joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006e6c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400a60a0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14006e755
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x14006e7b6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140048fe0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140081890
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x14006e871
sub ecx, 1
je 0x14006e8e4
sub ecx, 1
je 0x14006e820
cmp ecx, 1
je 0x14006e803
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14008fbb0]
call fcn.140048fe0
jmp 0x14006e8e4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.14006e3f0
test eax, eax
je 0x14006e8e4
jmp 0x14006e78a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14006e8e4
sub rax, rsi
cmp rax, rbp
jae 0x14006e8e4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140049160
jmp 0x14006e8e4
cmp r8d, 4
jle 0x14006e8e4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x14006e8e4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140048f00
mov esi, eax
test eax, eax
je 0x14006e8c3
mov edx, 5
mov rcx, rbx
call fcn.14006f3b0
mov eax, esi
jmp 0x14006e78a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400577e0
mov rcx, r14
call fcn.140057ac0
test eax, eax
je 0x14006e788
mov edx, 5
mov rcx, rbx
call fcn.14006f3b0
mov eax, Ordinal_46
jmp 0x14006e78a
Function at 0x140081680
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.b_b_]
mov rdi, rax
test rax, rax
jne 0x1400816c2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140081709
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140081762
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140081720
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400817a3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14009533a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14009533b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140081770
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400827c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140082812
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140082812
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140082812
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140082812
cmp dword [rcx + 0x84], 0xe
jbe 0x140082812
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140082814
xor al, al
add rsp, 0x28
ret
Function at 0x1400110a5
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011c00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14001e0b8]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400240a3]
call fcn.1400113e8
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011cb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAllocEx_Failed_With_Error_:__d__n
call fcn.1400111c7
xor eax, eax
jmp 0x140011e0e
mov rdx, qword [rbp + 8]
lea rcx, str._i__Allocated_Memory_At_:_0x_p__n
call fcn.1400111c7
lea rcx, str.___Press__Enter__To_Write_Payload_...
call fcn.1400111c7
call qword [sym.imp.ucrtbased.dll_getchar]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x150]
mov r8, qword [rbp + 0x148]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011d0f
mov rax, qword [rbp + 0x150]
cmp qword [rbp + 0x28], rax
je 0x140011d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_With_Error_:__d__n
call fcn.1400111c7
xor eax, eax
jmp 0x140011e0e
mov rdx, qword [rbp + 0x28]
lea rcx, str._i__Successfully_Written__d_Bytes_n
call fcn.1400111c7
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call fcn.14001131b
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x150]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140011d92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtectEx_Failed_With_Error_:__d__n
call fcn.1400111c7
xor eax, eax
jmp 0x140011e0e
lea rcx, str.___Press__Enter__To_Run_...
call fcn.1400111c7
call qword [sym.imp.ucrtbased.dll_getchar]
lea rcx, str._i__Executing_Payload_...
