joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008cf73
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 3
mov r9d, 3
cmovb r9, rdx
test r9, r9
je 0x14008cfa9
xor r10d, r10d
xor eax, eax
mov dl, byte [r8 + rax]
xor dl, byte [rcx + rax]
lea r11, [rax + 1]
or r10b, dl
mov rax, r11
cmp r9, r11
jne 0x14008cf8b
test r10b, 0xdf
sete al
ret
mov al, 1
ret

Function at 0x14009638a
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, dword [rdx + 2]
movzx eax, word [rdx + 6]
shl rax, 0x20
or rax, r8
cmp word [rdx], 0
je 0x1400963fb
movzx r8d, word [rdx + 0x1c]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
shr rax, 0x10
rol r8w, 8
mov dword [rcx + 8], eax
mov rax, qword [rdx + 8]
mov qword [rcx + 0xc], rax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x14], eax
xorps xmm0, xmm0
movups xmmword [rcx + 0x1c], xmm0
movups xmmword [rcx + 0x2c], xmm0
movups xmmword [rcx + 0x3c], xmm0
movups xmmword [rcx + 0x4c], xmm0
movups xmmword [rcx + 0x5c], xmm0
movups xmmword [rcx + 0x6c], xmm0
mov dword [rcx + 0x7c], 0
mov word [rcx], 0x17
mov dword [rcx + 0x18], r10d
mov edx, 0x1c
mov eax, r9d
jmp 0x140096438
mov r8, rax
shr r8, 0x20
rol r8w, 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x70], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
mov word [rcx], 2
mov qword [rcx + 8], 0
mov edx, 0x10
mov word [rcx + 2], r8w
mov dword [rcx + 4], eax
mov dword [rcx + 0x80], edx
ret
Function at 0x14012556a
Capabilities:
Connect socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140126d5f
cmp qword [rdi], 0
je 0x1401255b4
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov qword [rsi + 8], 0xffffffffffffffff
jmp 0x14012567e
mov r14, qword [rsp + 0x28]
mov eax, dword [rbx + 2]
movzx edi, word [rbx + 6]
mov r9, qword [rbx + 0xc]
mov r10d, dword [rbx + 0x18]
cmp word [rbx], 0
je 0x140125601
movzx ecx, di
movzx edi, word [rbx + 0x1c]
mov edx, dword [rbx + 8]
mov r11d, dword [rbx + 0x14]
rol di, 8
shr rax, 0x10
shl rdx, 0x20
shl rcx, 0x10
or rcx, rdx
or rcx, rax
mov r8d, 0x1c
mov bx, 0x17
mov eax, r11d
jmp 0x140125611
rol di, 8
mov r8d, 0x10
mov bx, 2
xor ecx, ecx
lea rdx, [rsp + 0x30]
mov word [rdx], bx
mov word [rdx + 2], di
mov dword [rdx + 4], eax
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], r9
mov dword [rdx + 0x18], r10d
mov rcx, r14
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14012565d
call sub.KERNEL32.DLL_GetLastError
mov rbx, rax
shl rbx, 0x20
or rbx, 2
mov ecx, eax
call fcn.14023d1e0
cmp al, 0xd
jne 0x14012566a
mov rcx, rbx
call fcn.14007eeac
mov qword [rsi], 0
mov qword [rsi + 8], r14
jmp 0x14012567e
mov qword [rsi], rbx
mov qword [rsi + 8], 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140126d5f
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov rax, qword [0x14051f0a8]
cmp rax, 3
jne 0x140126e05
mov ecx, edi
mov edx, 1
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x140126ddc
mov rdi, rax
lea r8, [rsp + 0x34]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x140126df4
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov qword [rsi + 8], rbx
jmp 0x140126ded
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140126dfa
mov qword [rsi + 8], rdi
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x33]
mov byte [rax], 1
lea r8, [rsp + 0x38]
mov qword [r8], rax
lea rax, [0x14044e928]
mov qword [rsp + 0x20], rax
lea rcx, [0x14051f0a8]
lea r9, [0x14044e1d8]
xor edx, edx
call fcn.1403b92c0
jmp 0x140126d87
Function at 0x14012fbd8
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x60], r9
mov r14d, ecx
mov r10, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
movzx eax, r8b
mov qword [rsp + 0x58], rax
test dl, dl
jne 0x14012fd70
mov r12d, r10d
and r12d, 0x1f
mov rbx, r10
and rbx, 0xffffffffffffffe0
lea r13, [rsi + rbx]
lea r9, [0x140451478]
mov r15, 0xffffffffffffffff
xor r14d, r14d
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rdi
mov rdi, r9
mov cl, byte [r9]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], rsi
mov r8, qword [rsp + 0xf0]
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x57], cl
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
call fcn.14012fdc8
test rbx, rbx
je 0x14012fcd4
mov rdx, rsi
mov rax, rbx
xor ebp, ebp
mov r9, rdi
lea r8, [rdx + 0x20]
xor edi, edi
xor esi, esi
mov bl, byte [rdx + rsi]
