joyce8/EMBER2024-capa huggingface dataset:
Function at 0x535440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53552a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf8b880adadb275f7
mov qword [rsp + 0x35], rdx
movabs rdx, 0xd554e4f8b880adad
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc3b3a37fbc643957
mov qword [rsp + 0x40], rdx
movabs rdx, 0x12100c1107080a07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x100f0511001210
mov qword [rsp + 0x25], rdx
movabs rdx, 0x60a030e07021104
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x5354cd
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x29]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x29]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x5354fa
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x53551d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x5354b0
jmp 0x535511
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456420
mov eax, edi
mov ecx, 0x13
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00535440

Function at 0x5363c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536498
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xdd461f10c0fdca24
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xcc242195
movabs rdx, 0x8000a020700080b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x30908000a020700
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x505010b04090b01
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x536434
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x536468
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x53648b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
nop
cmp rsi, 0xc
jb 0x53641a
jmp 0x53647f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.005363c0
Function at 0x538fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5390ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5a722470735d6f6e
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x656c635b
movabs rdx, 0x303050307030203
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x807050906020303
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x539045
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x53907c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x53909f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 0xc
jb 0x53902b
jmp 0x539093
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00538fe0

Function at 0x53bb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53bc4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2fdc286165f3c675
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xc52d336c622fdc28
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0505060a02070a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x701060a0b0a0c05
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x53bbef
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x53bc1c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x53bc3f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x53bbd2
jmp 0x53bc33
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456420
mov eax, edi
mov ecx, 0xd
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053bb80

Function at 0x53bc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53bd27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x657e787465676e75
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x65686665
movabs rdx, 0x805050605070804
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x809020202070805
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x53bcc8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 7]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 7]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x53bcf7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x53bd1a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x53bcab
jmp 0x53bd0e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053bc60
Function at 0x53c1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c2ec
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xb3ff947517b20a69
mov qword [rsp + 0x53], rdx
movabs rdx, 0xfff1a4f120b3ff94
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe6f26bf09e8e3a7e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x5f727f650dfc0116
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2065707935ff0249
mov qword [rsp + 0x70], rdx
movabs rdx, 0x71f0a0103051a15
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x61b160d030c071f
mov qword [rsp + 0x23], rdx
movabs rdx, 0x21718180b140911
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1040d1c1e170f04
mov qword [rsp + 0x33], rdx
movabs rdx, 0xb1717171d111c0a
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1710150c13161e0f
mov qword [rsp + 0x43], rdx
movabs rdx, 0x1c15111d1120060d
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x53c284
movzx r9d, byte [rsp + rsi + 0x53]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4f]
mov byte [rsp + rdi + 0x53], dl
mov byte [rsp + rsi + 0x53], r8b
add rax, 2
cmp rax, 0x36
jge 0x53c2bc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x53c2df
movzx r8d, byte [rsp + rdi + 0x53]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4f]
cmp rsi, 0x25
jb 0x53c26a
jmp 0x53c2d3
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x25
call fcn.00444780
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456420
mov eax, edi
mov ecx, 0x25
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053c1a0

Function at 0x53cea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53cfa8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa744ee026ff7bef8
mov qword [rsp + 0x37], rdx
movabs rdx, 0xda051520b841650f
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x96da051520b84165
mov qword [rsp + 0x40], rdx
movabs rdx, 0x781474754db3d018
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa10170b07100005
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x110f040702060110
mov qword [rsp + 0x23], rdx
movabs rdx, 0x13010d12110f0407
mov qword [rsp + 0x27], rdx
movabs rdx, 0x80e0d10020e0117
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x53cf4b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1c
jge 0x53cf78
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x53cf9b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x53cf2e
jmp 0x53cf8f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456420
mov eax, edi
mov ecx, 0x19
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053cea0
Function at 0x53ede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53eea6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x656d01743b532f20
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x58495065
movabs rdx, 0xa08090800080303
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x3050902
xor eax, eax
jmp 0x53ee40
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x53ee72
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x53ee97
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
cmp rsi, 0xb
jb 0x53ee24
jmp 0x53ee8b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053ede0

Function at 0x53fb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53fc1d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x409f732f80bb6475
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x9ea0
movabs rdx, 0x906030807000902
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x2090603
xor eax, eax
jmp 0x53fbc0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x53fbed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x53fc10
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x53fba3
jmp 0x53fc04
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456420
mov eax, edi
mov ecx, 0xa
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.0053fb60

Function at 0x53fc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53fd0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8b83732f76658c44
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x81756f8b
movabs rdx, 0x7070000070a0107
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x106010a060a0707
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x53fca5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x53fcdc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x53fcff
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0xb
jb 0x53fc8b
jmp 0x53fcf3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053fc40
Function at 0x54ae20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54af0c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x52364a2263323130
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3852364a22633231
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4b65262e63211769
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10030e04090f0a03
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd07100910030e04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe0d050e0304030b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54aeaa
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xb]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x54aedc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54aeff
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xb]
cmp rsi, 0x11
jb 0x54ae90
jmp 0x54aef3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0054ae20

Function at 0x54bbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54bcca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4fd8193bbb321130
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x164fd8193bbb3211
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5dfc160b39620612
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0c0d090a040a03
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe070508060c0f0c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd060d0c0e100401
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54bc6d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x54bc9a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54bcbd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x54bc50
jmp 0x54bcb1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0054bbe0
Function at 0x54bce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54bdca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xffd26c27333231ec
mov qword [rsp + 0x37], rdx
movabs rdx, 0x32ffd26c27333231
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5866652427035416
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb10000b07060404
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd07060810050009
mov qword [rsp + 0x27], rdx
movabs rdx, 0xc0a04050c060d04
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54bd6d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x54bd9a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54bdbd
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x54bd50
jmp 0x54bdb1
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0054bce0

Function at 0x54c700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c7ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1e363515333218dd
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xe21e363515333218
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7866ecf591f9a801
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80e010a040c0908
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x70e080e010a040c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd0b0401070004
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54c78d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x54c7ba
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54c7dd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x54c770
jmp 0x54c7d1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0054c700
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1403c8aa0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1403c8ab0]
mov dword [rax], 1
mov rax, qword [0x1403c8ac0]
mov dword [rax], 1
mov rax, qword [0x1403c8a20]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1403c8a90]
mov dword [0x1403eb00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1403c8b70]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1403c8b50]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1403c8a00]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
in al, dx
pop rax
mov rsi, rcx
mov rbx, qword [0x140182048]
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140001e80
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140001e99
add rax, 8
jmp 0x140001f3f
mov rcx, qword [0x140182048]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140001e77
je 0x140001f3d
test rsi, rsi
je 0x140001eb5
mov rdi, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x140001ecf
mov rax, qword [0x140182028]
mov edi, 1
lock xadd qword [rax], rdi
test rdi, rdi
je 0x140001f78
mov rax, qword [0x1403c8b08]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140001f69
mov r14, rax
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140001f49
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140001f59
dec ecx
add r14, 8
mov rdx, rsi
call fcn.14017fffc
test rdi, rdi
je 0x140001f38
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, r14
jmp 0x140001f3f
xor eax, eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140182048]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
jmp 0x140001f03
mov rcx, qword [0x140182048]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
jmp 0x140001f14
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h51d221331ea27b21
lea rax, str.regex:_thread_ID_allocation_space_exhausted
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:Userswin10_x64.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.7_srcutilpool.rs
lea rcx, [rsp + 0x28]
call sym.core::panicking::panic_fmt::h57c46dec66ad69af
int3
Function at 0x140018ab0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140018ac7
dec ecx
jmp 0x140018ad1
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
mov edx, 1
call fcn.14017fffc
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140018af9
dec ecx
jmp 0x140018b03
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
xor edx, edx
call fcn.14017fffc
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140018b40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rbx, qword [0x140182220]
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140018b75
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140018b8e
add rax, 8
jmp 0x140018c3a
mov rcx, qword [0x140182220]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140018b6c
je 0x140018c38
test rsi, rsi
je 0x140018baa
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x140018bc6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x1403c8b08]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140018c69
mov r14, rax
mov rsi, rax
mov qword [rax], rbx
movups xmmword [rax + 8], xmm6
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140018c49
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x140018c59
dec ecx
add r14, 8
mov rdx, rsi
call fcn.14017fffc
test rdi, rdi
je 0x140018c33
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, r14
jmp 0x140018c3a
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140182220]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
jmp 0x140018bfe
mov rcx, qword [0x140182220]
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h71d97aa0af732720
mov ecx, eax
jmp 0x140018c0f
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h51d221331ea27b21
int3
Function at 0x140025420
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140025462
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14002546a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002547b
jmp 0x140025492
xor r10d, r10d
jmp 0x14002551d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140025492
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400254a9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400254c9
add r11, r8
jmp 0x1400255fb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140025592
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140025540
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400255b0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400255c2
jmp 0x1400255dd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400255dd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400255f7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret