joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f1c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rcx
movzx ecx, word [rdx + 0x18]
movzx r8d, byte [rdx + 0x1a]
shl r8d, 0x10
or r8d, ecx
cmp cl, 0x11
jne 0x1400f1cd7
mov rcx, qword [rdx + 8]
mov r9, rcx
shr r9, 0x20
jne 0x1400f1cfe
cmp ecx, 0x10000000
jae 0x1400f1cfe
mov rsi, rax
mov eax, dword [rdx + 0x10]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
and r8d, 0xffffff
shl r8, 0x20
or r8, rax
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x20]
call sym._ZN89__LT_der..asn1..generalized_time..GeneralizedTime_u20_as_u20_der..decode..DecodeValue_GT_12decode_value17hb3be75ba2914340
mov ecx, dword [rsp + 0x88]
cmp ecx, 2
jne 0x1400f1d27
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov ecx, dword [rsp + 0x38]
cmp byte [rsp + 0x3c], 0
mov rax, rsi
je 0x1400f1d79
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 1
add rsp, 0xc0
pop rsi
ret
mov edx, r8d
shr edx, 0x10
shr r8d, 8
mov dword [rax + 8], 0x1111
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], dl
mov byte [rax + 4], cl
mov byte [rax + 5], r8b
mov byte [rax + 6], dl
jmp 0x1400f1d18
mov dword [rax + 4], ecx
mov qword [rax + 8], 0xa
mov qword [rax + 0x10], rcx
mov dword [rax + 0x20], 0
mov byte [rax + 0x24], 0
mov dword [rax], 0
add rsp, 0xc0
pop rsi
ret
movups xmm0, xmmword [rsp + 0x8c]
movups xmm1, xmmword [rsp + 0x98]
movups xmm2, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x6c], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0xb8]
mov rax, rsi
mov qword [rsi + 0x30], rdx
movups xmmword [rsi + 0x20], xmm2
movups xmm0, xmmword [rsp + 0x6c]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 4], xmm0
mov dword [rsi], ecx
add rsp, 0xc0
pop rsi
ret
mov edx, dword [rsp + 0x30]
cmp edx, ecx
jbe 0x1400f1da6
xor r8d, r8d
sub edx, ecx
cmovb edx, r8d
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 0x13
mov dword [rax + 0xc], ecx
mov dword [rax + 0x10], edx
add rsp, 0xc0
pop rsi
ret
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 8], xmm0
mov dword [rax], 2
add rsp, 0xc0
pop rsi
ret
Function at 0x1400f1e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rcx
movzx ecx, word [rdx + 0x18]
movzx r8d, byte [rdx + 0x1a]
shl r8d, 0x10
or r8d, ecx
cmp cl, 1
jne 0x1400f1f67
mov rcx, qword [rdx + 8]
mov r9, rcx
shr r9, 0x20
jne 0x1400f1f8e
cmp ecx, 0x10000000
jae 0x1400f1f8e
mov rsi, rax
mov eax, dword [rdx + 0x10]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
and r8d, 0xffffff
shl r8, 0x20
or r8, rax
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x20]
call sym.__der::asn1::integer::bigint::UIntRef_as_der::decode::DecodeValue_::decode_value::hf0862e7a6b5cf60d
mov ecx, dword [rsp + 0x88]
cmp ecx, 2
jne 0x1400f1fb7
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov ecx, dword [rsp + 0x38]
cmp byte [rsp + 0x3c], 0
mov rax, rsi
je 0x1400f2009
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 1
add rsp, 0xc0
pop rsi
ret
mov edx, r8d
shr edx, 0x10
shr r8d, 8
mov dword [rax + 8], 0x111
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], dl
mov byte [rax + 4], cl
mov byte [rax + 5], r8b
mov byte [rax + 6], dl
jmp 0x1400f1fa8
mov dword [rax + 4], ecx
mov qword [rax + 8], 0xa
mov qword [rax + 0x10], rcx
mov dword [rax + 0x20], 0
mov byte [rax + 0x24], 0
mov dword [rax], 0
add rsp, 0xc0
pop rsi
ret
movups xmm0, xmmword [rsp + 0x8c]
movups xmm1, xmmword [rsp + 0x98]
movups xmm2, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x6c], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0xb8]
mov rax, rsi
mov qword [rsi + 0x30], rdx
movups xmmword [rsi + 0x20], xmm2
movups xmm0, xmmword [rsp + 0x6c]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 4], xmm0
mov dword [rsi], ecx
add rsp, 0xc0
pop rsi
ret
mov edx, dword [rsp + 0x30]
cmp edx, ecx
jbe 0x1400f2036
xor r8d, r8d
sub edx, ecx
cmovb edx, r8d
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 0x13
mov dword [rax + 0xc], ecx
mov dword [rax + 0x10], edx
add rsp, 0xc0
pop rsi
ret
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 8], xmm0
mov dword [rax], 2
add rsp, 0xc0
pop rsi
ret
Function at 0x1400f25f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rcx
movzx ecx, word [rdx + 0x18]
movzx r8d, byte [rdx + 0x1a]
shl r8d, 0x10
or r8d, ecx
cmp cl, 0xc
jne 0x1400f26c7
mov rcx, qword [rdx + 8]
mov r9, rcx
shr r9, 0x20
jne 0x1400f26ee
cmp ecx, 0x10000000
jae 0x1400f26ee
mov rsi, rax
mov eax, dword [rdx + 0x10]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
and r8d, 0xffffff
shl r8, 0x20
or r8, rax
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x20]
call sym._ZN92__LT_der..asn1..printable_string..PrintableStringRef_u20_as_u20_der..decode..DecodeValue_GT_12decode_value17h8bfe7641ce62
mov ecx, dword [rsp + 0x88]
cmp ecx, 2
jne 0x1400f2717
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov ecx, dword [rsp + 0x38]
cmp byte [rsp + 0x3c], 0
mov rax, rsi
je 0x1400f2769
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 1
add rsp, 0xc0
pop rsi
ret
mov edx, r8d
shr edx, 0x10
shr r8d, 8
mov dword [rax + 8], 0xc11
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], dl
mov byte [rax + 4], cl
mov byte [rax + 5], r8b
mov byte [rax + 6], dl
jmp 0x1400f2708
mov dword [rax + 4], ecx
mov qword [rax + 8], 0xa
mov qword [rax + 0x10], rcx
mov dword [rax + 0x20], 0
mov byte [rax + 0x24], 0
mov dword [rax], 0
add rsp, 0xc0
pop rsi
ret
movups xmm0, xmmword [rsp + 0x8c]
movups xmm1, xmmword [rsp + 0x98]
movups xmm2, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x6c], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0xb8]
mov rax, rsi
mov qword [rsi + 0x30], rdx
movups xmmword [rsi + 0x20], xmm2
movups xmm0, xmmword [rsp + 0x6c]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 4], xmm0
mov dword [rsi], ecx
add rsp, 0xc0
pop rsi
ret
mov edx, dword [rsp + 0x30]
cmp edx, ecx
jbe 0x1400f2796
xor r8d, r8d
sub edx, ecx
cmovb edx, r8d
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 0x13
mov dword [rax + 0xc], ecx
mov dword [rax + 0x10], edx
add rsp, 0xc0
pop rsi
ret
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 8], xmm0
mov dword [rax], 2
add rsp, 0xc0
pop rsi
ret
Function at 0x1400f2a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rcx
movzx ecx, word [rdx + 0x18]
movzx r8d, byte [rdx + 0x1a]
shl r8d, 0x10
or r8d, ecx
cmp cl, 0x10
jne 0x1400f2b17
mov rcx, qword [rdx + 8]
mov r9, rcx
shr r9, 0x20
jne 0x1400f2b3e
cmp ecx, 0x10000000
jae 0x1400f2b3e
mov rsi, rax
mov eax, dword [rdx + 0x10]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
and r8d, 0xffffff
shl r8, 0x20
or r8, rax
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x20]
call sym.__der::asn1::utc_time::UtcTime_as_der::decode::DecodeValue_::decode_value::hfb91728b50b13e58
mov ecx, dword [rsp + 0x88]
cmp ecx, 2
jne 0x1400f2b67
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov ecx, dword [rsp + 0x38]
cmp byte [rsp + 0x3c], 0
mov rax, rsi
je 0x1400f2bb9
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 1
add rsp, 0xc0
pop rsi
ret
mov edx, r8d
shr edx, 0x10
shr r8d, 8
mov dword [rax + 8], 0x1011
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], dl
mov byte [rax + 4], cl
mov byte [rax + 5], r8b
mov byte [rax + 6], dl
jmp 0x1400f2b58
mov dword [rax + 4], ecx
mov qword [rax + 8], 0xa
mov qword [rax + 0x10], rcx
mov dword [rax + 0x20], 0
mov byte [rax + 0x24], 0
mov dword [rax], 0
add rsp, 0xc0
pop rsi
ret
movups xmm0, xmmword [rsp + 0x8c]
movups xmm1, xmmword [rsp + 0x98]
movups xmm2, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x6c], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0xb8]
mov rax, rsi
mov qword [rsi + 0x30], rdx
movups xmmword [rsi + 0x20], xmm2
movups xmm0, xmmword [rsp + 0x6c]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 4], xmm0
mov dword [rsi], ecx
add rsp, 0xc0
pop rsi
ret
mov edx, dword [rsp + 0x30]
cmp edx, ecx
jbe 0x1400f2be6
xor r8d, r8d
sub edx, ecx
cmovb edx, r8d
mov dword [rax], 1
mov dword [rax + 4], ecx
mov byte [rax + 8], 0x13
mov dword [rax + 0xc], ecx
mov dword [rax + 0x10], edx
add rsp, 0xc0
pop rsi
ret
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x18], rcx
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 8], xmm0
mov dword [rax], 2
add rsp, 0xc0
pop rsi
ret
Function at 0x1400fdcb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, r9
or rax, rdx
je 0x1400fde91
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov r8d, 4
mov r15, rcx
call sym.base64ct::encoding::validate_last_block::last_block_start::h771947e45dd40a57
cmp rax, rsi
ja 0x1400fdcfc
mov rdi, rax
mov r8d, 3
mov rcx, r14
mov rdx, rbx
call sym.base64ct::encoding::validate_last_block::last_block_start::h771947e45dd40a57
sub rbx, rax
jae 0x1400fdd03
xor eax, eax
jmp 0x1400fde93
add r14, rax
mov dword [rsp + 0x2c], 0
lea r8, [rsp + 0x2c]
mov r9d, 4
mov rcx, r14
mov rdx, rbx
call sym.__T_as_base64ct::encoding::Encoding_::encode::hb3bb737c75c9790e
test rax, rax
je 0x1400fdd53
lea rcx, [r15 + rdi]
add rsi, r15
sub rsi, rcx
cmp rdx, rsi
cmovb rsi, rdx
test rsi, rsi
je 0x1400fde91
cmp rsi, 8
jae 0x1400fdd5a
xor r8d, r8d
xor edx, edx
jmp 0x1400fde70
mov al, 1
jmp 0x1400fde93
cmp rsi, 0x20
jae 0x1400fdd6a
xor r8d, r8d
xor edx, edx
jmp 0x1400fde07
mov rdx, rsi
and rdx, 0xffffffffffffffe0
lea r8, [rdi + r15]
add r8, 0x10
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rax + r9]
movdqu xmm3, xmmword [rax + r9 + 0x10]
movdqu xmm4, xmmword [r8 + r9 - 0x10]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [r8 + r9]
pxor xmm2, xmm3
por xmm1, xmm2
add r9, 0x20
cmp rdx, r9
jne 0x1400fdd90
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r8d, xmm1
cmp rsi, rdx
je 0x1400fde88
test sil, 0x18
je 0x1400fde70
mov r9, rdx
mov rdx, rsi
and rdx, 0xfffffffffffffff8
movzx r8d, r8b
movd xmm0, r8d
nop word [rax + rax]
mov r8, qword [rcx + r9]
xor r8, qword [rax + r9]
movq xmm1, r8
por xmm0, xmm1
add r9, 8
cmp rdx, r9
jne 0x1400fde20
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r8d, xmm1
cmp rsi, rdx
je 0x1400fde88
nop word [rax + rax]
movzx r9d, byte [rcx + rdx]
xor r9b, byte [rax + rdx]
lea r10, [rdx + 1]
or r8b, r9b
mov rdx, r10
cmp rsi, r10
jne 0x1400fde70
test r8b, r8b
jne 0x1400fdcfc
mov al, 2
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400fdea0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, r9
or rax, rdx
je 0x1400fe081
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov r8d, 4
mov r15, rcx
call sym.base64ct::encoding::validate_last_block::last_block_start::h771947e45dd40a57
cmp rax, rsi
ja 0x1400fdeec
mov rdi, rax
mov r8d, 3
mov rcx, r14
mov rdx, rbx
call sym.base64ct::encoding::validate_last_block::last_block_start::h771947e45dd40a57
sub rbx, rax
jae 0x1400fdef3
xor eax, eax
jmp 0x1400fe083
add r14, rax
mov dword [rsp + 0x2c], 0
lea r8, [rsp + 0x2c]
mov r9d, 4
mov rcx, r14
mov rdx, rbx
call sym.__T_as_base64ct::encoding::Encoding_::encode::h44287e288ef75514
test rax, rax
je 0x1400fdf43
lea rcx, [r15 + rdi]
add rsi, r15
sub rsi, rcx
cmp rdx, rsi
cmovb rsi, rdx
test rsi, rsi
je 0x1400fe081
cmp rsi, 8
jae 0x1400fdf4a
xor r8d, r8d
xor edx, edx
jmp 0x1400fe060
mov al, 1
jmp 0x1400fe083
cmp rsi, 0x20
jae 0x1400fdf5a
xor r8d, r8d
xor edx, edx
jmp 0x1400fdff7
mov rdx, rsi
and rdx, 0xffffffffffffffe0
lea r8, [rdi + r15]
add r8, 0x10
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rax + r9]
movdqu xmm3, xmmword [rax + r9 + 0x10]
movdqu xmm4, xmmword [r8 + r9 - 0x10]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [r8 + r9]
pxor xmm2, xmm3
por xmm1, xmm2
add r9, 0x20
cmp rdx, r9
jne 0x1400fdf80
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r8d, xmm1
cmp rsi, rdx
je 0x1400fe078
test sil, 0x18
je 0x1400fe060
mov r9, rdx
mov rdx, rsi
and rdx, 0xfffffffffffffff8
movzx r8d, r8b
movd xmm0, r8d
nop word [rax + rax]
mov r8, qword [rcx + r9]
xor r8, qword [rax + r9]
movq xmm1, r8
por xmm0, xmm1
add r9, 8
cmp rdx, r9
jne 0x1400fe010
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r8d, xmm1
cmp rsi, rdx
je 0x1400fe078
nop word [rax + rax]
movzx r9d, byte [rcx + rdx]
xor r9b, byte [rax + rdx]
lea r10, [rdx + 1]
or r8b, r9b
mov rdx, r10
cmp rsi, r10
jne 0x1400fe060
test r8b, r8b
jne 0x1400fdeec
mov al, 2
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140106f30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r10, qword [rdx + 0x28]
cmp r10, 5
jb 0x140106f73
mov r10, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov rdx, qword [r8 + 0x28]
cmp rdx, 5
jae 0x140106f81
lea rcx, [r8 + 8]
mov r9, rdx
cmp r10, r9
cmovb r9, r10
test r9, r9
jne 0x140106f99
jmp 0x140107069
lea rax, [rsi + 8]
mov rdx, qword [r8 + 0x28]
cmp rdx, 5
jb 0x140106f5b
mov r9, qword [r8 + 8]
mov rcx, qword [r8 + 0x10]
cmp r10, r9
cmovb r9, r10
test r9, r9
je 0x140107069
cmp r9, 8
jb 0x140106fb1
lea r10, [rcx + r9*8]
cmp rax, r10
jae 0x140107024
lea r10, [rax + r9*8]
cmp rcx, r10
jae 0x140107024
xor r10d, r10d
mov rbx, r9
mov r11, r10
and rbx, 3
je 0x140106fe4
mov r14, r10
nop word cs:[rax + rax]
mov r11, qword [rcx + r14*8]
xor qword [rax + r14*8], r11
lea r11, [r14 + 1]
mov r14, r11
dec rbx
jne 0x140106fd0
sub r10, r9
cmp r10, 0xfffffffffffffffc
ja 0x140107069
nop dword [rax]
mov r10, qword [rcx + r11*8]
xor qword [rax + r11*8], r10
mov r10, qword [rcx + r11*8 + 8]
xor qword [rax + r11*8 + 8], r10
mov r10, qword [rcx + r11*8 + 0x10]
xor qword [rax + r11*8 + 0x10], r10
mov r10, qword [rcx + r11*8 + 0x18]
xor qword [rax + r11*8 + 0x18], r10
lea r10, [r11 + 4]
mov r11, r10
cmp r9, r10
jne 0x140106ff0
jmp 0x140107069
mov r10, r9
and r10, 0xfffffffffffffffc
xor r11d, r11d
nop
movups xmm0, xmmword [rcx + r11*8]
movups xmm1, xmmword [rcx + r11*8 + 0x10]
movups xmm2, xmmword [rax + r11*8]
xorps xmm2, xmm0
movups xmm0, xmmword [rax + r11*8 + 0x10]
xorps xmm0, xmm1
movups xmmword [rax + r11*8], xmm2
movups xmmword [rax + r11*8 + 0x10], xmm0
add r11, 4
cmp r10, r11
jne 0x140107030
cmp r9, r10
jne 0x140106fb4
lea rbx, [rsi + 0x28]
mov r9, rdx
cmp rdx, 5
jb 0x14010707a
mov r9, qword [r8 + 8]
mov rax, qword [rbx]
cmp rax, 5
jb 0x14010708e
mov rcx, qword [rsi + 8]
cmp r9, rcx
ja 0x140107096
jmp 0x1401070c9
mov rcx, rax
cmp r9, rax
jbe 0x1401070c9
cmp rdx, 5
jb 0x1401070a6
mov rdx, qword [r8 + 8]
mov r8, qword [r8 + 0x10]
jmp 0x1401070aa
add r8, 8
cmp rdx, rcx
jb 0x14010714d
lea rax, [r8 + rcx*8]
lea r8, [r8 + rdx*8]
mov rcx, rsi
mov rdx, rax
call fcn.140120dc0
mov rax, qword [rbx]
cmp rax, 5
setae cl
jb 0x1401070d6
mov rax, qword [rsi + 8]
test rax, rax
je 0x14010712a
lea rdx, [rsi + 8]
mov r8, qword [rsi + 0x10]
jmp 0x1401070f5
test rax, rax
je 0x14010712a
mov r9, r8
test cl, 1
jne 0x140107100
mov r9, rdx
cmp qword [r9 + rax*8 - 8], 0
jne 0x14010712a
mov r9, rdx
test cl, 1
jne 0x140107113
mov r9, rbx
dec rax
mov qword [r9], rax
mov rax, qword [rbx]
cmp rax, 5
setae cl
jb 0x1401070f0
mov rax, qword [rdx]
jmp 0x1401070f0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_num_bigint_dig_0.8.4_src_biguint.rs0x0b0o
call sym.core::slice::index::slice_start_index_len_fail::hc4490513dd7cd116
ud2
Function at 0x140130de0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140130df7
dec ecx
jmp 0x140130e01
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
mov edx, 1
call fcn.1402dd8f4
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140130e2f
dec qword [rcx]
jne 0x140130e2f
dec qword [rcx + 8]
jne 0x140130e2f
mov edx, 0x170
mov r8d, 0x10
call sym.__rust_dealloc
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140130e4d
dec ecx
jmp 0x140130e57
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
xor esi, esi
xor edx, edx
call fcn.1402dd8f4
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140130fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call sym.__rand_core::os::OsRng_as_rand_core::RngCore_::try_fill_bytes::h06f3966c4be4dbc0
test rax, rax
je 0x14013101a
mov rbx, rax
mov r14, rdx
mov rcx, rax
call qword [rdx]
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140131072
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call sym.__rust_dealloc
jmp 0x140131072
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x14045dd58]
lea rdx, [rsp + 0x40]
mov r9d, 8
call sym.rand_chacha::guts::init_chacha::hb8c75b19b7969a91
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.rand_chacha::guts::refill_wide::h12c8a2d729ebaa83
Function at 0x1401310d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140131100
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140131115
cmp qword [rax + 8], 0
je 0x140131115
add rax, 8
jmp 0x14013119a
mov rcx, rdi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1401310f0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140131183
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140131198
test rax, rax
jne 0x14013116e
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1401311b3
mov qword [rax], rdi
mov qword [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x1401311a1
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.1402dd8f4
mov rax, rdi
add rax, 8
mov rcx, rax
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::thread_local::lazy::LazyKeyInner_T_::initialize::h348e6fbd8b03ce39
mov rcx, rdi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140131129
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
mov rax, rdi
jmp 0x140131160
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::hac6683127b8aa11c
int3
Function at 0x140134970
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1401349d6
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x140134998
add rdi, rbx
sub rsi, rbx
je 0x1401349d6
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140134990
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140134990
and ebp, 0x7fffffff
jmp 0x1401349d8
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140135350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8d, ecx
cmp cx, 4
jae 0x140135370
xor r9d, r9d
test r8w, r8w
setne r9b
mov eax, r9d
add rsp, 0x28
ret
bsr cx, r8w
xor ecx, 0xfffffff0
movzx eax, r8w
add ecx, 0x11
shr ecx, 1
mov r9d, 1
shl r9d, cl
shr eax, cl
add eax, r9d
movzx ecx, ax
shr ecx, 1
cmp cx, r9w
jbe 0x1401353bb
nop word [rax + rax]
mov eax, r8d
xor edx, edx
div cx
add eax, ecx
movzx eax, ax
shr eax, 1
mov r9d, ecx
cmp cx, ax
mov ecx, eax
jb 0x1401353a0
jmp 0x1401353d9
mov eax, ecx
jmp 0x1401353d9
test ax, ax
je 0x1401353e7
mov r9d, eax
mov eax, r8d
xor edx, edx
div r9w
add eax, r9d
movzx eax, ax
shr eax, 1
cmp r9w, ax
ja 0x1401353c0
mov eax, r9d
add rsp, 0x28
ret
lea rcx, [0x14045e9b8]
call sym.core::panicking::panic_const::panic_const_div_by_zero::hd947b851b7a2aa3a
int3