joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f2170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xcbf29ce484222325
test r8, r8
je 0x1400f21ce
movabs r9, 0x100000001b3
shl r8, 3
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [rdx + r10 + 4]
xor r11, rax
imul r11, r9
movzx esi, byte [rdx + r10 + 5]
xor rsi, r11
imul rsi, r9
mov eax, dword [rdx + r10]
xor rax, rsi
imul rax, r9
add r10, 8
cmp r8, r10
jne 0x1400f21a0
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400f21e5
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402e0000]
lea r8, [0x1402dffe0]
mov edx, 0x39
call dbg.panic
ud2

Function at 0x1400f2710
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400f275f
movzx r8d, byte [rdx + 5]
movzx r9d, byte [rdx + 4]
mov edx, dword [rdx]
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
xor rax, r9
imul rax, rdx
xor rax, r8
imul rax, rdx
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x28
ret
lea rcx, [0x1402e0000]
lea r8, [0x1402e0088]
mov edx, 0x39
call dbg.panic
ud2

Function at 0x140104460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140104491
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1401044a6
cmp qword [rax + 8], 0
je 0x1401044a6
add rax, 0x10
jmp 0x140104561
mov rcx, rdi
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140104481
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140104546
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14010455f
mov rbx, rax
test rax, rax
jne 0x14010450b
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1401045b1
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140104569
dec ecx
mov rdx, rbx
call fcn.14026861c
test rsi, rsi
je 0x140104521
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x140104534
mov ecx, 1
lock xadd qword [0x14026a280], rcx
test rcx, rcx
je 0x140104575
lea rax, [rbx + 0x10]
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], rcx
jmp 0x140104561
mov rcx, rdi
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x1401044c2
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x140104503
lea rax, str.regex:_thread_ID_allocation_space_exhausted
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
lea rax, [0x1402e34b0]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rdx, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_util_pool.rs
lea rcx, [rsp + 0x20]
call dbg.panic_fmt
ud2
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
ud2
Function at 0x1401045d0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1401045e7
dec ecx
jmp 0x1401045f1
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
mov edx, 1
call fcn.14026861c
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140104619
dec ecx
jmp 0x140104623
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
xor edx, edx
call fcn.14026861c
nop
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140105fc0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov ebx, 4
test rdi, rdi
je 0x140106024
mov rax, rdi
shr rax, 0x3d
jne 0x140106160
lea r12, [rdi*4]
test r12, r12
je 0x140106024
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 4
mov rcx, r12
call sym.__rust_alloc
test rax, rax
je 0x140106167
mov rbx, rax
jmp 0x140106027
xor r12d, r12d
mov rcx, rbx
mov rdx, r15
mov r8, r12
call sym.memcpy
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov rdx, qword [r14 + 0x30]
movzx ecx, byte [r14 + 0x158]
shr rdx, cl
test rdx, rdx
je 0x1401060de
xor r9d, r9d
lea r8, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_dfa_remapper.rs
lea r10, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_dfa_remapper.rs
lea r11, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_dfa_remapper.rs
jmp 0x140106088
inc r9
cmp r9, rdx
je 0x1401060de
mov rcx, qword [rsi + 0x18]
and ecx, 0x3f
mov r15, r9
shl r15, cl
cmp r9, rdi
je 0x140106150
mov eax, dword [rbx + r9*4]
cmp eax, r15d
je 0x140106080
nop word [rax + rax]
mov ebp, eax
mov eax, eax
shr rax, cl
cmp rax, rdi
jae 0x140106140
mov eax, dword [rbx + rax*4]
cmp eax, r15d
jne 0x1401060b0
mov rcx, qword [rsi + 0x10]
cmp r9, rcx
jae 0x140106155
mov rax, qword [rsi]
mov dword [rax + r9*4], ebp
jmp 0x140106080
lea r8, [rsi + 0x18]
mov rcx, r14
mov rdx, rsi
call sym._ZN14regex_automata3dfa8remapper7onepass105__LT_impl_u20_regex_automata..dfa..remapper..Remappable_u20_for_u20_regex_automata.
