joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140055540
test al, 1
je 0x140055630
test al, 2
jne 0x140055648
test al, 8
jne 0x14005557b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 0xc
lea rdx, [rsp + 0x50]
call fcn.1400c43c0
jmp 0x140055599
test al, 0x10
je 0x140055599
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1400556cc
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e7bf0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140055660
jne 0x140055625
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400555e9
mov rcx, rdi
call fcn.140043040
lea rcx, [rsi + 0x30]
call fcn.140052ce0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140055608
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14016b208]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x208
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140137580]
mov edx, 0x23
call fcn.1400fa150
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401375c0]
mov edx, 0x25
call fcn.1400fa150
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400088f0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140137608]
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x14015dbe8]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
int3
Function at 0x140055710
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140055720
test al, 1
je 0x1400557c9
test al, 2
jne 0x1400557e1
test al, 8
jne 0x14005575a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xc8], 4
lea rdx, [rsp + 0x58]
call fcn.1400c4880
jmp 0x140055778
test al, 0x10
je 0x140055778
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140055865
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e7900
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400557f9
jne 0x1400557bf
mov rcx, rsi
add rsp, 0xd0
pop rsi
jmp fcn.140054130
nop
add rsp, 0xd0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140137580]
mov edx, 0x23
call fcn.1400fa150
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401375c0]
mov edx, 0x25
call fcn.1400fa150
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1400088f0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140137608]
lea rcx, [rsp + 0x58]
call fcn.1400f9f90
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x14015dbe8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1400f9f90
int3
Function at 0x140055e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfd8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140055e90
test al, 1
je 0x140055f80
test al, 2
jne 0x140055f98
test al, 8
jne 0x140055ecb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call fcn.1400c46f0
jmp 0x140055ee9
test al, 0x10
je 0x140055ee9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x14005601c
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e7900
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140055fb0
jne 0x140055f75
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140055f39
mov rcx, rdi
call fcn.14002b340
lea rcx, [rsi + 0x30]
call fcn.1400519a0
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140055f58
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14016b208]
xor edx, edx
add rsp, 0xfd8
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0xfd8
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140137580]
mov edx, 0x23
call fcn.1400fa150
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401375c0]
mov edx, 0x25
call fcn.1400fa150
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1400088f0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140137608]
lea rcx, [rsp + 0x58]
call fcn.1400f9f90
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x14015dbe8]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.1400f9f90
int3
Function at 0x140056350
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140056360
test al, 1
je 0x140056450
test al, 2
jne 0x140056468
test al, 8
jne 0x14005639b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.1400c5580
jmp 0x1400563b9
test al, 0x10
je 0x1400563b9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400564ec
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e7900
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140056480
jne 0x140056445
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140056409
mov rcx, rdi
call fcn.14002b340
lea rcx, [rsi + 0x30]
call fcn.140053830
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140056428
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14016b208]
xor edx, edx
add rsp, 0x238
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140137580]
mov edx, 0x23
call fcn.1400fa150
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401375c0]
mov edx, 0x25
call fcn.1400fa150
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400088f0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140137608]
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x14015dbe8]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
int3
Function at 0x140056530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140056540
test al, 1
je 0x140056630
test al, 2
jne 0x140056648
test al, 8
jne 0x14005657b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 0xc
lea rdx, [rsp + 0x50]
call fcn.1400c43c0
jmp 0x140056599
test al, 0x10
je 0x140056599
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1400566cc
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400e7900
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140056660
jne 0x140056625
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400565e9
mov rcx, rdi
call fcn.14002b340
lea rcx, [rsi + 0x30]
call fcn.140052ce0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140056608
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14016b208]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x208
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140137580]
mov edx, 0x23
call fcn.1400fa150
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401375c0]
mov edx, 0x25
call fcn.1400fa150
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400088f0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140137608]
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x14015dbe8]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.1400f9f90
int3
Function at 0x140093470
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov qword [rsp + 0x100], r8
mov rsi, rdx
mov qword [rsp + 0x128], rcx
mov word [rax + rbp], fs
add dword [rax], eax
add byte [rdi], cl
mov dh, 0x82
js 0x14009349e
add byte [rax], al
Function at 0x1400a7540
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400a757e
movabs rdi, 0x8000000000000000
jmp 0x1400a75f3
mov rbx, qword [rsp + 0x28]
mov r14, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400a75d6
movzx eax, byte [0x14016b2a0]
mov rcx, qword [0x14016b208]
test rcx, rcx
jne 0x1400a75b7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400a75c9
mov rcx, rax
mov qword [0x14016b208], rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400a75dc
mov ecx, 1
mov rdx, rdi
call fcn.1400f9ca0
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rdi
mov qword [rsi], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400a7610
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400a764e
movabs rdi, 0x8000000000000000
jmp 0x1400a76c3
mov rbx, qword [rsp + 0x28]
mov r14, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400a76a6
movzx eax, byte [0x14016b2a0]
mov rcx, qword [0x14016b208]
test rcx, rcx
jne 0x1400a7687
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400a7699
mov rcx, rax
mov qword [0x14016b208], rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400a76ac
mov ecx, 1
mov rdx, rdi
call fcn.1400f9ca0
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rdi
mov qword [rsi], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400ca1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x60]
mov r8d, 0xb
mov rdx, rax
call fcn.14008b3f0
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
movzx eax, byte [0x14016b2a0]
mov rcx, qword [0x14016b208]
test rcx, rcx
jne 0x1400ca218
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400ca359
mov rcx, rax
mov qword [0x14016b208], rax
mov r8d, 0x800
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400ca359
mov rbx, rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
mov r14, qword [rsp + 0x68]
lea rbp, [rsp + 0x38]
lea r15, [rsp + 0x3c]
mov r12, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
sub rsi, r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call r12
cmp eax, 0xea
jne 0x1400ca2ae
mov r8d, dword [rsp + 0x38]
cmp rsi, r8
jae 0x1400ca270
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.1400feee0
mov rbx, qword [rsp + 0x48]
jmp 0x1400ca263
test eax, eax
jne 0x1400ca2d5
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
mov rdx, qword [rsp + 0x58]
jbe 0x1400ca33b
movabs rax, 0xde00000002
jmp 0x1400ca2e2
shl rax, 0x20
or rax, 2
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rdx], rax
cmp qword [rsp + 0x40], 0
je 0x1400ca30d
mov rcx, qword [0x14016b208]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x1400ca329
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x14016b208]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x1400ca315
jmp 0x1400ca329
mov ecx, 1
mov edx, 0x800
call fcn.1400f9ca0
int3
Function at 0x1400ce6c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140008d00
cmp rax, rcx
je 0x1400ce6e5
cmp rdx, 4
jae 0x1400ce6e8
xor eax, eax
xor r8d, r8d
jmp 0x1400ce780
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140102590]
movdqa xmm3, xmmword [0x1401025a0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400ce710
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400ce797
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400ce780
ret
Function at 0x1400d9fc0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.1400d5b90
mov rax, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400da016
lea rcx, [rbp - 0x50]
call fcn.1400d3530
mov qword [rsi], rdi
jmp 0x1400da1ff
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x408], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x410], rax
add byte [rax - 0x39], cl
test eax, esi
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test eax, edi
add eax, dword [rax]
add byte [rdx], al
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], eax
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x48], al
add byte [rdx], al
add byte [rax], al
Function at 0x1400dc0a0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x14016b210]
cmp rax, 3
jne 0x1400dc26d
cmp rbx, 0x17f
ja 0x1400dc27f
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x60], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x1400dc118
xor edx, edx
nop
cmp byte [rsp + rdx + 0x60], 0
je 0x1400dc1d4
inc rdx
cmp rax, rdx
jne 0x1400dc100
jmp 0x1400dc234
lea rcx, [rsp + 0x67]
and rcx, 0xfffffffffffffff8
sub rcx, r15
je 0x1400dc14e
je 0x1400dc14e
xor edx, edx
nop word [rax + rax]
cmp byte [rsp + rdx + 0x60], 0
je 0x1400dc1d4
inc rdx
cmp rcx, rdx
jne 0x1400dc130
lea rdx, [rbx - 0xf]
cmp rcx, rdx
jbe 0x1400dc154
jmp 0x1400dc19e
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x140102580]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rsp + rcx + 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400dc19e
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400dc170
sub rax, rcx
je 0x1400dc234
lea r8, [rsp + rcx]
add r8, 0x60
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x1400dc1d1
inc rdx
cmp rax, rdx
jne 0x1400dc1c0
jmp 0x1400dc234
add rdx, rcx
cmp rdx, rbx
jne 0x1400dc234
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400dc248
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400dc25b
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400dc25e
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400ff9a0
cmp rbx, 0x17f
jbe 0x1400dc0da
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400ffa10
Function at 0x1400dcc00
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14016b2a0]
mov rcx, qword [0x14016b208]
test rcx, rcx
jne 0x1400dcc4c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400dcd19
mov rcx, rax
mov qword [0x14016b208], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dcd19
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400dcde0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400dcd0b
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400dcce4
cmp qword [rax + 0x10], 0x11
jae 0x1400dcccd
mov r8, qword [rbp - 0x10]
jmp 0x1400dccd5
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x14016b208]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14016b208]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400f9ca0
ud2

Function at 0x1400dcf40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400dcf83
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1400dac00]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400f9f90
ud2