call fcn.1400111c7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140011dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_Failed_With_Error_:__d__n
call fcn.1400111c7
xor eax, eax
jmp 0x140011e0e
lea rcx, str.___DONE___n
call fcn.1400111c7
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001b1f0]
call fcn.140011370
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111ea
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400127d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014f80
xor al, al
jmp 0x140015001
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014f93
xor al, al
jmp 0x140015001
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014fbd
xor al, al
jmp 0x140015001
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014fd1
xor al, al
jmp 0x140015001
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014fe3
xor al, al
jmp 0x140015001
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014fff
xor al, al
jmp 0x140015001
mov al, 1
add rsp, 0x38
ret
Function at 0x14000a0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000a180
cmp r11, r10
ja 0x14000a1f6
cmp r10, rdx
ja 0x14000a20a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000a182
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000a160
jmp 0x14000a1e4
ja 0x14000a18a
mov r11, r10
cmp rax, r8
jne 0x14000a124
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000a1c0
mov rdi, r8
sub ecx, edx
jns 0x14000a1db
jmp 0x14000a1e6
cmp r8, rsi
je 0x14000a21b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000a1e6
xor al, 1
cmp rdi, rsi
jne 0x14000a1a0
jmp 0x14000a1e6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400055e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140004b30
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_a28077b28a02b92985b3a3faecf92813155f1ea1library_alloc_srccollections_btree_navigate.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140004ed0
ud2
Function at 0x14000beb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14000c0cd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401411e0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14000bf20
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1401411f0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14000c04a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x14000c020
movdqa xmm1, xmmword [0x1401411f0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140141200], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14000c0eb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14000c110
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14000d900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140140018]
test ecx, ecx
je 0x14000da33
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14000d939
mov rdi, rax
mov rax, qword [rax + 8]
add rdi, 0x10
test rax, rax
cmove rdi, rax
jne 0x14000da74
mov ecx, dword [0x140140018]
test ecx, ecx
je 0x14000da55
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14000da72
mov rsi, rax
test rax, rax
jne 0x14000d9ce
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x14000d98b
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000dab5
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000dab5
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140140018]
test ecx, ecx
je 0x14000da88
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [0x1401e6030]
cmp rax, 3
jne 0x14000da7e
call fcn.14000d450
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
je 0x14000da74
mov rax, qword [rcx + 0x820]
test rax, rax
je 0x14000da9b
lea r8, [rax - 1]
mov rdx, qword [rcx + 0x818]
mov qword [rcx + 0x820], r8
cmp rax, 1
jne 0x14000da74
test rdx, rdx
jne 0x14000da74
call fcn.14000ca80
jmp 0x14000da74
lea rcx, section..data
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14000d921
jmp 0x14000d939
lea rcx, section..data
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14000d958
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
call fcn.14000d5e0
jmp 0x14000d9df
lea rcx, section..data
call fcn.14008c7e0
mov ecx, eax
jmp 0x14000d9c6
lea rcx, [0x14014d870]
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_crossbeam_epoch_0.9.18_src_internal.rs
mov edx, 0x21
call fcn.140004ed0
ud2
mov ecx, 8
mov edx, 0x18
call fcn.140002ac0
ud2
Function at 0x140025880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140140038]
test ecx, ecx
je 0x1400258b3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400258cc
mov rcx, qword [rax + 8]
add rax, 0x10
test rcx, rcx
cmove rax, rcx
je 0x1400258cc
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140020]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14002589c
mov ecx, dword [0x140140038]
test ecx, ecx
je 0x140025985
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400259a2
mov rsi, rax
test rax, rax
jne 0x14002595d
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x14002591e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400259ba
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x28
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400259ba
mov rsi, rax
lea rax, [0x140140020]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140140038]
test ecx, ecx
je 0x1400259aa
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov word [rsi + 0x18], 0
mov qword [rsi + 0x20], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140020]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400258eb
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140020]
call fcn.14008c7e0
mov ecx, eax
jmp 0x140025955
mov ecx, 8
mov edx, 0x28
call fcn.140002ac0
ud2

Function at 0x1400269e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140140148]
test ecx, ecx
je 0x140026a13
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140026a2c
mov rcx, qword [rax + 8]
add rax, 0x10
test rcx, rcx
cmove rax, rcx
je 0x140026a2c
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140130]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400269fc
mov ecx, dword [0x140140148]
test ecx, ecx
je 0x140026ad3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140026af0
mov rsi, rax
test rax, rax
jne 0x140026ab9
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x140026a7e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140026b08
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140026b08
mov rsi, rax
lea rax, [0x140140130]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140140148]
test ecx, ecx
je 0x140026af8
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rsi + 0x10]
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140130]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140026a4b
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140130]
call fcn.14008c7e0
mov ecx, eax
jmp 0x140026ab1
mov ecx, 8
mov edx, 0x18
call fcn.140002ac0
ud2
Function at 0x1400279f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov al, 1
test rdx, rdx
je 0x140027afe
movzx r9d, byte [rcx]
mov r10, qword [r8]
movzx r10d, byte [r10]
not r10b
test r9b, r10b
jne 0x140027afe
mov r10, qword [r8 + 0x10]
test r10, r10
je 0x140027b06
mov r8, qword [r8 + 8]
xor byte [r8], r9b
mov r11d, 1
cmp r10, 1
je 0x140027af8
lea rbx, [rdx - 1]
lea rdi, [r10 - 2]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [r8 + 1]
inc rsi
cmp rsi, 0x10
jbe 0x140027ace
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x140027a80
add rdi, r8
add rdi, 2
lea rbx, [rcx + 1]
cmp rbx, rdi
jb 0x140027ace
mov r11d, esi
and r11d, 0xf
mov ebx, 0x10
cmovne rbx, r11
mov rdi, rsi
sub rdi, rbx
neg rbx
lea r11, [rsi + rbx]
inc r11
lea rsi, [r9 + rdi]
xor ebx, ebx
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + rbx + 1]
movups xmm1, xmmword [r9 + rbx]
xorps xmm1, xmm0
movups xmmword [r9 + rbx], xmm1
add rbx, 0x10
cmp rdi, rbx
jne 0x140027ab0
mov r9, rsi
add r8, r10
nop word cs:[rax + rax]
cmp rdx, r11
je 0x140027afe
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, r8
jne 0x140027ae0
cmp r11, rdx
setne al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x140160008]
xor ecx, ecx
xor edx, edx
call fcn.140004230
ud2
Function at 0x14002bd00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x14002bedd
mov rsi, r8
mov rax, r8
shr rax, 0x3a
jne 0x14002be8f
test rsi, rsi
jne 0x14002bd47
lea r8, [0x1401605f0]
xor ecx, ecx
xor edx, edx
call fcn.140004230
ud2
mov rdi, rdx
mov rbx, rsi
shl rbx, 6
mov r14, qword [rcx]
xor eax, eax
cmp rsi, 4
jb 0x14002bdb2
mov rdx, rdi
sub rdx, r14
cmp rdx, 0x20
jb 0x14002bdb2
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r14 + rdx*8]
movdqu xmm2, xmmword [r14 + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x14002bd80
cmp rax, rsi
je 0x14002be2e
mov r8, rax
not r8
add r8, rsi
mov r9, rsi
and r9, 3
je 0x14002be80
nop dword [rax + rax]
lea rdx, [rax + 1]
mov r10, qword [r14 + rax*8]
not r10
mov qword [rdi + rax*8], r10
mov rax, rdx
dec r9
jne 0x14002bdd0
cmp r8, 3
jb 0x14002be2e
nop dword [rax]
mov rax, qword [r14 + rdx*8]
not rax
mov qword [rdi + rdx*8], rax
mov rax, qword [r14 + rdx*8 + 8]
not rax
mov qword [rdi + rdx*8 + 8], rax
mov rax, qword [r14 + rdx*8 + 0x10]
not rax
mov qword [rdi + rdx*8 + 0x10], rax
mov rax, qword [r14 + rdx*8 + 0x18]
not rax
mov qword [rdi + rdx*8 + 0x18], rax
lea rax, [rdx + 4]
mov rdx, rax
cmp rsi, rax
jne 0x14002bdf0
or byte [rdi], 1
sub rbx, qword [rcx + 0x20]
jb 0x14002bea9
je 0x14002be76
cmp rbx, 0x40
jae 0x14002bec3
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, ebx
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp rbx, 1
adc rbx, 0
nop dword [rax]
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9, rsi
call fcn.14012c960
dec rbx
jne 0x14002be60
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdx, rax
cmp r8, 3
jae 0x14002bdf0
jmp 0x14002be2e
lea rcx, [0x1401606c0]
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_arithmetic_bigint_modulus.rs_b
mov edx, 0x21
call fcn.140004ed0
ud2
lea rcx, [0x140160700]
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_arithmetic_bigint_modulus.rs_b
mov edx, 0x21
call fcn.140004ed0
ud2
lea rcx, [0x140160740]
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_arithmetic_bigint_modulus.rs_b
mov edx, 0x24
call fcn.140004ed0
ud2
mov qword [rsp + 0x38], 0
lea r9, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_arithmetic_bigint_modulus.rs_b
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.140038920
ud2