joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d37e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0xd8
call fcn.1801c8430
sub rsp, rax
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r12, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
mov rax, r12
sub rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rdi, r8
mov r13, rdx
mov ebp, esi
cmp r15, r8
jb 0x1800d39c6
cmp r8, 0x40
ja 0x1800d39c6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x118], rbx
neg rax
mov qword [rsp + 0xd0], r14
and eax, 0x3f
lea r14, [rsp + 0x40]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1800d387a
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rbx, rsi
call sub.VCRUNTIME140.dll_memset
mov r9, rsi
cmp rbp, r15
jae 0x1800d3937
mov r11, qword [r13 + 0x20]
mov r10, qword [rsp + 0x28]
lea r13, [r11 + r12]
nop word [rax + rax]
lea rdx, [r11 + rbp]
mov rax, rbp
xor rax, r10
mov rcx, rdx
sub rcx, r13
xor rcx, r12
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r12
neg r8
or rcx, rax
mov rax, r8
xor rcx, rbp
or rax, rsi
shr rcx, 0x3f
and r8, r9
neg rcx
or rbx, r8
mov rsi, rcx
inc rbp
and rsi, rax
movzx eax, byte [rdx]
and al, sil
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, rdi
sub rcx, rdi
xor rax, r9
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
cmp rbp, r15
jb 0x1800d38b0
xor esi, esi
test rdi, rdi
je 0x1800d39af
mov r9, qword [rsp + 0x30]
mov rax, rbx
and rax, 0xffffffffffffffdf
movzx r8d, byte [rax + r14]
mov rax, rbx
or rax, 0x20
movzx edx, byte [rax + r14]
mov eax, ebx
and eax, 0x20
inc rbx
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [rsp + 0x28], eax
not eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
and cl, dl
and al, r8b
or al, cl
mov rcx, rbx
sub rcx, rdi
mov byte [r9 + rsi], al
xor rcx, rdi
mov rax, rdi
xor rax, rbx
inc rsi
or rcx, rax
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1800d3941
mov r14, qword [rsp + 0xd0]
mov eax, 1
mov rbx, qword [rsp + 0x118]
jmp 0x1800d39c8
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1801c77e0
add rsp, 0xd8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800d4b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.1801c8430
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1800d4bf8
lea rax, [rsi + r8]
cmp rax, rdx
ja 0x1800d4bfd
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x438]
mov qword [rsp + 0x38], rdi
movzx edi, byte [rdx + rax - 1]
call fcn.1800b1210
mov rcx, rax
call fcn.1800eec60
mov rdx, qword [rbx + 8]
and eax, 0x200000
je 0x1800d4c0a
sub rdx, rdi
mov eax, 1
mov rdi, qword [rsp + 0x38]
dec rdx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp rsi, rdx
jbe 0x1800d4bac
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov r8, rdx
sub r8, rcx
mov esi, 0x100
xor r8, rcx
mov rax, rdx
xor rax, rcx
or r8, rax
xor r8, rdx
shr r8, 0x3f
dec r8
cmp rdx, rsi
cmovb rsi, rdx
xor r9d, r9d
test rsi, rsi
je 0x1800d4c8d
mov r11, qword [rbx + 0x20]
mov r10, rdi
shr r10, 0x3f
dec r11
add r11, rdx
nop
mov rax, r9
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r9
inc r9
shr rcx, 0x3f
xor cl, al
xor al, r10b
or cl, al
xor cl, r10b
dec cl
movzx edx, cl
movzx ecx, byte [r11 + 1]
xor rcx, rdi
and rdx, rcx
not rdx
and r8, rdx
cmp r9, rsi
jb 0x1800d4c50
lea rax, [rdi + 1]
not r8
mov rdi, qword [rsp + 0x38]
movzx ecx, r8b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
not ecx
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x48]
and ecx, 1
or eax, ecx
add rsp, 0x20
pop rsi
ret

Function at 0x1800e7c20
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1801c8430
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800ec0a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1800ec10c
movzx ecx, byte [rcx]
test cl, cl
je 0x1800ec10c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1800ec0c0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x1800ec1d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.1801c8430
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1800ec263
movzx eax, byte [rcx]
test al, al
je 0x1800ec263
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.18011ebd0
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x1800ec200
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1800f6f10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1801c8430
sub rsp, rax
lea rcx, [0x180288a90]
add rsp, 0x28
jmp fcn.1800e7a80
Function at 0x18011f3f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.1801c8430
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x18011f42f
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.1800ed050
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x18011f442
mov dword [rdx], r8d
cmp r9, 1
jne 0x18011f464
test r11, r11
je 0x18011f45a
movzx eax, byte [r10]
test r8d, r8d
je 0x18011f458
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x18011f481
mov eax, 1
mov ebx, eax
jmp 0x18011f52f
cmp cl, 0xff
jne 0x18011f56d
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x18011f51f
cmp rcx, 8
jb 0x18011f510
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x18011f4b3
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x18011f51f
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x18011f510
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x18011f56d
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x18011f56d
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
call fcn.1800ed050
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x18011f5c1
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x18011f5bc
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x18011f5a0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret
Function at 0x1801292b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
movsxd rbx, r8d
mov r11, rdx
mov rdi, rcx
test r8d, r8d
jle 0x1801292ef
mov r9, rdx
mov rdx, rcx
sub rdx, r9
movzx eax, byte [r9]
cmp byte [rdx + r9], al
jne 0x1801292ef
inc r9
inc r10d
mov rax, r9
sub rax, r11
cmp rax, rbx
jl 0x1801292d4
lea edx, [r8 - 1]
movsxd rax, edx
test edx, edx
js 0x18012931a
mov r8, rdi
lea rcx, [rax + r11]
sub r8, r11
cmp byte [rcx + r8], 0
jne 0x18012931a
cmp byte [rcx], 0xff
jne 0x18012931a
dec edx
dec rcx
cmp rcx, r11
jns 0x180129304
cmp r10d, edx
jl case.0x180129373.2
jle 0x180129338
lea eax, [r10*8]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
movsxd rax, r10d
movzx r8d, byte [rax + r11]
movzx r9d, byte [rax + rdi]
movzx edx, r8b
xor dl, r9b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x180129373.2
lea r11, [0x180000000]
cdqe
movzx eax, byte [r11 + rax + 0x1293e8]
mov ecx, dword [r11 + rax*4 + 0x1293c8]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1801293a4
mov eax, 6
jmp 0x1801293a4
mov eax, 5
jmp 0x1801293a4
mov eax, 4
jmp 0x1801293a4
mov eax, 3
jmp 0x1801293a4
mov eax, 2
jmp 0x1801293a4
mov eax, 1
test dl, r9b
jne case.0x180129373.2
and r8b, dl
lea eax, [rax + r10*8]
cmp r8b, dl
je 0x1801293ba
mov eax, 0xffffffff
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18015bfa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1801c8430
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x18015bfc9
lea rax, [0x18015a600]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1801532c0
lea rax, [0x1801597b0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180153000
Function at 0x14ad01c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14ad026
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14ad04f
pop rbp
sub rbp, 0x33
sub rbp, 0x10ad01c
sub rsp, 0x20
jmp 0x14ad06e
mov rax, 0x10ad01c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffeee71eae
xor byte [rax], dl
inc rax
dec rcx
jne 0x14ad08d
jmp 0x14ad0a4
out 0x27, al
and eax, 0xaeae9227
scasb al, byte [rdi]
out 0x2f, al
outsd dx, dword [rsi]
cmpsb byte [rsi], byte [rdi]
scasd eax, dword [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
out 0xaf, al
out 0x69, al
outsb dx, byte [rsi]
stosb byte [rdi], al
scasb al, byte [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
out 0x69, al
insb byte [rdi], dx
xchg byte [rsi + 0x59e6aeae], ch
out 0xaf, al
outsd dx, dword [rsi]
and eax, 0xaeaea22f
scasb al, byte [rdi]
out 0xaf, al
invalid
Function at 0x14001d320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001d3b0
cmp r10, r11
jb 0x14001d426
cmp r10, rdx
ja 0x14001d43a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14001d3b2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001d390
jmp 0x14001d414
ja 0x14001d3ba
mov r11, r10
cmp rax, r8
jne 0x14001d354
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001d3f0
mov rdi, r8
sub ecx, edx
jns 0x14001d40b
jmp 0x14001d416
cmp r8, rsi
je 0x14001d44b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001d416
xor al, 1
cmp rdi, rsi
jne 0x14001d3d0
jmp 0x14001d416
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140147850
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140147550
ud2
lea rcx, [0x1401f0b23]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1401475d0
ud2
Function at 0x140020d96
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x1401509b8]
mov ebx, 0xff
lea rsi, str..cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x140020ec6
mov r14d, 4
sub r14, 1
jb 0x140020dbb
cmp r9, 0xf
jbe 0x140020ef3
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.1400213e6
mov r9, rdx
mov ecx, ebp
jmp 0x140020dcb
xor edx, edx
cmp r9, rdx
je 0x140020ee4
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140020ec8
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
mov ecx, recv
mov rdx, r9
call fcn.140147450
ud2
Function at 0x14002c7d9
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14002c7ff
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14002c7e9
mov qword [rcx], rax
ret

Function at 0x14002c927
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14002c7ae
test rbx, rbx
je 0x14002c960
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14002c7d9
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14002c7d1
Function at 0x14005c67d
Capabilities:
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movabs r9, 0x100000001b3
cmp rdx, r8
je 0x14005c6aa
movzx r10d, byte [rcx + r8]
xor rax, r10
imul rax, r9
inc r8
jmp 0x14005c694
ret
Function at 0x14006afdb
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test r12, r12
je 0x14006b06e
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x14006b008
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x14006b008
xor ebx, 0x80000000
je 0x14006b06e
mov al, byte [0x140201ed8]
mov ecx, 4
mov edx, 4
call fcn.1400109f0
test rax, rax
je 0x14006b081
mov dword [rax], ebx
jmp 0x14006b070
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.140147130
ud2
Function at 0x1400811ca
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
call fcn.14007fff8
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400812a8
test eax, eax
je 0x1400812c4
cmp eax, 0x90317
je 0x14008133c
cmp eax, 0x90321
jne 0x140081344
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14008116a
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x140081352
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140081340
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.14008135c
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1400ea958
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14008116a
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140081352
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140081352
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400815aa
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
lea r9, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
call fcn.14007fff8
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14008168e
test eax, eax
je 0x1400816ad
cmp eax, 0x90317
je 0x14008172e
cmp eax, 0x90321
jne 0x140081736
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14008154a
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x140081744
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x140081732
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.14008135c
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1400ea958
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14008154a
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x140081744
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140081744
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008174e
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x140081760
add rcx, 8
jmp fcn.1400e768a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x38], rdx
mov rcx, r8
call fcn.1400818f2
mov rbx, rax
mov r14, rdx
lea r15, [rsp + 0x28]
mov rcx, rsi
call fcn.1400819c9
test rdx, rdx
jne 0x140081803
mov rcx, r15
mov rdx, rsi
call fcn.14008032b
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x140081892
test eax, eax
je 0x140081803
cmp qword [rsi + 0xf8], 0
je 0x1400817e6
mov rcx, r15
mov rdx, rsi
call fcn.140080f9d
cmp qword [rsp + 0x28], 0
jne 0x140081892
cmp qword [rsp + 0x30], 0
je 0x140081803
and qword [rsi + 0xf8], 0
mov rcx, r15
mov rdx, rsi
call fcn.1400811ca
cmp byte [rsp + 0x28], 0
jne 0x140081892
cmp byte [rsp + 0x29], 0
je 0x14008178c
mov rcx, rsi
call fcn.1400819c9
mov r15, rdx
test rax, rax
je 0x140081897
mov r13, rax
cmp r14, r15
mov r12, r15
cmovb r12, r14
lea r9, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.1400494e0
mov rbx, rax
mov r14, rdx
lea r9, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
mov rcx, r12
mov rdx, r13
mov r8, r15
call fcn.1400494e0
mov r9, rdx
lea rcx, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.140012217
mov rax, qword [rsi + 0x78]
add rax, r12
cmp rax, qword [rsi + 0x70]
ja 0x1400818d8
mov qword [rsi + 0x78], rax
mov rcx, rdi
mov rdx, r12
call fcn.14008195f
xor r15d, r15d
jmp 0x1400818be
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov rcx, r15
call fcn.140001a1c
cmp al, 0xd
jne 0x1400818be
and qword [rsi + 0x38], 0
lea rcx, [rsp + 0x28]
call fcn.14006b251
mov eax, 1
jmp 0x1400818c5
and qword [rsi + 0x38], 0
xor eax, eax
mov rdx, r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsx_v
mov edx, 0x3b
call fcn.1401475d0
ud2
Function at 0x1400b0a4a
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x58]
mov r8d, recv
mov rcx, rdi
mov rdx, rax
call fcn.1400b0b72
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.1400bf06e
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400b0ae7
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.1400ea940
mov rbx, qword [rsp + 0x40]
jmp 0x1400b0ab2
test eax, eax
jne 0x1400b0b09
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x1400b0b27
movabs rax, 0xde00000002
jmp 0x1400b0b11
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140029ea3
jmp 0x1400b0b3b
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400bdb40
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret