joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110d2
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001ae60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1404a20f4]
call fcn.140011893
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001aeb7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001afc3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001af5c
cmp qword [rbp + 0x28], 0
jle 0x14001af5c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001aefc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011811
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001afb2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001afb2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14001b0b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1404a22a4]
call fcn.140011893
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x68], rax
movzx eax, word [rbp + 0x160]
mov r8, qword [rbp + 0x168]
mov edx, eax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14001b154
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14001b154
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14001b154
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rbp + 0x170]
mov dword [rcx], eax
mov rax, qword [rbp + 0x48]
jmp 0x14001b163
mov rax, qword [rbp + 0x170]
mov dword [rax], 0
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400114c4
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e050
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400115f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001eb80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001eba0
xor al, al
jmp 0x14001ec21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001ebb3
xor al, al
jmp 0x14001ec21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001ebdd
xor al, al
jmp 0x14001ec21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ebf1
xor al, al
jmp 0x14001ec21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ec03
xor al, al
jmp 0x14001ec21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ec1f
xor al, al
jmp 0x14001ec21
mov al, 1
add rsp, 0x38
ret
Function at 0x14001187a
Capabilities:
Write file on windows

Disassembly:
jmp 0x140016d00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14049b0d8]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1404a20f4]
call fcn.140011893
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140016d66
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140016d6d
mov al, 1
jmp 0x140016ec7
call fcn.140011249
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011249
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.14001173f
movzx eax, al
test eax, eax
je 0x140016dc8
xor al, al
jmp 0x140016ec7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140016e2d
cmp dword [rbp + 0x194], 1
je 0x140016e38
cmp dword [rbp + 0x194], 3
je 0x140016eb6
jmp 0x140016ec5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140016e88
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140016e88
xor al, al
jmp 0x140016ec7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140016ea3
mov dword [rbp + 0x194], 1
jmp 0x140016ead
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140016ec7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140016ec7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140026730]
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.140011406
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x402200
Capabilities:
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x402251
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x4022ac
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x005721d0]
test rax, rax
je 0x402303
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x402318
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x40232c
xor ebx, 0x80000000
je 0x402251
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x4022d8
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x40237e
mov rcx, rax
mov qword [0x00572170], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x40237e
mov dword [rax], ebx
mov rcx, qword [0x00572170]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
jmp 0x402342
call fcn.004e6d90
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x402285
lea r8, [0x005394a8]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.0045e970
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, qword [rdi + 0x30]
mov rcx, rax
xor rcx, 0xfffffffffffffeff
and rax, 0xfffffffffffffeff
lea rax, [rcx + rax*2]
inc rax
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.0045bd12
mov ecx, 4
mov edx, 4
call fcn.00404d20
ud2
Function at 0x40b400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov ecx, dword [0x004fe200]
test ecx, ecx
je 0x40b5bc
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x40b43b
mov rdi, rax
mov rax, qword [rax]
add rdi, 8
test rax, rax
cmove rdi, rax
jne 0x40b5fd
mov ecx, dword [0x004fe200]
test ecx, ecx
je 0x40b5de
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x40b5fb
mov rdi, rax
test rax, rax
jne 0x40b4fa
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x40b48a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x40b61a
mov rcx, rax
mov qword [0x00572170], rax
mov r8d, 0x58
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x40b61a
mov rdi, rax
mov qword [rax], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmm2, xmmword [rsp + 0x40]
movups xmm3, xmmword [rsp + 0x50]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
movups xmmword [rax + 0x38], xmm3
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x48], rax
lea rax, [0x004fe1e8]
mov qword [rdi + 0x50], rax
mov ecx, dword [0x004fe200]
test ecx, ecx
je 0x40b607
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x40b51b
lea rcx, [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
lea rax, [0x00537a90]
cmovne rax, rcx
jmp 0x40b522
lea rax, [0x00537a90]
mov rcx, qword [rax + 0x40]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdi + 0x10]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x18]
mov qword [rdi], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
movups xmmword [rdi + 0x28], xmm2
movups xmmword [rdi + 0x38], xmm3
mov rdx, qword [rsp + 0x60]
mov qword [rdi + 0x48], rdx
je 0x40b5b6
cmp rax, 2
je 0x40b5b6
lock dec qword [rcx]
sete dl
test rax, rax
je 0x40b5ad
test dl, dl
je 0x40b5b6
call fcn.00407db0
jmp 0x40b5b6
test dl, dl
je 0x40b5b6
call fcn.00408ee0
add rdi, 8
jmp 0x40b5fd
lea rcx, [0x004fe1e8]
call fcn.004d6970
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x40b424
jmp 0x40b43b
lea rcx, [0x004fe1e8]
call fcn.004d6970
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x40b45a
xor edi, edi
mov rax, rdi
add rsp, 0x68
pop rdi
pop rsi
ret
lea rcx, [0x004fe1e8]
call fcn.004d6970
mov ecx, eax
jmp 0x40b4f2
mov ecx, 0x58
mov edx, 8
call fcn.00404d20
ud2
Function at 0x41ed20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x41ed64
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x41ed6c
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x41ed7d
jmp 0x41ed94
xor r10d, r10d
jmp 0x41ee42
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x41ed94
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x41edab
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
mov r9d, r11d
and r9d, 0x37
mov edi, r11d
and edi, 8
mov ecx, r11d
or ecx, 8
imul ecx, edi
xor edi, 8
imul edi, r9d
add ecx, edi
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x41ede2
add r11, r8
jmp 0x41ef36
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
mov rbx, rcx
and rbx, r11
add r11, rcx
add rbx, rbx
sub r11, rbx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x41eece
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop word cs:[rax + rax]
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
xor rsi, rcx
rol rcx, 0x20
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
mov r14, rcx
and r14, rdi
add rdi, rcx
add r9, rsi
rol rsi, 0x11
add r14, r14
xor rsi, r9
rol r9, 0x20
sub rdi, r14
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x41ee70
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x41eeec
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x41eefe
jmp 0x41ef18
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x41ef18
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x41ef32
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x421450
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x421460
test al, 1
je 0x42154f
test al, 2
jne 0x421569
test al, 8
jne 0x4214be
mov rbx, qword [rsi + 0x28]
xor edi, edi
xor ecx, ecx
call fcn.004ed810
test rax, rax
je 0x42149c
mov rdi, qword [rax + 0x30]
mov qword [rax + 0x30], rbx
lea rcx, [rsi + 0x30]
call fcn.00413590
mov dword [rsi + 0x30], 2
xor ecx, ecx
call fcn.004ed810
test rax, rax
je 0x4214dc
mov qword [rax + 0x30], rdi
jmp 0x4214dc
test al, 0x10
je 0x4214dc
mov rax, qword [rsi + 0x398]
test rax, rax
je 0x4215e7
mov rcx, qword [rsi + 0x390]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x3a0]
test rcx, rcx
je 0x421504
mov rax, qword [rsi + 0x3a8]
xor edx, edx
sub rdx, qword [rax + 0x10]
and rdx, 0xfffffffffffffff0
sub rcx, rdx
lea rdx, [rsp + 0x28]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.004ed0e5
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x421583
jne 0x421543
mov rcx, rsi
call fcn.00420930
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x00537778]
mov edx, 0x23
call fcn.0042fe50
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x005377b8]
mov edx, 0x25
call fcn.0042fe50
ud2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.00430cd0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
lea rdx, [0x00537800]
jmp 0x421621
lea rax, str.waker_missing
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x28], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.40.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.0042fe10
ud2
Function at 0x4217c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x4217d0
test al, 1
je 0x4218bf
test al, 2
jne 0x4218d9
test al, 8
jne 0x42182e
mov rbx, qword [rsi + 0x28]
xor edi, edi
xor ecx, ecx
call fcn.004ed810
test rax, rax
je 0x42180c
mov rdi, qword [rax + 0x30]
mov qword [rax + 0x30], rbx
lea rcx, [rsi + 0x30]
call fcn.00413590
mov dword [rsi + 0x30], 2
xor ecx, ecx
call fcn.004ed810
test rax, rax
je 0x42184c
mov qword [rax + 0x30], rdi
jmp 0x42184c
test al, 0x10
je 0x42184c
mov rax, qword [rsi + 0x398]
test rax, rax
je 0x421957
mov rcx, qword [rsi + 0x390]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x3a0]
test rcx, rcx
je 0x421874
mov rax, qword [rsi + 0x3a8]
xor edx, edx
sub rdx, qword [rax + 0x10]
and rdx, 0xfffffffffffffff0
sub rcx, rdx
lea rdx, [rsp + 0x28]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.004ec9d2
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x4218f3
jne 0x4218b3
mov rcx, rsi
call fcn.00421210
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x00537778]
mov edx, 0x23
call fcn.0042fe50
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x005377b8]
mov edx, 0x25
call fcn.0042fe50
ud2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.00430cd0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
lea rdx, [0x00537800]
jmp 0x421991
lea rax, str.waker_missing
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x28], 0
lea rax, str.ntdll.dll
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.40.0_src_runtime_task_core.rs
lea rcx, [rsp + 0x28]
call fcn.0042fe10
ud2
Function at 0x4227d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x422844
mov rax, rdi
or rax, 4
mov ebx, edi
and ebx, 4
imul rax, rbx
mov rcx, rdi
and rcx, 0xfffffffffffffffb
xor rbx, 4
imul rbx, rcx
add rbx, rax
je 0x42285f
mov rcx, qword [0x00572170]
test rcx, rcx
jne 0x422826
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x422835
mov rcx, rax
mov qword [0x00572170], rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapAlloc
test rax, rax
jne 0x422864
mov edx, 2
mov rcx, rbx
call fcn.00404d20
ud2
mov qword [rsi], rdi
mov qword [rsi + 8], 2
mov qword [rsi + 0x10], 0
add rsi, 0x10
xor ecx, ecx
jmp 0x4228ba
mov eax, 2
mov qword [rsi], rdi
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov ecx, 1
cmp rdi, 2
jb 0x4228b0
mov edx, 1
nop word cs:[rax + rax]
mov r8, rdx
xor r8, 1
and edx, 1
lea rdx, [r8 + rdx*2]
mov dword [rax], 0xffff
add rax, 4
inc rcx
cmp rdx, rdi
jb 0x422890
add rsi, 0x10
mov dword [rax], 0xffff
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x431040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x4310d0
cmp r10, r11
jb 0x431146
cmp r10, rdx
ja 0x43115a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x4310d2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x4310b0
jmp 0x431134
ja 0x4310da
mov r11, r10
cmp rax, r8
jne 0x431074
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x431110
mov rdi, r8
sub ecx, edx
jns 0x43112b
jmp 0x431136
cmp r8, rsi
je 0x43116b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x431136
xor al, 1
cmp rdi, rsi
jne 0x4310f0
jmp 0x431136
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r11
mov rdx, r10
call fcn.00431cd0
ud2
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r10
call fcn.004312c0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.library_core_src_unicode_printable.rs
mov edx, 0x2b
call fcn.0042fe50
ud2

Function at 0x43e3f9
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x43e41f
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x43e409
mov qword [rcx], rax
ret

Function at 0x43e423
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x18]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.0043e3ce
test rbx, rbx
je 0x43e45c
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.0043e3f9
mov cl, byte [rdi]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.0043e3f1