joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c790
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400cdd1f]
lea r8, str.BracedRangeExpr
mov rcx, rax
call fcn.140086720
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009c81b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009c800
mov byte [rsi + 4], 0
test r14, r14
je 0x14009c831
mov rcx, r14
mov rdx, rsi
call fcn.140096250
jmp 0x14009c856
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.1400979d0
mov rcx, rsi
mov rdx, rdi
call fcn.1400979d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400b68e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov al, byte [0x1400f1f78]
test al, al
je 0x1400b69df
cmp qword [0x142258870], 0
je 0x1400b6950
mov rax, qword [0x1400d9320]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x1422589c8]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140027780
mov rax, qword [0x1400d9310]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x142258978]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140027780
call fcn.1400b6af0
movzx eax, byte [rsi]
test al, 1
je 0x1400b695d
mov rax, qword [rsi + 8]
jmp 0x1400b695f
shr eax, 1
test rax, rax
je 0x1400b69d7
lea rcx, [0x1422587f0]
mov rdx, rsi
mov r8d, 0x10
call fcn.1400b6b30
cmp qword [0x142258870], 0
je 0x1400b6a15
mov rax, qword [0x1400d9310]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142258938]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140027780
mov rax, qword [0x1400d9320]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142258988]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140027780
nop
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400f1f78]
call fcn.140036710
test eax, eax
je 0x1400b68f7
call fcn.1400b6a50
lea rcx, [0x1400b6ae0]
call fcn.1400333a0
lea rcx, [0x1400f1f78]
call fcn.1400367eb
jmp 0x1400b68f7
mov rdi, qword [0x1400d9318]
lea rdx, str.Unable_to_open_debug_log_file
mov rcx, rdi
call fcn.14001b7f0
mov rcx, rdi
mov rdx, rsi
call fcn.14001b7c0
mov rcx, rdi
call fcn.14001bb80
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400ba120
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x1400ba152
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400ba1b1
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x1400ba19d
mov rcx, rbx
mov r8, r14
call fcn.1400c3d80
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x1400ba13b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x1400ba24e
lea rcx, [rbx*8]
call fcn.140025d00
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x1400ba225
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x1400ba214
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x1400ba13b
call fcn.140020740
mov r8, qword [rsi + 0x10]
jmp 0x1400ba13b
call fcn.14002ab90
int3

Function at 0x1400bd3c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9d, 0xffffffff
lea r8, [0x1400d8470]
cmp rdx, 4
jb 0x1400bd426
mov eax, r9d
xor r9b, byte [rcx]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
mov r9d, eax
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [r8 + rax*4]
mov eax, r9d
xor r9b, byte [rcx + 2]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
mov r9d, eax
xor al, byte [rcx + 3]
shr r9d, 8
movzx eax, al
xor r9d, dword [r8 + rax*4]
add rcx, 4
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x1400bd3d3
test rdx, rdx
je 0x1400bd44d
xor r10d, r10d
mov eax, r9d
xor r9b, byte [rcx + r10]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
inc r10
mov r9d, eax
cmp rdx, r10
jne 0x1400bd431
jmp 0x1400bd450
mov eax, r9d
not eax
ret
Function at 0x140001000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, str.notepad.exe
mov qword [r11 - 0x28], rax
lea r14, [r11 - 0x28]
lea rax, str.conhost.exe
mov qword [r11 - 0x20], rax
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [r14]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001114
nop
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x1400010a4
add rcx, 2
test eax, eax
jne 0x140001090
test edx, edx
jne 0x1400010fe
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400010db
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140003310]
jmp 0x1400010e2
lea rdx, [0x140003330]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001160
lea rdx, [0x140001340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x270]
add r14, 8
cmp r14, rax
jne 0x140001050
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001400
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret

Function at 0x140001cdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d26
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d28
xor al, al
add rsp, 0x28
ret
Function at 0x1407961b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14079633f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407961e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407961cf
add dl, dl
jne 0x1407961f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140796256
xor eax, eax
add dl, dl
jne 0x140796205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079630d
add dl, dl
jne 0x140796216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079623d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14079624a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407961de
mov eax, 1
add dl, dl
jne 0x140796266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079625b
sub eax, ebx
mov ebx, 1
jne 0x1407962ac
mov ecx, 1
add dl, dl
jne 0x14079628e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079629b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140796283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407961de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407962c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407962d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407962bd
cmp eax, 0x7d00
jae 0x1407962fb
cmp eax, 0x500
jb 0x1407962f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407961de
cmp eax, 0x7f
ja 0x1407962fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407961de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140796332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407961de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011140
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140011fe0
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400240a4]
call fcn.1400113a7
mov eax, dword [rbp + 0x100]
shl eax, 1
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.140011343
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011221
Capabilities:
Terminate process

Disassembly:
jmp 0x140013900
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112ad
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c70
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c83
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014cad
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014cc1
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014cd3
xor al, al
jmp 0x140014cf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014cef
xor al, al
jmp 0x140014cf1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400020f2
Capabilities:
Check http status code

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [rcx + 0x38], 2
je 0x1400021f9
mov rsi, rcx
cmp qword [rcx + 0x20], 0
je 0x140002114
mov rcx, rsi
call fcn.1400028b5
lea rcx, [rsi + 0x30]
call fcn.140002928
lea rcx, [rsi + 0x40]
cmp qword [rsi + 0x38], 0
je 0x14000212d
mov rsi, rcx
jmp 0x14000213f
call fcn.1400bdf2c
lea rcx, [rsi + 0x50]
call fcn.140002744
add rsi, 0x68
lea rdi, [rsi + 8]
cmp qword [rsi], 0
je 0x140002164
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400021f9
mov rcx, qword [rdi]
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400bdf14
mov rcx, rdi
call fcn.1400bdf75
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002190
mov rdx, qword [rsi + 0x10]
shl rdx, 5
mov r8d, 8
call fcn.140002a93
lea rcx, [rsi + 0x18]
call fcn.140048f1b
cmp qword [rsi + 0x30], 0
je 0x1400021be
mov edi, 0x30
cmp rdi, 0xc8
je 0x1400021be
mov rax, qword [rsi + rdi]
lock dec qword [rax]
jne 0x1400021b8
lea rcx, [rsi + rdi]
call fcn.1400be1a1
add rdi, 8
jmp 0x14000219c
mov rax, qword [rsi + 0x1f8]
lock dec qword [rax]
jne 0x1400021d7
lea rcx, [rsi + 0x1f8]
call fcn.14004ec0a
mov rax, qword [rsi + 0x200]
lock dec qword [rax]
jne 0x1400021f9
add rsi, 0x200
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400be021
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14001ab4a
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r9, r8
mov rax, rdx
not ecx
lea rbx, [0x1401647e8]
mov r15d, 0xff
lea r14, str.C:Usersyyy.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.2.1_src_baseline.rs
cmp r9, 0x40
jb 0x14001ac7a
mov edi, 4
test rdi, rdi
je 0x14001ab72
cmp r9, 0x10
jb 0x14001aca5
movzx edx, byte [rax + 0xf]
movzx ebp, byte [rax + 0xe]
mov ebp, dword [rbx + rbp*4 + 0x400]
xor ebp, dword [rbx + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rbx + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rbx + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rbx + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rbx + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rbx + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rbx + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rbx + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rbx + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rbx + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rbx + rdx*4 + 0x2c00]
movzx edx, byte [rax + 3]
mov esi, ecx
shr esi, 0x18
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3000]
movzx edx, byte [rax + 2]
mov esi, ecx
shr esi, 0x10
and esi, r15d
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3400]
movzx edx, byte [rax + 1]
mov esi, ecx
shr esi, 8
and esi, r15d
xor rsi, rdx
xor ebp, dword [rbx + rsi*4 + 0x3800]
movzx edx, byte [rax]
and ecx, r15d
xor rcx, rdx
xor ebp, dword [rbx + rcx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, r14
call fcn.14001acbb
mov r9, rdx
dec rdi
mov ecx, ebp
jmp 0x14001ab81
xor ebp, ebp
cmp r9, rbp
je 0x14001ac94
mov dl, byte [rax + rbp]
xor dl, cl
movzx edx, dl
shr ecx, 8
xor ecx, dword [rbx + rdx*4]
inc rbp
jmp 0x14001ac7c
not ecx
mov eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:Usersyyy.cargo_registry_srcgithub.com_1ecc6299db9ec823crc32fast_1.2.1_src_baseline.rs
mov ecx, send
mov rdx, r9
call fcn.1400ea290
ud2

Function at 0x14001dd70
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx]
xor r11d, r11d
movabs r10, 0x100000001b3
cmp r8, r11
je 0x14001dd96
movzx eax, byte [rdx + r11]
xor r9, rax
imul r9, r10
inc r11
jmp 0x14001dd80
mov qword [rcx], r9
ret

Function at 0x14001de53
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp byte [rcx], 1
jne 0x14001de87
mov ecx, 1
mov rdx, rsi
call fcn.14001dd4d
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001dd70
xor ecx, ecx
mov rdx, rsi
call fcn.14001dd4d
mov cl, byte [rdi + 1]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001dd9a
Function at 0x14008caba
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov r15, rcx
lea rbx, [rdx + 0xa8]
mov rdx, qword [rdx + 0xc0]
lea r8, str.C:Usersyyy.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.19_src_tls_stream.rs
mov rcx, rbx
call fcn.14008cc45
test rax, rax
mov ecx, edx
cmove rcx, rax
bts rcx, 0x20
lea rsi, [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
lea rdx, [rsp + 0x60]
mov qword [rdx + 8], rsi
movabs rax, 0x400000000
mov qword [rdx], rax
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14008cb93
test eax, eax
je 0x14008cba4
cmp eax, 0x90317
je 0x14008cc20
cmp eax, 0x90321
jne 0x14008cc28
mov dword [rdi + 0x108], 0x10000
mov byte [rdi + 0x10c], 0
xor eax, eax
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14008cc85
and qword [rdi + 0x80], 0
jmp 0x14008cc19
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
jmp 0x14008cc12
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0xa8]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x88]
and qword [rdi + 0x98], 0
mov rcx, rbx
call fcn.14008cc5a
lea r8, [rdx + rax]
mov rcx, r14
mov rdx, rax
call fcn.14000d84e
and qword [rdi + 0xa0], 0
xor esi, esi
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
mov eax, dword [rsp + 0x50]
cmovne eax, esi
sub rdx, rax
mov rcx, rdi
call fcn.14008cc85
xor eax, eax
cmp qword [rdi + 0xc0], rsi
sete al
mov qword [rdi + 0x80], rax
and word [r15], 0
jmp 0x14008cc39
mov word [r15], 0x100
jmp 0x14008cc39
shl rax, 0x20
mov qword [r15 + 8], rax
and qword [r15 + 0x10], 0
mov byte [r15], 1
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14008e926
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov r15, rcx
lea rbx, [rdx + 0x1b0]
mov rdx, qword [rdx + 0x1c8]
lea r8, str.C:Usersyyy.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.19_src_tls_stream.rs
mov rcx, rbx
call fcn.14008cc45
test rax, rax
mov ecx, edx
cmove rcx, rax
bts rcx, 0x20
lea rsi, [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
lea rdx, [rsp + 0x60]
mov qword [rdx + 8], rsi
movabs rax, 0x400000000
mov qword [rdx], rax
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14008e9ff
test eax, eax
je 0x14008ea10
cmp eax, 0x90317
je 0x14008ea8c
cmp eax, 0x90321
jne 0x14008ea94
mov dword [rdi + 0x210], 0x10000
mov byte [rdi + 0x214], 0
xor eax, eax
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c8]
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14008eab1
and qword [rdi + 0x188], 0
jmp 0x14008ea85
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
jmp 0x14008ea7e
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x1b0]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x190]
and qword [rdi + 0x1a0], 0
mov rcx, rbx
call fcn.14008cc5a
lea r8, [rdx + rax]
mov rcx, r14
mov rdx, rax
call fcn.14000d84e
and qword [rdi + 0x1a8], 0
xor esi, esi
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c8]
mov eax, dword [rsp + 0x50]
cmovne eax, esi
sub rdx, rax
mov rcx, rdi
call fcn.14008eab1
xor eax, eax
cmp qword [rdi + 0x1c8], rsi
sete al
mov qword [rdi + 0x188], rax
and word [r15], 0
jmp 0x14008eaa5
mov word [r15], 0x100
jmp 0x14008eaa5
shl rax, 0x20
mov qword [r15 + 8], rax
and qword [r15 + 0x10], 0
mov byte [r15], 1
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14009bddd
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, r8
mov rsi, rdx
mov r14, rcx
lea rbx, [rsp + 0x50]
mov r8d, recv
mov rcx, rbx
mov rdx, rax
call fcn.14009bef7
lea r12, [rsp + 0x30]
mov dword [r12], 0x800
lea rdi, [rsp + 0x34]
and dword [rdi], 0
lea r15, [rsp + 0x38]
mov edx, 0x800
mov rcx, r15
call fcn.14000dbdc
mov rsi, qword [rsi]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
mov r9, rdi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14009be6b
mov edx, dword [rsp + 0x30]
mov rcx, r15
call fcn.14000d887
jmp 0x14009be36
test eax, eax
jne 0x14009be8d
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xc
jb 0x14009bead
movabs rax, 0xde00000000
jmp 0x14009be91
shl rax, 0x20
mov qword [r14 + 8], rax
and qword [r14 + 0x10], 0
mov qword [r14], 1
lea rcx, [rsp + 0x38]
call fcn.14000d698
jmp 0x14009bec8
mov rcx, qword [rsp + 0x48]
mov qword [r14 + 0x18], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r14 + 8], xmm0
mov byte [r14 + 0x20], al
and qword [r14], 0
lea rcx, [rsp + 0x50]
call fcn.1400d9c4e
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400a85fd
Capabilities:
Get remote cert context via schannel

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
lea r8, [rsp + 0x28]
and qword [r8], 0
mov rcx, rdx
mov edx, 0x53
call sub.Secur32.dll_QueryContextAttributesW
mov rcx, rax
shl rcx, 0x20
test eax, eax
jne 0x1400a862b
mov rcx, qword [rsp + 0x28]
je 0x1400a863d
mov qword [rsi + 8], rcx
and qword [rsi + 0x10], 0
mov eax, 1
jmp 0x1400a8643
mov qword [rsi + 8], rcx
xor eax, eax
mov qword [rsi], rax
add rsp, 0x30
pop rsi
ret

Function at 0x1400a875b
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx + 8]
cmp qword [rdx], 1
jne 0x1400a8783
mov rax, qword [rdx + 0x10]
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
jmp 0x1400a88aa
mov rax, qword [0x140202d30]
cmp rax, 3
jne 0x1400a88bc
cmp dword [rdi], 1
mov ebp, 0x17
mov eax, 2
cmovne ebp, eax
and dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x81
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400a87ff
cmp dword [rdi], 1
mov eax, 0x1c
mov r8d, reloc.WS2_32.dll_recv
cmove r8d, eax
add rdi, 4
mov rcx, rbx
mov rdx, rdi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x1400a8871
mov qword [rsi + 8], rbx
and qword [rsi], 0
jmp 0x1400a88b1
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x1400a8819
mov r14d, eax
cmp eax, 0x2726
jne 0x1400a889c
and dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400a8894
mov rbx, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x1400a87cc
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
xor edi, edi
mov rcx, rbx
call fcn.1400de116
jmp 0x1400a88a2
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
and qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, rbx
call fcn.1400de116
jmp 0x1400a88b1
call sub.WS2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
xor edi, edi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov qword [rsi], 1
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rax, [rsp + 0x37]
mov byte [rax], 1
lea r8, [rsp + 0x38]
mov qword [r8], rax
lea rcx, [0x140202d30]
lea r9, [0x1401b7060]
xor edx, edx
call fcn.1400ec220
jmp 0x1400a8794