test rdi, rdi
je 0x140106107
shl rdi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140106130
mov rcx, qword [rsi]
shl rdx, 2
mov r8d, 4
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.__rust_dealloc
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r8, r10
mov rcx, rax
mov rdx, rdi
call dbg.panic_bounds_check
jmp 0x140106174
mov rax, rdi
jmp 0x140106143
mov rax, r9
mov rdi, rcx
mov r8, r11
jmp 0x140106143
call dbg.capacity_overflow
jmp 0x140106174
mov ecx, 4
mov rdx, r12
call dbg.handle_alloc_error
ud2
Function at 0x140130b50
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rdi, rcx
mov r14, qword [rdx + 0x10]
test r14, r14
je 0x140130bc4
mov rax, r14
shr rax, 0x3d
jne 0x140130cb2
lea rbx, [r14*4]
test rbx, rbx
je 0x140130bce
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 4
mov rcx, rbx
call sym.__rust_alloc
test rax, rax
je 0x140130cb9
mov ecx, esi
and ecx, 0x3f
cmp r14, 8
jae 0x140130bde
xor edx, edx
jmp 0x140130c70
mov eax, 4
jmp 0x140130c86
mov eax, 4
mov ecx, esi
and ecx, 0x3f
cmp r14, 8
jb 0x140130bbd
mov rdx, r14
and rdx, 0xfffffffffffffff8
movd xmm0, ecx
movdqa xmm1, xmmword [0x1402e7f80]
movdqa xmm2, xmmword [0x1402e7f90]
xor r8d, r8d
movdqa xmm3, xmmword [0x1402e7fa0]
movdqa xmm4, xmmword [0x1402e7fb0]
nop dword [rax]
movdqa xmm5, xmm1
paddq xmm5, xmm3
movdqa xmm6, xmm2
movdqa xmm7, xmm2
psllq xmm7, xmm0
paddq xmm6, xmm3
movdqa xmm8, xmm1
psllq xmm8, xmm0
psllq xmm6, xmm0
psllq xmm5, xmm0
shufps xmm7, xmm8, 0x88
shufps xmm6, xmm5, 0x88
movups xmmword [rax + r8*4], xmm7
movups xmmword [rax + r8*4 + 0x10], xmm6
add r8, 8
paddq xmm2, xmm4
paddq xmm1, xmm4
cmp rdx, r8
jne 0x140130c10
cmp r14, rdx
je 0x140130c86
nop word cs:[rax + rax]
mov r8, rdx
shl r8, cl
mov dword [rax + rdx*4], r8d
lea r8, [rdx + 1]
mov rdx, r8
cmp r14, r8
jne 0x140130c70
mov qword [rdi], rax
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], rsi
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call dbg.capacity_overflow
ud2
mov ecx, 4
mov rdx, rbx
call dbg.handle_alloc_error
ud2
Function at 0x140130dc0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov ebx, 4
test rdi, rdi
je 0x140130e24
mov rax, rdi
shr rax, 0x3d
jne 0x140130f50
lea r12, [rdi*4]
test r12, r12
je 0x140130e24
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 4
mov rcx, r12
call sym.__rust_alloc
test rax, rax
je 0x140130f57
mov rbx, rax
jmp 0x140130e27
xor r12d, r12d
mov rcx, rbx
mov rdx, r15
mov r8, r12
call sym.memcpy
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov rdx, qword [r14 + 0x10]
test rdx, rdx
je 0x140130ece
xor r9d, r9d
lea r8, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_aho_corasick_1.1.3_src_util_remapper.rs
lea r10, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_aho_corasick_1.1.3_src_util_remapper.rs
lea r11, str._Users_o_.cargo_registry_src_index.crates.io_6f17d22bba15001f_aho_corasick_1.1.3_src_util_remapper.rs
jmp 0x140130e78
inc r9
cmp r9, rdx
je 0x140130ece
mov rcx, qword [rsi + 0x18]
and ecx, 0x3f
mov r15, r9
shl r15, cl
cmp r9, rdi
je 0x140130f40
mov eax, dword [rbx + r9*4]
cmp eax, r15d
je 0x140130e70
nop word [rax + rax]
mov ebp, eax
mov eax, eax
shr rax, cl
cmp rax, rdi
jae 0x140130f30
mov eax, dword [rbx + rax*4]
cmp eax, r15d
jne 0x140130ea0
mov rcx, qword [rsi + 0x10]
cmp r9, rcx
jae 0x140130f45
mov rax, qword [rsi]
mov dword [rax + r9*4], ebp
jmp 0x140130e70
lea r8, [rsi + 0x18]
mov rcx, r14
mov rdx, rsi
call sym._ZN98__LT_aho_corasick..nfa..noncontiguous..NFA_u20_as_u20_aho_corasick..util..remapper..Remappable_GT_5remap17h97b3de3b840640
test rdi, rdi
je 0x140130ef7
shl rdi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140130f20
mov rcx, qword [rsi]
shl rdx, 2
mov r8d, 4
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.__rust_dealloc
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r8, r10
mov rcx, rax
mov rdx, rdi
call dbg.panic_bounds_check
jmp 0x140130f64
mov rax, rdi
jmp 0x140130f33
mov rax, r9
mov rdi, rcx
mov r8, r11
jmp 0x140130f33
call dbg.capacity_overflow
jmp 0x140130f64
mov ecx, 4
mov rdx, r12
call dbg.handle_alloc_error
ud2
Function at 0x1401704a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call sym.regex_syntax::ast::parse::ParserI_P_::char::h24a1626c7baf6ef3
cmp eax, 0x5c
jne 0x1401704de
mov rcx, rsi
mov rdx, rdi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.regex_syntax::ast::parse::ParserI_P_::parse_escape::h3d1bce610e18df70
mov r14, qword [rdi]
mov rbx, qword [r14 + 0xa0]
mov rcx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char::h24a1626c7baf6ef3
mov ecx, 1
cmp eax, 0x80
jb 0x140170516
mov ecx, 2
cmp eax, 0x800
jb 0x140170516
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rbx, rcx
jb 0x1401705f4
mov r15, qword [r14 + 0xb0]
inc r15
je 0x14017060e
mov r12, qword [r14 + 0xa8]
add r14, 0xa0
mov rcx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char::h24a1626c7baf6ef3
xor ecx, ecx
cmp eax, 0xa
sete cl
mov eax, 1
cmove r15, rax
add rcx, r12
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r15
mov rcx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char::h24a1626c7baf6ef3
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x88], 2
mov rcx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::bump::h6bc36e6f5d98a358
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi + 0x68], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x58], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x48], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x38], xmm3
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov dword [rsi], 0x22
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1402edb48]
lea r8, [0x1402edc48]
mov edx, 0x2b
call dbg.panic
ud2
lea rcx, [0x1402edb48]
lea r8, [0x1402edc60]
mov edx, 0x2b
call dbg.panic
ud2
Function at 0x14017ed70
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x14017edd4
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x14017ef34
mov rdi, rdx
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 4
mov rcx, rbx
call sym.__rust_alloc
test rax, rax
je 0x14017ef3b
cmp rbx, 0x80
jae 0x14017ede0
xor ecx, ecx
jmp 0x14017ee9a
xor ecx, ecx
mov eax, 4
jmp 0x14017ef1c
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x14017ee9a
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x14017ee9a
movabs rdx, 0x1ffffffffffffffe
lea r8, [r14 - 1]
lea r9, [rdx + 1]
cmp r8, r9
ja 0x14017ee9a
mov rcx, rdx
and rcx, r14
xor edx, edx
movdqa xmm0, xmmword [0x1402efcd0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x14017ee40
cmp r14, rcx
je 0x14017ef19
mov rdx, rcx
or rdx, 1
test bl, 8
je 0x14017eec9
mov r8d, dword [rdi + rcx*8]
mov r9d, dword [rdi + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp r14, rdx
je 0x14017ef19
nop
mov edx, dword [rdi + rcx*8]
mov r8d, dword [rdi + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [rdi + rcx*8 + 8]
mov r8d, dword [rdi + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp r14, rcx
jne 0x14017eed0
mov rcx, r14
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call dbg.capacity_overflow
ud2
mov ecx, 4
mov rdx, rbx
call dbg.handle_alloc_error
ud2
Function at 0x14019ffe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, qword [r8]
mov r9, qword [r8 + 8]
cmp rcx, rdx
je 0x1401a0108
mov r10, qword [r8 + 0x10]
sub rdx, rcx
mov r8, rdx
shr r8, 3
cmp rdx, 0xc0
jb 0x1401a006b
lea rsi, [r10 + r9*8]
lea r11, [rsi + r8*8]
add r11, 0xfffffffffffffff8
cmp r11, rsi
jb 0x1401a006b
lea r11, [r10 + r9*8]
add r11, 4
lea rdi, [rsi + r8*8]
add rdi, 0xfffffffffffffffc
cmp rdi, r11
jb 0x1401a006b
movabs r11, 0x1ffffffffffffffe
lea rdi, [r8 - 1]
lea rbx, [r11 + 1]
cmp rdi, rbx
ja 0x1401a006b
mov rdi, rdx
and rdi, 0xfffffffffffffff8
lea rbx, [rcx + rdi]
cmp rsi, rbx
jae 0x1401a010f
lea rdi, [rdi + r9*8]
add rdi, r10
cmp rdi, rcx
jbe 0x1401a010f
xor r11d, r11d
mov rsi, r11
or rsi, 1
test dl, 8
je 0x1401a009f
mov edx, dword [rcx + r11*8]
mov r11d, dword [rcx + r11*8 + 4]
cmp edx, r11d
mov edi, r11d
cmovb edi, edx
cmova r11d, edx
mov dword [r10 + r9*8], edi
mov dword [r10 + r9*8 + 4], r11d
inc r9
mov r11, rsi
cmp r8, rsi
je 0x1401a0108
lea rdx, [r10 + r9*8]
add rdx, 0xc
sub r8, r11
lea r10, [rcx + r11*8]
add r10, 0xc
xor ecx, ecx
nop dword [rax]
mov r11d, dword [r10 + rcx*8 - 0xc]
mov esi, dword [r10 + rcx*8 - 8]
cmp r11d, esi
mov edi, esi
cmovb edi, r11d
cmova esi, r11d
mov dword [rdx + rcx*8 - 0xc], edi
mov dword [rdx + rcx*8 - 8], esi
mov r11d, dword [r10 + rcx*8 - 4]
mov esi, dword [r10 + rcx*8]
cmp r11d, esi
mov edi, esi
cmovb edi, r11d
cmova esi, r11d
mov dword [rdx + rcx*8 - 4], edi
mov dword [rdx + rcx*8], esi
add rcx, 2
cmp r8, rcx
jne 0x1401a00c0
add r9, rcx
mov qword [rax], r9
pop rbx
pop rdi
pop rsi
ret
and r11, r8
add r9, r11
xor edi, edi
movdqa xmm0, xmmword [0x1402f4b50]
nop
movdqu xmm1, xmmword [rcx + rdi*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rsi + rdi*8], xmm2
add rdi, 2
cmp r11, rdi
jne 0x1401a0120
cmp r8, r11
jne 0x1401a006e
jmp 0x1401a0108
Function at 0x1401a5a50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov ecx, 0x1818
mov edx, 4
call sym.__rust_alloc
test rax, rax
je 0x1401a5b6b
xor ecx, ecx
lea rdx, [0x1403095a0]
movdqa xmm0, xmmword [0x1402f5460]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1401a5a90
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x303
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call fcn.14017aa50
mov rax, qword [rsp + 0x58]
test rax, rax
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x20], xmm0
sete byte [rsp + 0x38]
lea rcx, [rsp + 0x20]
call sym._ZN12regex_syntax3hir8interval20IntervalSet_LT_I_GT_12canonicalize17h2d4d953bf685bb8dE.llvm.10086880556477250346
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
mov ecx, 4
mov edx, 0x1818
call dbg.handle_alloc_error
ud2

Function at 0x1401a5ca0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov ecx, 0x200
mov edx, 4
call sym.__rust_alloc
test rax, rax
je 0x1401a5daa
xor ecx, ecx
lea rdx, [0x14030ae08]
movdqa xmm0, xmmword [0x1402f54c0]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1401a5ce0
mov rcx, rax
add rcx, 0x200
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x40
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call fcn.14017aa50
mov rax, qword [rsp + 0x58]
test rax, rax
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x20], xmm0
sete byte [rsp + 0x38]
lea rcx, [rsp + 0x20]
call sym._ZN12regex_syntax3hir8interval20IntervalSet_LT_I_GT_12canonicalize17h2d4d953bf685bb8dE.llvm.10086880556477250346
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
mov ecx, 4
mov edx, 0x200
call dbg.handle_alloc_error
ud2
Function at 0x1401ad7d0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x1401ad828
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.ws2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x1401ad842
lea rax, [0x140267f94]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, [0x14034d2f0]
lea r8, str.8_b5_
mov edx, 0x2b
call dbg.panic
ud2
mov qword [rsp + 0x30], 0
lea rdx, [0x140352650]
lea r9, str.library_std_src_syswindows_net.rs
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call dbg.assert_failed<i32, i32>
ud2

Function at 0x1401cd7c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x1401cd7f5
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401cd805
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x1401cf1e0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x1401cf260
jmp 0x1401cf24f
jae 0x1401cf304
cmp r8, 0x201
jae 0x1401cf260
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x1401cf2a7
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x1401cf287
lea rcx, [rsp + 0x30]
mov rdx, r15
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h2bdf9a6d8105bb54
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x1401cf2cb
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1401cf362
mov r8d, ebx
cmp rbp, r8
jne 0x1401cf240
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401cf382
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x1401cf24f
jmp 0x1401cf260
cmp r12, r8
jb 0x1401cf39c
lea rcx, [rsp + 0x48]
mov rdx, r13
call dbg.from_wide
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rdi, qword [rsp + 0x28]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
test rsi, rsi
je 0x1401cf34b
add rsi, rsi
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, rsi
call sym.__rust_dealloc
mov rax, rdi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rdi, qword [rsp + 0x28]
mov qword [rdi], rax
mov byte [rdi + 0x18], 2
test rsi, rsi
jne 0x1401cf335
jmp 0x1401cf34b
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call dbg.panic
jmp 0x1401cf3b1
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call dbg.slice_end_index_len_fail
ud2

Function at 0x1401cf3f0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x70
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x1401cf408
mov rdx, rax
add rsp, 0x70
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h777c0ce01dc2e028]
mov qword [rsp + 0x38], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rdx, str.library_std_src_syswindowsos.rs
lea rcx, [rsp + 0x40]
call dbg.panic_fmt
ud2