joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4689b0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
neg rsi
imul rsi, rsi, 0x1c
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x468a8b
lea rsi, [rdx + rdx*2]
lea rdi, [0x005ef380]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x468a34
inc rdx
jmp 0x468a0b
cmp r9, 0xffffffffffffffe0
jle 0x468a3f
dec rdx
jmp 0x468a0b
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00456bd0
nop
int3
Function at 0x140010db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140010e30
cmp r10, rax
jb 0x140010ea4
cmp r10, rdx
ja 0x140010eb8
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140010e32
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140010e10
jmp 0x140010e93
ja 0x140010e3a
mov rax, r10
cmp r11, r8
jne 0x140010de2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140010e70
mov r15, rbx
sub ecx, edx
jns 0x140010e8a
jmp 0x140010e95
cmp rbx, r14
je 0x140010ec9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140010e95
xor al, 1
cmp r15, r14
jne 0x140010e50
jmp 0x140010e95
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14000e990
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14000e060
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14000e4f0
ud2

Function at 0x14001c497
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx]
xor r11d, r11d
movabs r10, 0x100000001b3
cmp r8, r11
je 0x14001c4bd
movzx eax, byte [rdx + r11]
xor r9, rax
imul r9, r10
inc r11
jmp 0x14001c4a7
mov qword [rcx], r9
ret

Function at 0x14001c6c5
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
cmp qword [rdi + 0x18], 0
setne cl
call fcn.14001c46c
cmp qword [rdi + 0x18], 0
je 0x14001c6fc
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001c497
mov cl, byte [rdi]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001c48f
Function at 0x14006f4c5
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0xc0]
mov rcx, qword [rdx + 0xa8]
mov rdx, qword [rdx + 0xb8]
lea r9, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
call fcn.14006e1ad
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14006f5a5
test eax, eax
je 0x14006f5c4
cmp eax, 0x90317
je 0x14006f645
cmp eax, 0x90321
jne 0x14006f64d
mov dword [rdi + 0x108], 0x10000
xor ebx, ebx
mov byte [rdi + 0x10c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14006f465
and qword [rdi + 0x80], 0
mov byte [rsi + 1], bl
jmp 0x14006f65b
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x80], rax
mov byte [rsi + 1], 0
jmp 0x14006f649
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0xa8]
mov rdx, qword [rdi + 0xb8]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x88]
and qword [rdi + 0x98], 0
call fcn.14006f665
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1400c238b
and qword [rdi + 0xa0], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14006f465
xor eax, eax
cmp qword [rdi + 0xc0], rbx
sete al
mov qword [rdi + 0x80], rax
mov byte [rsi + 1], 0
jmp 0x14006f65b
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14006f65b
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006f8fc
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x1c0]
mov rcx, qword [rdx + 0x1a8]
mov rdx, qword [rdx + 0x1b8]
lea r9, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
call fcn.14006e1ad
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14006f9dc
test eax, eax
je 0x14006f9fb
cmp eax, 0x90317
je 0x14006fa7c
cmp eax, 0x90321
jne 0x14006fa84
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14006f89c
and qword [rdi + 0x180], 0
mov byte [rsi + 1], bl
jmp 0x14006fa92
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x180], rax
mov byte [rsi + 1], 0
jmp 0x14006fa80
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x1a8]
mov rdx, qword [rdi + 0x1b8]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x188]
and qword [rdi + 0x198], 0
call fcn.14006f665
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1400c238b
and qword [rdi + 0x1a0], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14006f89c
xor eax, eax
cmp qword [rdi + 0x1c0], rbx
sete al
mov qword [rdi + 0x180], rax
mov byte [rsi + 1], 0
jmp 0x14006fa92
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14006fa92
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006fa9c
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx + 0x18], 2
jne 0x14006faaf
add rcx, 0x20
jmp fcn.1400bfdad
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r8
mov rsi, rcx
mov qword [rcx + 0x78], rdx
mov rcx, r8
call fcn.14006fc4a
mov r14, rax
mov r12, rdx
lea rdi, [rsp + 0x28]
mov rcx, rsi
call fcn.14006fd27
test rdx, rdx
jne 0x14006fb53
mov rcx, rdi
mov rdx, rsi
call fcn.14006e571
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x14006fbea
cmp eax, 1
jne 0x14006fb53
cmp qword [rsi + 0x80], 0
je 0x14006fb36
mov rcx, rdi
mov rdx, rsi
call fcn.14006f29a
cmp qword [rsp + 0x28], 0
jne 0x14006fbea
cmp qword [rsp + 0x30], 0
je 0x14006fb53
and qword [rsi + 0x80], 0
mov rcx, rdi
mov rdx, rsi
call fcn.14006f4c5
cmp byte [rsp + 0x28], 0
jne 0x14006fbea
cmp byte [rsp + 0x29], 0
je 0x14006fadb
mov rcx, rsi
call fcn.14006fd27
mov rdi, rdx
test rax, rax
je 0x14006fbef
mov r13, rax
cmp r12, rdi
mov rbx, rdi
cmovb rbx, r12
lea r9, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
mov r8, r12
call fcn.14006e1f6
mov r14, rax
mov r12, rdx
lea r9, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
mov rcx, r13
mov rdx, rdi
mov r8, rbx
call fcn.140044ebb
mov r9, rdx
lea rcx, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov rdx, r12
mov r8, rax
call fcn.140090cb8
mov rax, qword [rsi + 0xa0]
add rax, rbx
cmp rax, qword [rsi + 0x98]
ja 0x14006fc30
mov qword [rsi + 0xa0], rax
mov rcx, r15
mov rdx, rbx
call fcn.14006fcba
xor edi, edi
jmp 0x14006fc16
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdi
mov rcx, rdi
call fcn.1400bbb9d
cmp al, 0xd
jne 0x14006fc16
and qword [rsi + 0x78], 0
lea rcx, [rsp + 0x28]
call fcn.14003ef3e
mov eax, 1
jmp 0x14006fc1d
and qword [rsi + 0x78], 0
xor eax, eax
mov rdx, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str._Users_halo_.cargo_registry_src_github.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
mov edx, 0x3b
call fcn.14000e4f0
ud2
Function at 0x140087e61
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov r14, rcx
lea rsi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rsi
mov rdx, rax
call fcn.140087f89
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.140090dd7
mov rdi, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rsi, qword [rsi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140087efe
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.1400134e0
mov rdi, qword [rsp + 0x40]
jmp 0x140087ec9
test eax, eax
jne 0x140087f20
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x140087f3f
movabs rax, 0xde00000002
jmp 0x140087f28
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140090dc2
jmp 0x140087f55
mov rcx, qword [rsp + 0x50]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
lea rcx, [rsp + 0x58]
call fcn.14006c49f
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008d980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x14008d9d2
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x14008d9d2
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x14008d9ed
cmp eax, 0x42
jne 0x14008d9d2
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x14008da2a
cmp byte [rdi + rcx], 0x5f
jne 0x14008da2a
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14008db22
mov rcx, rsi
xor edx, edx
call fcn.140089410
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.140089410
test al, al
jne 0x14008da25
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14008da9c
lea rdx, [0x14011fec2]
mov r8d, 1
call fcn.14000e0f0
test al, al
je 0x14008da9c
mov dil, 2
jmp 0x14008d9e1
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x14008db3e
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x14008db16
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14008da7f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14008da6e
add dl, 0xa9
jmp 0x14008da7d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14008db3e
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x14008db3e
movzx edx, bl
add rax, rdx
jae 0x14008da40
jmp 0x14008db3e
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14008d9e1
xor ebx, ebx
lea r14, [0x1401202ae]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14008dad4
cmp byte [rax + rcx], 0x45
je 0x14008dbcc
sub rbx, 1
jb 0x14008daf9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14008daf9
mov r8d, 2
mov rdx, r14
call fcn.14000e0f0
test al, al
jne 0x14008da25
mov rcx, rsi
call fcn.14008dbe0
test al, al
jne 0x14008da25
mov rax, qword [rsi]
test rax, rax
jne 0x14008dac0
jmp 0x14008d9e1
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x14008db3e
cmp rax, r9
jae 0x14008db3b
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
jbe 0x14008db8f
mov bl, 1
xor r8d, r8d
jmp 0x14008db40
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14008db7e
lea rax, [0x140120279]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14000e0f0
mov dil, 2
test al, al
jne 0x14008d9e1
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x14008d9e1
cmp qword [rsi + 0x20], 0
je 0x14008db88
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14008d980
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14008d9e3
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14008d9e1
Function at 0x14009035e
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
mov rax, qword [rcx]
test rax, rax
je 0x1400903c0
mov edx, dword [rcx + 0x10]
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400903f1
mov rdx, qword [rcx + 0x28]
xor ebx, ebx
lea r8, [0x14014b620]
xor esi, esi
cmp rdx, rbx
je 0x1400903ea
movzx edi, byte [rax + rbx]
or esi, dword [r8 + rdi*4]
inc rbx
jmp 0x1400903d8
mov dword [rsp + 0xa0], esi
mov rbx, qword [rcx + 0x30]
mov r15, qword [rcx + 0x40]
lea rsi, [r15*8]
test r15, r15
je 0x140090444
movabs rax, 0xfffffffffffffff
xor r14d, r14d
cmp r15, rax
setbe al
ja 0x14009051d
mov r14b, al
shl r14, 3
mov rcx, rsi
mov rdx, r14
call fcn.14008fb42
mov rdi, rax
test rax, rax
jne 0x140090449
mov rcx, rsi
mov rdx, r14
jmp 0x14009052e
mov edi, 8
xor eax, eax
cmp rsi, rax
je 0x14009045e
mov rcx, qword [rbx + rax]
mov qword [rdi + rax], rcx
add rax, 8
jmp 0x14009044b
lea rax, [rsp + 0x68]
mov dword [rax + 4], r15d
mov qword [rax + 8], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.Secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x1400904b5
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x1400904f0
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov ecx, 0x20
mov edx, 8
xor r8d, r8d
call fcn.14008fb4a
test rax, rax
je 0x140090524
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r12
xor r14d, r14d
test r15, r15
je 0x140090506
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call fcn.140001905
mov rax, r14
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14000a3c0
ud2
mov ecx, 0x20
mov edx, 8
call fcn.14000a410
ud2

Function at 0x140090b7e
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.Secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x140090ba7
mov rdx, qword [rsp + 0x20]
jmp 0x140090baf
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x1400913a2
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400913ce
xor eax, eax
jmp 0x1400913d3
call fcn.14003d77b
nop
add rsp, 0x38
ret
Function at 0x140092980
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
lea rcx, [0x14015b0b8]
call sub.kernel32.dll_AcquireSRWLockExclusive
mov rbx, qword [rsi]
test rbx, rbx
jne 0x140092a0b
mov rbx, qword [rsi + 8]
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140092a25
mov edi, eax
test rbx, rbx
je 0x1400929ff
mov ecx, 0x18
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x140092af2
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rax, qword [0x14015b100]
nop word cs:[rax + rax]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x14015b100], rcx
jne 0x1400929f0
mov ebx, edi
mov rax, rbx
xchg qword [rsi], rax
test edi, edi
je 0x140092a42
lea rcx, [0x14015b0b8]
call fcn.1400c9820
mov rax, rbx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESlibrary_std_src_syswindows_thread_local_key.rs
lea r8, [0x140123190]
mov edx, 0x2e
call fcn.14000e4f0
jmp 0x140092b01
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
lea rax, str.assertion_failed:_key___0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], 0
lea rax, str._rustc_897e37553bba8b42751c67658967889d11ecd120librarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_release_store
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [0x14000e720]
mov qword [rsp + 0x38], rax
lea rax, [0x1401212b8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call fcn.140091df0
mov rcx, rax
call fcn.140091ee0
mov ecx, 7
int 0x29
ud2
mov ecx, 0x18
mov edx, 8
call fcn.14000a410
ud2

Function at 0x1400933a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x1400cc078]
test rcx, rcx
jne 0x1400933c0
lea rcx, [0x1400cc078]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400933d4
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x140093450
mov rcx, qword [0x1400cc078]
test rcx, rcx
jne 0x1400933ef
lea rcx, [0x1400cc078]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140093456
mov rsi, rax
test rax, rax
jne 0x14009344a
mov ecx, 0x10
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x140093461
mov rsi, rax
mov byte [rax + 8], 0
lea rax, [0x1400cc078]
mov qword [rsi], rax
mov rcx, qword [0x1400cc078]
test rcx, rcx
jne 0x140093442
lea rcx, [0x1400cc078]
call fcn.140092980
mov rcx, rax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x140093458
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov ecx, 0x10
mov edx, 8
call fcn.14000a410
ud2
Function at 0x140094850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x1400cc098]
test rcx, rcx
jne 0x140094870
lea rcx, [0x1400cc098]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14009488a
cmp qword [rax], 0
je 0x14009488a
add rax, 8
jmp 0x14009491b
mov rcx, qword [0x1400cc098]
test rcx, rcx
jne 0x1400948a5
lea rcx, [0x1400cc098]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140094919
mov rsi, rax
test rax, rax
jne 0x140094904
mov ecx, 0x18
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x140094921
mov rsi, rax
mov qword [rax], 0
lea rax, [0x1400cc098]
mov qword [rsi + 0x10], rax
mov rcx, qword [0x1400cc098]
test rcx, rcx
jne 0x1400948fc
lea rcx, [0x1400cc098]
call fcn.140092980
mov rcx, rax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rax, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], 0
jmp 0x14009491b
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.14000a410
ud2

Function at 0x140094a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x1400cc088]
test rcx, rcx
jne 0x140094a21
lea rcx, [0x1400cc088]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140094a3e
mov rdi, rax
cmp qword [rax], 0
je 0x140094a3e
add rdi, 8
jmp 0x140094aec
mov rcx, qword [0x1400cc088]
test rcx, rcx
jne 0x140094a59
lea rcx, [0x1400cc088]
call fcn.140092980
mov rcx, rax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140094aea
mov rsi, rax
test rax, rax
jne 0x140094abc
mov ecx, 0x20
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x140094af6
mov rsi, rax
mov qword [rax], 0
lea rax, [0x1400cc088]
mov qword [rsi + 0x18], rax
mov rcx, qword [0x1400cc088]
test rcx, rcx
jne 0x140094ab4
lea rcx, [0x1400cc088]
call fcn.140092980
mov rcx, rax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 8]
cmp qword [rsi], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
je 0x140094aec
test rcx, rcx
je 0x140094aec
lock dec qword [rcx]
jne 0x140094aec
call fcn.140092b20
jmp 0x140094aec
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x20
mov edx, 8
call fcn.14000a410
ud2