inc rsi
mov ecx, ebx
sar cl, 7
xor bl, cl
sub bl, cl
movzx ecx, bl
add rdi, rcx
cmp rsi, 0x20
jne 0x14012fca7
add rbp, rdi
cmovb rbp, r15
mov rdx, r8
add rax, 0xffffffffffffffe0
jne 0x14012fc9f
jmp 0x14012fcd9
xor ebp, ebp
mov r9, rdi
inc r9
test r12, r12
je 0x14012fd1d
xor edx, edx
xor ecx, ecx
mov rsi, qword [rsp + 0xf8]
mov r10, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x68]
mov r8b, byte [rsp + 0x57]
mov bl, byte [r13 + rdx]
mov eax, ebx
sar al, 7
xor bl, al
sub bl, al
movzx eax, bl
add rcx, rax
inc rdx
cmp r12, rdx
jne 0x14012fcff
jmp 0x14012fd39
xor ecx, ecx
mov rsi, qword [rsp + 0xf8]
mov r10, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x68]
mov r8b, byte [rsp + 0x57]
add rbp, rcx
cmovb rbp, r15
cmp rbp, rdi
movzx eax, r14b
movzx r14d, r8b
cmova r14d, eax
cmovb rdi, rbp
lea rax, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823png_0.17.10_src_text_metadata.rsunreachable
cmp r9, rax
mov rbx, qword [rsp + 0x70]
jne 0x14012fc40
mov al, 4
cmp r14b, 4
je 0x14012fdb6
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], rsi
mov r8, qword [rsp + 0xf0]
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov ecx, r14d
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
call fcn.14012fdc8
mov eax, r14d
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140131894
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140134198
test rax, rax
je 0x1401318d1
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x14013190a
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.140134131
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140131c38
Function at 0x140134198
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x1401341fb
mov edi, eax
mov rcx, rbx
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401341da
xor esi, esi
jmp 0x1401341fb
xor edi, 0x80000000
je 0x1401341d6
mov ecx, 4
mov edx, 4
call fcn.14002c720
test rax, rax
je 0x140134206
mov rsi, rax
mov dword [rax], edi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.1403af440
ud2

Function at 0x1401355cb
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov r15, rdx
mov r13, rcx
mov r12, qword [rdx + 0x20]
mov al, byte [rdx + 0x28]
mov byte [rsp + 0x77], al
lea rcx, [rsp + 0x80]
call fcn.140134eef
mov rax, qword [r15 + 0x58]
mov qword [rsp + 0x78], rax
movabs r8, 0x7465646279746573
movabs r9, 0x6c7967656e657261
movabs r10, 0xded7d4e2d7dedfc6
movabs rbx, 0xa60c596fc19fead0
movabs rdi, 0xe414a674f0de7325
mov eax, 1
lock xadd qword [0x14051f0c0], rax
mov rsi, rax
xor rsi, r8
lea rcx, [rsi + r9]
mov rdx, rsi
rol rdx, 0x10
xor rdx, rcx
lea rcx, [rdx + r10]
rol rdx, 0x15
xor rdx, rcx
add rsi, rbx
mov r14, rsi
xor r14, rdi
rol rsi, 0x20
xor rax, rcx
add rax, r14
rol r14, 0xd
mov rcx, rdx
xor r14, rax
rol rax, 0x20
btc rcx, 0x3b
add rsi, rcx
shrd rcx, rdx, 0x30
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
add rsi, r14
rol r14, 0x11
xor rcx, rax
xor r14, rsi
rol rsi, 0x20
btc rax, 0x3b
add rax, r14
rol r14, 0xd
xor r14, rax
rol rax, 0x20
xor rsi, 0xff
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
add rsi, r14
rol r14, 0x11
xor r14, rsi
rol rsi, 0x20
xor rcx, rax
add rax, r14
rol r14, 0xd
xor r14, rax
rol rax, 0x20
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
add rsi, r14
rol r14, 0x11
xor r14, rsi
rol rsi, 0x20
xor rcx, rax
add rax, r14
rol r14, 0xd
xor r14, rax
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
rol rcx, 0x15
add rsi, r14
rol r14, 0x11
xor r14, rsi
rol rsi, 0x20
xor r14, rcx
xor r14, rsi
je 0x140135643
mov rsi, qword [r15 + 0x60]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [r13 + 0x110], xmm1
movups xmmword [r13 + 0x100], xmm0
mov qword [r13 + 0x120], r12
mov al, byte [rsp + 0x77]
mov byte [r13 + 0x128], al
lea rdx, [rsp + 0x80]
mov r8d, pe_nt_image_headers64
mov rcx, r13
call fcn.1403abad0
mov rax, qword [rsp + 0x78]
mov qword [r13 + 0x130], rax
mov qword [r13 + 0x138], r14
mov qword [r13 + 0x140], rsi
add r15, 0x40
mov rcx, r15
call fcn.140006070
nop
lea rsp, [rbp + 0x138]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401b4e57
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov r14, rcx
lea rsi, [rsp + 0x50]
mov r8d, 0xb
mov rcx, rsi
mov rdx, rax
call fcn.1401c49aa
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r12, [rsp + 0x34]
mov dword [r12], 0
mov ecx, 0x800
call fcn.140236215
mov rdi, rdx
lea r15, [rsp + 0x38]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0
mov rsi, qword [rsi + 8]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9, r12
call rbp
cmp eax, 0xea
jne 0x1401b4f11
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x1401b4ecc
mov rcx, r15
call fcn.1403b89f8
mov rdi, qword [rsp + 0x40]
jmp 0x1401b4ecc
test eax, eax
jne 0x1401b4f33
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1401b4f5f
movabs rax, 0xde00000002
jmp 0x1401b4f3b
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
cmp qword [rsp + 0x38], 0
je 0x1401b4f75
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x1401b4f75
mov rcx, qword [rsp + 0x48]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
cmp qword [rsp + 0x50], 0
je 0x1401b4f91
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401b5b8f
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1401b5d1f
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea rbx, [rsp + 0x20]
movups xmmword [rbx + 0x30], xmm0
mov dword [rbx], ecx
mov dword [rbx + 4], 1
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1401b5c95
cmp eax, 0x80090318
je 0x1401b5cf3
test eax, eax
jne 0x1401b5ce3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov r9, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov rax, rcx
mov qword [rdi + 0x18], 0
add rax, r8
jb 0x1401b5d2d
cmp r9, rax
jb 0x1401b5d3e
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.140057f93
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401b5ee4
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x1401b5d15
cmp eax, 0x90317
je 0x1401b5d0f
cmp eax, 0x90321
jne 0x1401b5ce3
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401b5ee4
mov qword [rdi + 0x1d8], 0
mov byte [rsi + 1], bl
jmp 0x1401b5d15
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1401b5d15
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x1401b5d13
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
call fcn.1403af940
ud2
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rdx, rax
call fcn.1403afbd0
ud2
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, rax
mov rdx, r9
jmp 0x1401b5d26
Function at 0x1401b6d3a
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1401b6eca
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea rbx, [rsp + 0x20]
movups xmmword [rbx + 0x30], xmm0
mov dword [rbx], ecx
mov dword [rbx + 4], 1
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1401b6e40
cmp eax, 0x80090318
je 0x1401b6e9e
test eax, eax
jne 0x1401b6e8e
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov r9, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov rax, rcx
mov qword [rdi + 0x18], 0
add rax, r8
jb 0x1401b6ed8
cmp r9, rax
jb 0x1401b6ee9
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.140057f93
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1401b5ee4
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x1401b6ec0
cmp eax, 0x90317
je 0x1401b6eba
cmp eax, 0x90321
jne 0x1401b6e8e
mov dword [rdi + 0x108], 0x10000
xor ebx, ebx
mov byte [rdi + 0x10c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1401b5ee4
mov qword [rdi + 0xd8], 0
mov byte [rsi + 1], bl
jmp 0x1401b6ec0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1401b6ec0
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x1401b6ebe
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
call fcn.1403af940
ud2
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rdx, rax
call fcn.1403afbd0
ud2
lea r8, str.C:Usersuser1.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.22_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, rax
mov rdx, r9
jmp 0x1401b6ed1
Function at 0x1401c0b31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r12, rdx
add rdx, 0x28
cmp qword [r12 + 0x20], 0
je 0x1401c0b81
cmp qword [r12 + 0x58], 0xffffffffffffffff
mov r8, qword [r12]
mov r9, qword [r12 + 8]
mov rax, qword [r12 + 0x10]
mov rbp, qword [r12 + 0x18]
je 0x1401c0c73
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x1401c0c82
mov r14b, byte [r12 + 0x3a]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov r15b, byte [r12 + 0x38]
mov r8, qword [r12 + 0x28]
xor r11d, r11d
test r14b, r14b
jne 0x1401c0caa
mov ebx, r15d
xor bl, 1
mov byte [r12 + 0x38], bl
test r8, r8
je 0x1401c0bcc
cmp r9, r8
jbe 0x1401c0bc6
cmp byte [r10 + r8], 0xbf
jg 0x1401c0bcc
jmp 0x1401c0cbc
jne 0x1401c0cbc
cmp r8, r9
je 0x1401c0c89
mov al, byte [r10 + r8]
movzx ebp, al
test bpl, bpl
jns 0x1401c0c2f
mov esi, ebp
and esi, 0x1f
movzx edi, byte [r10 + r8 + 1]
and edi, 0x3f
cmp bpl, 0xdf
jbe 0x1401c0c21
movzx ebp, byte [r10 + r8 + 2]
shl edi, 6
and ebp, 0x3f
or ebp, edi
cmp al, 0xf0
jb 0x1401c0c2a
movzx eax, byte [r10 + r8 + 3]
and esi, 7
shl esi, 0x12
shl ebp, 6
and eax, 0x3f
or eax, ebp
or eax, esi
mov ebp, eax
jmp 0x1401c0c2f
shl esi, 6
or esi, edi
mov ebp, esi
jmp 0x1401c0c2f
shl esi, 0xc
or ebp, esi
test r15b, r15b
jne 0x1401c0c99
cmp ebp, 0x110000
je 0x1401c0c8e
mov eax, 1
cmp ebp, 0x80
jb 0x1401c0c65
mov eax, 2
cmp ebp, 0x800
jb 0x1401c0c65
cmp ebp, 0x10000
mov eax, 4
sbb rax, 0
add r8, rax
mov qword [rdx], r8
mov r15d, ebx
jmp 0x1401c0b9c
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
call fcn.140007ff9
jmp 0x1401c0cad
test r15b, r15b
jne 0x1401c0c9c
mov byte [r12 + 0x3a], 1
xor r11d, r11d
jmp 0x1401c0caa
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r11d, 1
mov qword [rcx], r11
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str._rustc_d5a82bbd26e1ad8b7401f6a718a9c57c96905483librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.1403afdc0
ud2
Function at 0x1401f2c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov qword [rsp + 0x40], r9
mov ebp, r8d
mov dword [rsp + 0x34], edx
mov r13, rcx
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x1e0]
mov r15, qword [rdi + 8]
mov ebx, dword [rdi]
mov esi, dword [rdi + 4]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007e008
mov r14b, byte [rax + 0x60]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007e008
mov r12b, byte [rax + 0x60]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007e008
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x50], rax
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007e008
cmp r14b, 5
ja 0x1401f2d19
cmp r14b, 3
jne 0x1401f2d6b
mov byte [rsp + 0x33], r12b
mov r12, r13
mov r13d, dword [rax + 0xb8]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007fdfe
mov r14, rax
lea rcx, [rax + 0x60]
call fcn.140086402
mov byte [r14 + 0x60], 0
mov byte [r14 + 0x61], bpl
mov dword [r14 + 0x64], r13d
mov eax, dword [rsp + 0x34]
mov dword [r14 + 0x68], eax
cmp byte [rsp + 0x33], 5
ja 0x1401f2d7f
cmp qword [rsp + 0x50], 0
jne 0x1401f2d7f
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
mov r14, qword [rsp + 0x40]
mov rdx, r14
mov r8, rdi
call fcn.1401c1b43
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebx
mov r9d, esi
call fcn.14007e008
mov eax, dword [rax + 0xb8]
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdx + 8], eax
mov byte [rdx], 8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, r12
mov r8, r14
mov r9, rdi
call fcn.1401c1e68
mov rcx, r12
mov rdx, rdi
mov r8, qword [rsp + 0x48]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14008770b
Function at 0x1401f323b
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
test rcx, rcx
je 0x1401f3273
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rcx], 0
cmp rdx, 1
je 0x1401f3409
lea rcx, [0x14025f150]
call fcn.1400903c5
movabs r13, 0x736f6d6570736575
xor r13, rax
movabs rsi, 0x646f72616e646f6d
xor rsi, rdx
movabs rbp, 0x6c7967656e657261
mov qword [rsp + 0x28], rax
xor rbp, rax
movabs r12, 0x7465646279746573
mov r15, rdx
xor r12, rdx
mov r14d, 1
xorps xmm6, xmm6
lea rax, [rsp + 0x68]
movups xmmword [rax], xmm6
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x30], r14
mov r8d, 8
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.140078e87
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
shl rbx, 0x38
or rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0xd
xor rcx, rbx
xor rax, rdx
rol rdx, 0x20
mov rdi, qword [rsp + 0x40]
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rcx, rdx
xor rax, rdi
rol rdi, 0x20
xor rdx, rbx
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
xor rdi, 0xff
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
rol rcx, 0x15
xor rax, rdx
add rdi, rax
rol rax, 0x11
mov rdx, rdi
rol rdx, 0x20
xor rax, rdi
xor rax, rcx
inc r14
xor rax, rdx
je 0x1401f32c4
mov ecx, dword [0x14051f7b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret