d, r10d
add rdx, 0x10
mov r8, rax
jmp 0x140043721
add r8, 0xfffffffffffffff0
test r8, r8
je 0x14004385d
xor r10d, r10d
lea r9, [0x1402be3a0]
mov al, byte [rdx + r10]
xor al, cl
movzx eax, al
shr ecx, 8
xor ecx, dword [r9 + rax*4]
inc r10
cmp r8, r10
jne 0x140043845
not ecx
mov eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rax, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.3.2_src_baseline.rs_
mov ecx, 0xf
mov rdx, r8
mov r8, rax
call fcn.1402a64c0
ud2
Function at 0x140043881
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x140043a84
movdqu xmm4, xmmword [rdx]
movdqu xmm5, xmmword [rdx + 0x10]
movdqu xmm1, xmmword [rdx + 0x20]
movdqu xmm0, xmmword [rdx + 0x30]
not ecx
movd xmm3, ecx
pxor xmm3, xmm4
add r8, 0xffffffffffffffc0
add rdx, 0x40
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm8, xmmword [0x1402adbb0]
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm8, 0x11
movdqu xmm3, xmmword [rdx]
pxor xmm3, xmm6
pxor xmm3, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm9, xmmword [rdx + 0x30]
movdqa xmm2, xmm5
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm6
pclmulqdq xmm5, xmm8, 0x11
pxor xmm5, xmm2
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm7
pclmulqdq xmm1, xmm8, 0x11
pxor xmm1, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm9
pclmulqdq xmm0, xmm8, 0x11
pxor xmm0, xmm2
add r8, 0xffffffffffffffc0
add rdx, 0x40
cmp r8, 0x3f
ja 0x1400438e8
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmmword [0x1402adbc0]
pclmulqdq xmm3, xmm7, 0x11
pxor xmm6, xmm5
pxor xmm6, xmm3
movdqa xmm2, xmm6
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm6, xmm7, 0x11
pxor xmm2, xmm1
pxor xmm2, xmm6
movdqa xmm1, xmm2
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm2, xmm7, 0x11
pxor xmm1, xmm0
pxor xmm1, xmm2
cmp r8, 0x10
jb 0x140043a06
movdqu xmm0, xmmword [rdx]
add rdx, 0x10
add r8, 0xfffffffffffffff0
movdqa xmm2, xmm1
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm0
pclmulqdq xmm1, xmm7, 0x11
pxor xmm1, xmm2
cmp r8, 0xf
ja 0x1400439dc
movdqa xmm0, xmmword [0x1402adbc0]
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
pxor xmm0, xmm0
pxor xmm2, xmm2
movss xmm2, xmm1
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm1, 4
pxor xmm1, xmm3
xorps xmm2, xmm2
movss xmm2, xmm1
pclmulqdq xmm2, xmmword [0x1402adbd0], 0x10
pblendw xmm2, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm2, 0
pxor xmm0, xmm1
pextrd ecx, xmm0, 1
not ecx
test r8, r8
je 0x140043aa2
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400436fb
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret