joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002140
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002213
cmp byte [rcx + 0x71], 0
je 0x140002213
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000220f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400021d4
sub eax, 1
je 0x1400021d8
cmp eax, 2
jne 0x14000220f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003090
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002206
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000220f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400021bc
xor al, al
jmp 0x1400021bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003090
add rsp, 0x60
pop rbx
ret

Function at 0x140003a24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a70
xor al, al
add rsp, 0x28
ret
Function at 0x140001610
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov qword [rsp + 0x58], 0
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x6c], 0
mov eax, dword [0x140196314]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x48]
cmp rax, 1
jne 0x1400017f2
mov eax, dword [0x140196314]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x50]
inc qword [rbx]
je 0x140001801
mov rax, qword [rbx + 0x110]
cmp rax, 0x40
jb 0x1400016c9
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x120]
mov rax, qword [rbx + 0x158]
test rax, rax
jle 0x1400016c2
cmp qword [rbx + 0x160], 0
js 0x1400016c2
add rax, 0xffffffffffffff00
mov qword [rbx + 0x158], rax
call fcn.140055570
jmp 0x1400016c7
call fcn.14004a830
xor eax, eax
mov ebp, dword [rbx + rax*4 + 0x10]
inc rax
mov qword [rbx + 0x110], rax
and ebp, 1
or ebp, 0x1000
dec qword [rbx]
jne 0x1400016fd
dec qword [rbx + 8]
jne 0x1400016fd
mov rcx, qword [0x140196260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], 0x40
lea r14, [rsp + 0x58]
lea r15, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
mov rdx, r14
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r15
mov r9d, 0x50
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp qword [rsi], 0
je 0x1400017e4
mov rcx, qword [0x140196260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test rax, rax
jne 0x140001803
call fcn.14011f0f0
jmp 0x14000165d
ud2
lea rax, [0x14015fd28]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_d9284afea99e0969a0e692b9e9fd61ea4ba21366library_std_src_threadlocal.rs
lea r9, [0x14015fc58]
lea r8, [rsp + 0x60]
mov edx, 0x46
call fcn.140119760
int3
Function at 0x14000d590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000d610
cmp r10, r11
jb 0x14000d687
cmp r10, rdx
ja 0x14000d699
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14000d612
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000d5f0
jmp 0x14000d674
ja 0x14000d61a
mov r11, r10
cmp rax, r8
jne 0x14000d5be
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000d650
mov rdi, r8
sub ecx, edx
jns 0x14000d66b
jmp 0x14000d676
cmp r8, rsi
je 0x14000d6a8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000d676
xor al, 1
cmp rdi, rsi
jne 0x14000d630
jmp 0x14000d676
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401197f0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140119450
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140119860
int3
Function at 0x14001e980
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001e9c2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001e9ca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001e9db
jmp 0x14001e9f2
xor r10d, r10d
jmp 0x14001ea7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001e9f2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001ea09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001ea29
add r11, r8
jmp 0x14001eb5b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001eaf2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001eaa0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14001eb10
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001eb22
jmp 0x14001eb3d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001eb3d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001eb57
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140028320
Capabilities:
Check for software breakpoints
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1d08
call fcn.140115070
sub rsp, rax
movdqa xmmword [rsp + 0x1cf0], xmm11
movaps xmmword [rsp + 0x1ce0], xmm10
movaps xmmword [rsp + 0x1cd0], xmm9
movaps xmmword [rsp + 0x1cc0], xmm8
movaps xmmword [rsp + 0x1cb0], xmm7
movaps xmmword [rsp + 0x1ca0], xmm6
mov rsi, rdx
mov qword [rsp + 0x38], rcx
lea r11, [r8 + 0x10]
movzx r10d, byte [r8 + 0x16]
movzx eax, byte [r8 + 0x11]
mov byte [rsp + 0x37], al
mov rax, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rsp + 0x2b8], rcx
mov qword [rsp + 0x2c0], rax
lea rax, [rax + 8]
mov qword [rsp + 0x2b0], rax
movzx eax, byte [r8 + 0x15]
mov byte [rsp + 0x36], al
movzx eax, byte [r8 + 0x13]
mov byte [rsp + 0x35], al
xorps xmm6, xmm6
movaps xmm7, xmmword [0x140126740]
movss xmm8, dword [0x140126750]
movdqa xmm9, xmmword [str.uespemosarenegylmodnarodsetybdetwwwwwwwwwwwwwwwwpgrade_insecure_trict_transport_sec_websocket_vesec_websocket_exsec_websocket_acproxy_authentica_policy_report_ocontent_securityroxy_authorizatif_unmodified_sinontent_dispositiaccess_control_rns_prefetch_contontent_type_optiec_websocket_proccess_control_maublic_key_pins_rccess_control_alaccess_control_a]
movdqa xmm10, xmmword [0x140126780]
lea r13, [rsp + 0x3a0]
xor eax, eax
mov qword [rsp + 0x1f8], rax
Function at 0x14004a830
Capabilities:
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x14004a883
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14004a8d3
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x1401962d8]
test rax, rax
je 0x14004a909
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x14004a91a
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x14004a92e
and ebx, 0x7fffffff
je 0x14004a883
movzx eax, byte [0x140196310]
mov edx, 4
xor ecx, ecx
call fcn.1400f0c90
test rax, rax
je 0x14004a970
mov dword [rax], ebx
mov rcx, qword [0x140196260]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14004a944
call fcn.140123c00
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x14004a8af
lea r8, [0x14015eab0]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140057810
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140055570
mov ecx, 4
mov edx, 4
call fcn.140119090
int3
Function at 0x14004dbc0
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rdi, rdx
mov rdx, rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], 0xb
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0x45
lea rsi, [rbp - 8]
mov r8d, 0xb
mov rcx, rsi
call fcn.1400eaa40
mov rcx, qword [rbp - 8]
mov rax, qword [rbp]
movabs r15, 0x8000000000000000
cmp rcx, r15
jne 0x14004dc2b
mov rdi, rax
jmp 0x14004dca8
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 8]
mov r8d, 0x45
mov rdx, rdi
call fcn.1400eaa40
mov r14, qword [rbp - 8]
mov rbx, qword [rbp]
cmp r14, r15
jne 0x14004dc62
mov rdi, rbx
cmp qword [rbp + 0x30], 0
mov r15, qword [rbp + 0x38]
jne 0x14004dc96
jmp 0x14004dca8
mov r15, qword [rbp + 0x38]
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x14004dcbd
xor edi, edi
test r14, r14
je 0x14004dc8f
mov rcx, qword [0x140196260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp + 0x30], 0
je 0x14004dca8
mov rcx, qword [0x140196260]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test rdi, rdi
jne 0x14004dcd4
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
test r14, r14
jne 0x14004dc7d
jmp 0x14004dc8f
mov qword [rbp + 0x28], rdi
lea rax, [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, [0x1400ebb30]
mov qword [rbp], rax
lea rcx, [rbp - 0x28]
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x18], rax
lea rax, [fcn.1400eb420]
mov qword [rbp + 0x20], rax
lea rax, [0x14015c310]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 3
lea rdx, [0x14015c340]
lea rcx, [rbp - 0x58]
call fcn.140119330
ud2
Function at 0x14007a380
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x14007a3c0
movabs r12, 0x8000000000000000
jmp 0x14007a41a
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x14007a3fa
movzx eax, byte [0x140196310]
xor ecx, ecx
mov rdx, rdi
call fcn.1400f0c90
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x14007a403
mov ecx, 1
mov rdx, rdi
call fcn.140119070
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140118560
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14007d7f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14007d800
test al, 1
je 0x14007d8ef
test al, 2
jne 0x14007d907
test al, 8
jne 0x14007d83b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.140093d00
jmp 0x14007d859
test al, 0x10
je 0x14007d859
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14007d98b
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140103230
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14007d91f
jne 0x14007d8e4
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007d8a8
mov rcx, rdi
call fcn.140080710
lea rcx, [rsi + 0x30]
call fcn.14007ba40
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14007d8c7
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140196260]
xor edx, edx
add rsp, 0x238
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140161218]
mov edx, 0x23
call fcn.1401194c0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140161258]
mov edx, 0x25
call fcn.1401194c0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008a30]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_p
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1401612a0]
lea rcx, [rsp + 0x50]
call fcn.140119330
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersBOTNET.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140119330
int3
Function at 0x14007d9d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14007d9e0
test al, 1
je 0x14007da88
test al, 2
jne 0x14007daa0
test al, 8
jne 0x14007da1a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xc8], 4
lea rdx, [rsp + 0x58]
call fcn.140093940
jmp 0x14007da38
test al, 0x10
je 0x14007da38
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x14007db24
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401035c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14007dab8
jne 0x14007da7e
mov rcx, rsi
add rsp, 0xd0
pop rsi
jmp fcn.14007d650
nop
add rsp, 0xd0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140161218]
mov edx, 0x23
call fcn.1401194c0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140161258]
mov edx, 0x25
call fcn.1401194c0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.140008a30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_p
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x1401612a0]
lea rcx, [rsp + 0x58]
call fcn.140119330
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersBOTNET.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.140119330
int3
Function at 0x14007db60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14007db70
test al, 1
je 0x14007dc52
test al, 2
jne 0x14007dc6a
test al, 8
jne 0x14007dbaa
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x38], 0x3b9aca01
lea rdx, [rsp + 0x30]
call fcn.1400944c0
jmp 0x14007dbc2
test al, 0x10
je 0x14007dbc2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14007dcf1
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401035c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14007dc82
jne 0x14007dc47
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007dc11
mov rcx, rdi
call fcn.1400807d0
lea rcx, [rsi + 0x30]
call fcn.14007cef0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14007dc2a
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140196260]
xor edx, edx
add rsp, 0x88
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x88
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140161218]
mov edx, 0x23
call fcn.1401194c0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140161258]
mov edx, 0x25
call fcn.1401194c0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.140008a30]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:_p
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x1401612a0]
lea rcx, [rsp + 0x30]
call fcn.140119330
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersBOTNET.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.140119330
int3
Function at 0x14007dd30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14007dd40
test al, 1
je 0x14007de2f
test al, 2
jne 0x14007de47
test al, 8
jne 0x14007dd7b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 0xc
lea rdx, [rsp + 0x50]
call fcn.140093b20
jmp 0x14007dd99
test al, 0x10
je 0x14007dd99
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x14007decb
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401035c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14007de5f
jne 0x14007de24
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007dde8
mov rcx, rdi
call fcn.1400807d0
lea rcx, [rsi + 0x30]
call fcn.14007c410
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x14007de07
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140196260]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x208
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140161218]
mov edx, 0x23
call fcn.1401194c0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140161258]
mov edx, 0x25
call fcn.1401194c0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008a30]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_p
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1401612a0]
lea rcx, [rsp + 0x50]
call fcn.140119330
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersBOTNET.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.140119330
int3