joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069a10
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne case.0x140048c13.406
test al, 1
je 0x140069ac8
test al, 2
jne 0x140069ae0
test al, 8
jne 0x140069a5a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xc8], 4
lea rdx, [rsp + 0x58]
call fcn.140069840
jmp 0x140069a78
test al, 0x10
je 0x140069a78
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140069b64
test byte [rax], 0
invalid
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140069af8
jne 0x140069abe
mov rcx, rsi
add rsp, 0xd0
pop rsi
jmp fcn.140069770
nop
add rsp, 0xd0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.140012c90]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x14014ac08]
lea rcx, [rsp + 0x58]
call fcn.140104620
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x14016f768]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.140104620
int3
Function at 0x14006bd40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14006bd60
test al, 1
je 0x14006bf4a
test al, 2
jne 0x14006bf62
test al, 8
jne 0x14006be85
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x120]
cmp eax, 1
je 0x14006bddd
xorps xmm6, xmm6
test eax, eax
jne 0x14006be09
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xd0]
lea rdx, [0x1400e46c0]
call fcn.1400d3ad0
mov byte [rbx + 0x120], 1
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xf0]
mov qword [rax + 0xf0], 1
mov qword [rax + 0xf8], rdi
lea rcx, [rsi + 0x30]
call fcn.14006ab50
mov byte [rsi + 0xa8], 4
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x120]
cmp eax, 1
je 0x14006be69
test eax, eax
jne 0x14006bea3
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xd0]
lea rdx, [0x1400e46c0]
call fcn.1400d3ad0
mov byte [rdi + 0x120], 1
mov eax, dword [0x14017d2b4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xf0], xmm6
jmp 0x14006bea3
test al, 0x10
je 0x14006bea3
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14006bfe6
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14006bf7a
jne 0x14006bf37
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14006bef2
mov rcx, rdi
call fcn.140069ba0
lea rcx, [rsi + 0x30]
call fcn.14006ab50
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14006bf11
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x14017d208]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x28], rax
Function at 0x140071820
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop

Function at 0x140072250
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140072260
test al, 1
je 0x140072302
test al, 2
jne 0x14007231a
test al, 8
jne 0x14007229a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.1400720b0
jmp 0x1400722b2
test al, 0x10
je 0x1400722b2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14007239e
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140072332
jne 0x1400722f8
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.140071ff0
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140012c90]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x14014ac08]
lea rcx, [rsp + 0x28]
call fcn.140104620
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x14016f768]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x28]
call fcn.140104620
int3
Function at 0x14007f4a0
Capabilities:
Check for software breakpoints
Encode data using xor
Encrypt data using speck
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2178
call fcn.1401027c0
sub rsp, rax
movaps xmmword [rsp + 0x2160], xmm14
movaps xmmword [rsp + 0x2150], xmm13
movaps xmmword [rsp + 0x2140], xmm12
movaps xmmword [rsp + 0x2130], xmm11
movaps xmmword [rsp + 0x2120], xmm10
movaps xmmword [rsp + 0x2110], xmm9
movaps xmmword [rsp + 0x2100], xmm8
movaps xmmword [rsp + 0x20f0], xmm7
movaps xmmword [rsp + 0x20e0], xmm6
mov r13, rdx
mov rdi, rcx
lea rax, [rsp + 0x7e7]
and rax, 0xfffffffffffffff8
lea r12, [rsp + 0x7e0]
mov qword [rsp + 0x680], rax
sub rax, r12
mov qword [rsp + 0x678], rax
movdqa xmm6, xmmword [0x14010f9c0]
movdqa xmm7, xmmword [str.PRI__HTTP_2.0_r_n]
xorps xmm8, xmm8
movaps xmm9, xmmword [0x14010f7a0]
movdqa xmm10, xmmword [0x14010f730]
movss xmm11, dword [0x14010f7b0]
lea rax, [rcx + 0x90]
mov qword [rsp + 0xc8], rax
lea r15, [rcx + 0x1b0]
lea rbp, [rcx + 0x180]
lea rax, [rcx + 0xd8]
mov qword [rsp + 0xc0], rax
lea rax, [rcx + 0x10]
mov qword [rsp + 0x5e8], rax
lea rax, [rcx + 0xa8]
mov qword [rsp + 0x5e0], rax
lea rax, [rcx + 0x158]
mov qword [rsp + 0x428], rax
lea rax, [rcx + 0xf8]
mov qword [rsp + 0x5d0], rax
lea rax, [rcx + 0xa1]
mov qword [rsp + 0x5d8], rax
lea rax, [rcx + 0x18]
mov qword [rsp + 0x688], rax
lea rsi, [rsp + 0x1460]
lea r14, [rsp + 0x140]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0xd4], eax
mov dword [rsp + 0x2c], eax
xor eax, eax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x60], rbp
jmp 0x14007f63d

Function at 0x140089cf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140089d00
test al, 1
Function at 0x14008a440
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14008a450
test al, 1
je 0x14008a4ef
test al, 2
jne 0x14008a507
test al, 8
jne 0x14008a487
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.140089b50
jmp 0x14008a49f
test al, 0x10
je 0x14008a49f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14008a58b
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14008a51f
jne 0x14008a4e5
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp 0x14008a380
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140012c90]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x14014ac08]
lea rcx, [rsp + 0x28]
call fcn.140104620
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x14016f768]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x28]
call fcn.140104620
int3
Function at 0x1400911a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
add byte [rax], al

Function at 0x140096d40
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x240
add byte [rax - 0x77], cl
invalid
Function at 0x1400a9e90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xff0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400a9ea0
test al, 1
je 0x1400a9f49
test al, 2
jne 0x1400a9f61
test al, 8
jne 0x1400a9edb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call case.0x140071b87.234
jmp 0x1400a9ef9
test al, 0x10
je 0x1400a9ef9
mov rax, qword [rsi + 0xfd8]
test rax, rax
je 0x1400a9fe5
mov rcx, qword [rsi + 0xfe0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400a9f79
jne 0x1400a9f3f
mov rcx, rsi
add rsp, 0xff0
pop rsi
jmp 0x1400a9dd0
nop
add rsp, 0xff0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.140012c90]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x14014ac08]
lea rcx, [rsp + 0x58]
call fcn.140104620
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [0x14016f768]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.140104620
int3
Function at 0x1400b0120
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400b015e
movabs rdi, 0x8000000000000000
jmp 0x1400b01a7
mov r14, qword [rsp + 0x28]
mov r15, qword [r14 + 8]
mov edi, dword [r14 + 0x10]
test rdi, rdi
je 0x1400b018b
movzx eax, byte [0x14017d2b0]
xor ecx, ecx
mov rdx, rdi
call fcn.1400e0010
test rax, rax
je 0x1400b01be
mov rbx, rax
jmp 0x1400b0190
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r14
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.140104360
int3
Function at 0x1400b24e0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0xd4]
mov qword [rsp + 0x128], rax
lea rbx, [rdx + 0x10]
lea rax, [rdx + 0xf0]
mov qword [rsp + 0x100], rax
xorps xmm6, xmm6
movzx eax, byte [rdi + 0xd0]
test eax, eax
je 0x1400b2584
Function at 0x1400b3a60
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400b3a9e
movabs rdi, 0x8000000000000000
jmp 0x1400b3ae7
mov r14, qword [rsp + 0x28]
mov r15, qword [r14 + 8]
mov edi, dword [r14 + 0x10]
test rdi, rdi
je 0x1400b3acb
movzx eax, byte [0x14017d2b0]
xor ecx, ecx
mov rdx, rdi
call fcn.1400e0010
test rax, rax
je 0x1400b3afe
mov rbx, rax
jmp 0x1400b3ad0
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r14
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
Function at 0x1400b75b0
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
mov qword [rsp + 0xd8], r8
mov rsi, rdx
mov qword [rsp + 0x110], rcx
movzx eax, byte [rdx + 0x378]
test eax, eax
je 0x1400b7604
cmp eax, 3
jne case.default.0x1400b7602
lea r14, [rsi + 0x1f0]
movzx eax, byte [rsi + 0x280]
lea rcx, [0x140174be4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x40], rax
xor r12d, r12d
mov rcx, qword [rax + 8]
mov r15, r12
cmp rcx, qword [rax + 0x18]
jne 0x1400b7655
test r15, r15
je 0x1400b8386
lea rcx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_0.14.28_srcclientconnecthttp.rs
call fcn.140104c30
mov word [rsi + 0x48], bp
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rsi + 0x4a], xmm0
movups xmm0, xmmword [rsp + 0x1be]
movups xmmword [rsi + 0x58], xmm0
pop rax
Function at 0x1400c3d80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2f0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400c3d90
test al, 1
je 0x1400c3e39
test al, 2
jne 0x1400c3e51
test al, 8
jne 0x1400c3dcb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 4
lea rdx, [rsp + 0x50]
call fcn.1400c3be0
jmp 0x1400c3de9
test al, 0x10
je 0x1400c3de9
mov rax, qword [rsi + 0x2e0]
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__

Function at 0x1400c49f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2f0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400c4a00
test al, 1
je 0x1400c4aa9
test al, 2
jne 0x1400c4ac1
test al, 8
jne 0x1400c4a3b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 4
lea rdx, [rsp + 0x50]
call fcn.1400c3be0
jmp 0x1400c4a59
test al, 0x10
je 0x1400c4a59
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1400c4b45
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ead20
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400c4ad9
jne 0x1400c4a9f
mov rcx, rsi
add rsp, 0x2f0
pop rsi
jmp fcn.1400c4930
nop
add rsp, 0x2f0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14014ab80]
mov edx, 0x23
call fcn.1401046f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14014abc0]
mov edx, 0x25
call fcn.1401046f0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140012c90]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x14014ac08]
lea rcx, [rsp + 0x50]
call fcn.140104620
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x14016f768]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140104620
int3
Function at 0x1400cc010
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400cc035
cmp rax, rcx
je 0x1400cc03b
cmp rdx, 4
jae 0x1400cc03f
xor eax, eax
xor r8d, r8d
jmp 0x1400cc0d0
pop rbp
jmp fcn.1400130a0
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14010f740]
movdqa xmm3, xmmword [0x14010f750]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400cc060
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400cc0e7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400cc0d0
pop rbp
ret
Function at 0x1400cf450
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x18], rax
jne 0x1400cf50b
cmp qword [rcx + 0x30], rax
jne 0x1400cf527
mov r14, qword [rcx + 0x10]
lea rsi, [r14*8]
test r14, r14
je 0x1400cf571
movabs rax, 0x7ffffffffffffff9
cmp rsi, rax
jae 0x1400cf640
mov rbx, qword [rcx + 8]
movzx eax, byte [0x14017d2b0]
xor ecx, ecx
mov rdx, rsi
call fcn.1400e0010
test rax, rax
je 0x1400cf645
mov rdi, rax
mov rcx, rax
mov rdx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400cf576
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x90], rdx
cmp qword [rcx + 0x30], rax
je 0x1400cf4b2
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1400cf553
mov r8, qword [rcx + 0x38]
xor edx, edx
lea r9, [0x1401721d8]
xor r10d, r10d
movzx r11d, byte [r8 + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp rax, r10
jne 0x1400cf540
jmp 0x1400cf555
xor edx, edx
mov dword [rsp + 0x98], edx
mov r14, qword [rcx + 0x10]
lea rsi, [r14*8]
test r14, r14
jne 0x1400cf4c7
mov edi, 8
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x140143d53]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1400cf603
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
test rsi, rsi
je 0x1400cf5e8
mov rcx, qword [0x14017d208]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
movzx eax, byte [0x14017d2b0]
mov edx, 0x20
xor ecx, ecx
call fcn.1400e0010
test rax, rax
je 0x1400cf652
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor r14d, r14d
test rsi, rsi
jne 0x1400cf5d6
jmp 0x1400cf5e8
call fcn.140010910
mov ecx, 8
mov rdx, rsi
call fcn.140104360
mov ecx, 8
mov edx, 0x20
call fcn.140104380
int3

Function at 0x1400d4b40
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
test r8, r8
je 0x1400d4b9b

Function at 0x1400d9cb0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe

Function at 0x1400dabe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]