joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020a8e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x140214018]
test ecx, ecx
je 0x140020bc6
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140020ac6
mov rbx, rax
cmp qword [rax + 8], 0
je 0x140020ac6
add rbx, 0x10
jmp 0x140020bbb
mov ecx, dword [0x140214018]
test ecx, ecx
je 0x140020bd9
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140020b6f
mov rdi, rax
test rax, rax
jne 0x140020b35
mov al, byte [0x14030f1a8]
mov edx, 0x28
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x140020bff
mov rdi, rax
lea rax, section..data
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x140214018]
test ecx, ecx
je 0x140020bec
dec ecx
mov rdx, rdi
call fcn.1401a808c
lea rbx, [rdi + 8]
test rsi, rsi
je 0x140020b7d
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi], 0
cmp qword [rsp + 0x20], 0
je 0x140020b73
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x28]
jmp 0x140020b80
xor ebx, ebx
jmp 0x140020bbb
lea rcx, [rsp + 0x20]
call sym._ZN4core3ptr174drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_alloc..boxed..Box_LT_dy
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rdi + 8], 1
lea rbx, [rdi + 0x10]
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x20], rax
call sym._ZN4core3ptr174drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_alloc..boxed..Box_LT_dy
mov rax, rbx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, section..data
call dbg.init
mov ecx, eax
jmp 0x140020aa8
lea rcx, section..data
call dbg.init
mov ecx, eax
jmp 0x140020ad6
lea rcx, section..data
call dbg.init
mov ecx, eax
jmp 0x140020b2d
mov ecx, 8
mov edx, 0x28
call dbg.handle_alloc_error
int3

Function at 0x14002135b
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov qword [rdi], 0
lea rcx, [0x140222bb0]
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x14002139f
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400213d1
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call dbg.from_wide
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400520eb
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14006278e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
movaps xmmword [rsp + 0x190], xmm7
add byte [rax], al

Function at 0x140062d5c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rdx]
pxor xmm1, xmm0
pxor mm1, mm0
movdqa xmmword [rdx], xmm1
jg 0x140062d76
movdqa xmm1, xmmword [rdx + 0x10]
pxor xmm1, xmm0
pxor mm1, mm0
movdqa xmmword [rdx + 0x10], xmm1
Function at 0x140074f69
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14007501b
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call sym._ZN71__LT_std..hash..random..DefaultHasher_u20_as_u20_core..hash..Hasher_GT_5write17hd45a3bfd5bb134b9E.4866
test rdi, rdi
je 0x140075094
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400750ab
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x140075042
test rdx, rdx
je 0x1400751a0
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x1400751c1
mov r8, qword [rsi + 8]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x140075078
jmp 0x1400751c1
movzx eax, byte [rsi + 8]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call sym._ZN71__LT_std..hash..random..DefaultHasher_u20_as_u20_core..hash..Hasher_GT_5write17hd45a3bfd5bb134b9E.4866
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400751c1
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x1400751ab
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400751cd
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140075203
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14007520b
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140075210
xor r10d, r10d
jmp 0x1400752be
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140075233
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14007524a
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14007526a
add r11, r8
jmp 0x14007538f
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140075332
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400752e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140075344
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x14007534a
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140075371
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14007538b
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008bcea
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14008bd9c
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call sym._ZN71__LT_std..hash..random..DefaultHasher_u20_as_u20_core..hash..Hasher_GT_5write17hd45a3bfd5bb134b9E.4866
test rdi, rdi
je 0x14008be15
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14008be2c
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x14008bdc3
test rdx, rdx
je 0x14008bf21
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x14008bf42
mov r8, qword [rsi + 8]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x14008bdf9
jmp 0x14008bf42
movzx eax, byte [rsi + 8]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call sym._ZN71__LT_std..hash..random..DefaultHasher_u20_as_u20_core..hash..Hasher_GT_5write17hd45a3bfd5bb134b9E.4866
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14008bf42
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x14008bf2c
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400b86ed
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
lea rdx, [0x140278088]
mov r8d, 1
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x1400b8710
add rsp, 0x28
ret
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
lea rcx, [rax + 2]
add rsp, 0x28
jmp sym.core::ptr::drop_in_place_std::io::error::Error_::h1f4daee6a98f4d2e

Function at 0x1400c4e14
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rdi, qword [rcx]
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x1400c4e2b
dec ecx
jmp 0x1400c4e35
mov rcx, rdi
call dbg.init
mov ecx, eax
mov edx, 1
call fcn.1401a808c
cmp qword [rsi + 8], 0
je 0x1400c4e4e
lock dec qword [0x14030f050]
mov rcx, qword [0x14030f110]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x1400c4e6a
dec ecx
jmp 0x1400c4e74
mov rcx, rdi
call dbg.init
mov ecx, eax
xor edx, edx
call fcn.1401a808c
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1400c594a
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1400c599c
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400c599c
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400c599c
mov rbx, rax
xor esi, esi
jmp 0x1400c5a20
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1400c5a85
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400c5a85
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400c5a85
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400c5a85
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400c5a85
mov rbx, qword [rsp + 0x20]
mov al, byte [0x14030f1a8]
mov edx, 0x18
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x1400c5a9d
mov r14, rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbx
xor eax, eax
lock cmpxchg qword [0x14030f060], r14
je 0x1400c5a78
mov rsi, rax
cmp qword [r14], 0
je 0x1400c5a64
mov rcx, qword [r14 + 0x10]
call fcn.1401a7e14
mov rcx, qword [0x14030f110]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov r14, rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
lea r8, [0x140276850]
mov edx, 0x5b
call sym.std::panicking::begin_panic::h24e8c5520d7c465d
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
ud2

Function at 0x1400c66db
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400c66f2
dec ecx
jmp 0x1400c66fc
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call fcn.1401a808c
mov rcx, rdi
call sym._ZN4core3ptr265drop_in_place_LT_alloc..boxed..Box_LT_std..sys..pal..common..thread_local..os_local..Value_LT_alloc..rc..Rc_LT_
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400c6719
dec ecx
jmp 0x1400c6723
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
call fcn.1401a808c
nop
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400c68e4
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle sym.rand::rngs::adapter::reseeding::ReseedingCore_R_Rsdr_::reseed_and_generate::h1369ac1074acf291
cmp qword [rcx + 0x40], 0
js sym.rand::rngs::adapter::reseeding::ReseedingCore_R_Rsdr_::reseed_and_generate::h1369ac1074acf291
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp sym.rand_chacha::guts::refill_wide::h852f92df7e6dc7ee
Function at 0x1400c690b
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 0x20
call sym.__rand_core::os::OsRng_as_rand_core::RngCore_::try_fill_bytes::hde931bc6ac48dba6
test rax, rax
je 0x1400c694c
mov rcx, qword [0x14030f110]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
jmp 0x1400c69b6
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x90]
mov rcx, rbx
call sym.rand_chacha::guts::init_chacha::hf366e19e8be1c385
mov rax, qword [rbx]
movups xmm0, xmmword [rbx + 8]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, qword [rbx + 0x28]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
jmp sym.rand_chacha::guts::refill_wide::h852f92df7e6dc7ee
Function at 0x1400c90e7
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
mov r15d, 0xffffffff
xor esi, esi
cmp rdi, r15
mov r14d, 0xffffffff
cmovb r14, rdi
xor ecx, ecx
mov rdx, rbx
mov r8d, r14d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400c9139
mov ebp, eax
mov rcx, rbx
mov edx, r14d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400c9143
add rbx, r14
sub rdi, r14
jne 0x1400c9101
jmp 0x1400c916b
and ebp, 0x7fffffff
je 0x1400c9169
mov al, byte [0x14030f1a8]
mov edx, 4
xor ecx, ecx
call dbg.process_heap_alloc
test rax, rax
je 0x1400c917b
mov rsi, rax
mov dword [rax], ebp
jmp 0x1400c916b
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call dbg.handle_alloc_error
int3
Function at 0x1400f4227
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
Function at 0x1400f5c2b
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x78]
mov rdx, qword [rdx + 0x70]
cmp rdx, rcx
jb 0x1400f5dc3
mov rax, qword [rdi + 0x68]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x1400f5d39
cmp eax, 0x80090318
je 0x1400f5d97
test eax, eax
jne 0x1400f5d87
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x68]
mov rax, qword [rdi + 0x70]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x50], 0
add r9, r8
jb 0x1400f5dcf
cmp rax, r9
jb 0x1400f5dde
lea rax, [rdi + 0x40]
add rdx, rcx
mov rcx, rax
call sym.alloc::vec::Vec_T_A_::extend_from_slice::h713d337bc108938a
mov qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call sym.schannel::tls_stream::TlsStream_S_::consume_enc_in::h7726fd4f9ff6f475
xor eax, eax
cmp qword [rdi + 0x78], 0
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x1400f5db9
cmp eax, 0x90317
je 0x1400f5db3
cmp eax, 0x90321
jne 0x1400f5d87
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call sym.schannel::tls_stream::TlsStream_S_::consume_enc_in::h7726fd4f9ff6f475
mov qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x1400f5db9
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400f5db9
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x1400f5db7
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
call dbg.slice_end_index_len_fail
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
mov rdx, r9
call dbg.slice_index_order_fail
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
mov rcx, r9
mov rdx, rax
call dbg.slice_end_index_len_fail
int3
Function at 0x1400f6f7b
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x178]
mov rdx, qword [rdx + 0x170]
cmp rdx, rcx
jb 0x1400f7134
mov rax, qword [rdi + 0x168]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x1400f70a7
cmp eax, 0x80090318
je 0x1400f7108
test eax, eax
jne 0x1400f70f8
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x168]
mov rax, qword [rdi + 0x170]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x150], 0
add r9, r8
jb 0x1400f7140
cmp rax, r9
jb 0x1400f714f
lea rax, [rdi + 0x140]
add rdx, rcx
mov rcx, rax
call sym.alloc::vec::Vec_T_A_::extend_from_slice::h713d337bc108938a
mov qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call sym.schannel::tls_stream::TlsStream_S_::consume_enc_in::h7595783ff075e94a
xor eax, eax
cmp qword [rdi + 0x178], 0
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x1400f712a
cmp eax, 0x90317
je 0x1400f7124
cmp eax, 0x90321
jne 0x1400f70f8
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call sym.schannel::tls_stream::TlsStream_S_::consume_enc_in::h7595783ff075e94a
mov qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x1400f712a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400f712a
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x1400f7128
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
call dbg.slice_end_index_len_fail
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
mov rdx, r9
call dbg.slice_index_order_fail
lea r8, str.C:Users_soras.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64P
mov rcx, r9
mov rdx, rax
call dbg.slice_end_index_len_fail
int3
Function at 0x140137589
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne sym.tokio_native_tls::TlsStream_S_::with_context::h9cb3792ea0279aa2
add rcx, 8
jmp sym.__tokio::net::tcp::stream::TcpStream_as_tokio::io::async_read::AsyncRead_::poll_read::had58a60a091b2c0a