joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014e9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140014f1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140014f11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140014f11
mov rax, qword [rbp - 8]
jmp 0x140014f2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140014ee4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002240]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002230]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400034e8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140008e7f
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x48]
mov rcx, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x40]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.140008db8
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140008fcd
test eax, eax
je 0x140008f5b
cmp eax, 0x90317
je 0x140008fc7
cmp eax, 0x90321
jne 0x140008feb
mov dword [rdi + 0xa0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xa4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x48]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140008e29
and qword [rdi + 0xe8], 0
mov byte [rsi + 1], bl
jmp 0x140008ff9
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x40]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x10]
and qword [rdi + 0x20], 0
call fcn.140009003
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call case.0x14018d4e4.1301
and qword [rdi + 0x28], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x48]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140008e29
xor eax, eax
cmp qword [rdi + 0x48], rbx
sete al
mov qword [rdi + 0xe8], rax
mov byte [rsi + 1], 0
jmp 0x140008ff9
mov byte [rsi + 1], 1
jmp 0x140008fe7
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xe8], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x140008ff9
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000abe0
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x180]
mov rcx, qword [rdx + 0x170]
mov rdx, qword [rdx + 0x178]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
call fcn.140008db8
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1f8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14000ad4f
test eax, eax
je 0x14000acc8
cmp eax, 0x90317
je 0x14000ad49
cmp eax, 0x90321
jne 0x14000ad6d
mov dword [rdi + 0x1d8], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1dc], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x180]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14000ab81
and qword [rdi + 0x218], 0
mov byte [rsi + 1], bl
jmp 0x14000ad7b
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x170]
mov rdx, qword [rdi + 0x178]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x148]
and qword [rdi + 0x158], 0
call fcn.140009003
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call case.0x14018d4e4.1301
and qword [rdi + 0x160], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x180]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14000ab81
xor eax, eax
cmp qword [rdi + 0x180], rbx
sete al
mov qword [rdi + 0x218], rax
mov byte [rsi + 1], 0
jmp 0x14000ad7b
mov byte [rsi + 1], 1
jmp 0x14000ad69
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x218], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14000ad7b
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000c735
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx]
add r9, 0xfffffffffffffffe
cmp r9, 3
mov eax, 1
cmovb rax, r9
test rax, rax
je 0x14000c761
cmp rax, 1
je fcn.14000c76a
mov rcx, qword [rcx + 8]
jmp fcn.14000c97e
mov rcx, qword [rcx + 0x18]
jmp case.0x140195e42.143
Function at 0x14000c76a
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.140007756
mov eax, dword [rbx]
cmp eax, 2
jne 0x14000c7ac
mov rdx, qword [rsp + 0x38]
mov esi, 1
jmp 0x14000c967
mov esi, 1
test eax, eax
je 0x14000c923
mov rdx, qword [rdi + 0x68]
cmp rdx, qword [rdi + 0x60]
jne 0x14000c951
mov r14, qword [rsp + 0x38]
mov eax, r14d
shr r14, 0x20
cmp r15, r14
cmovb r14, r15
mov r13d, dword [rsp + 0x34]
lea r15, [r14 + r13]
add rax, r15
cmp rdx, rax
jae 0x14000c7fb
lea rcx, [rdi + 0x50]
mov rdx, rax
call fcn.14005aeaa
mov rdx, qword [rdi + 0x60]
mov rcx, qword [rdi + 0x58]
lea rax, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r13
mov r9, r15
call fcn.14013d664
lea rcx, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r14
call fcn.1401c59a4
mov rcx, qword [rdi + 0x58]
mov rdx, qword [rdi + 0x60]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov r8, r13
call fcn.140008db8
mov qword [rsp + 0x70], rax
mov rbp, rdx
xor ecx, ecx
test rax, rax
cmove ebp, ecx
mov rcx, qword [rdi + 0x58]
mov rdx, qword [rdi + 0x60]
lea rax, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r13
mov r9, r15
call fcn.14013d664
mov r13, rax
mov r12, rdx
test rax, rax
mov eax, 0
cmove r12d, eax
mov rcx, qword [rdi + 0x58]
mov rdx, qword [rdi + 0x60]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov r8, r15
call fcn.140009092
test rax, rax
mov ecx, 0
cmove edx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x78]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rdi + 0xc8]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x14000c92f
mov edx, eax
shl rdx, 0x20
or rdx, 2
jmp 0x14000c967
movabs rdx, 0x8009031700000002
jmp 0x14000c967
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
cmp qword [rdi + 0x60], rax
jb 0x14000c945
mov qword [rdi + 0x60], rax
and qword [rdi + 0x68], 0
mov qword [rdi + 0xf0], r14
mov rcx, rdi
call fcn.140008c39
test rax, rax
jne 0x14000c967
mov rdx, qword [rdi + 0xf0]
xor esi, esi
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c97e
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.14000991d
mov eax, dword [rbx]
cmp eax, 2
jne 0x14000c9c0
mov rdx, qword [rsp + 0x38]
mov esi, 1
jmp 0x14000cba5
mov esi, 1
test eax, eax
je 0x14000cb58
mov rdx, qword [rdi + 0x1a0]
cmp rdx, qword [rdi + 0x198]
jne 0x14000cb8f
mov r14, qword [rsp + 0x38]
mov eax, r14d
shr r14, 0x20
cmp r15, r14
cmovb r14, r15
mov r13d, dword [rsp + 0x34]
lea r15, [r14 + r13]
add rax, r15
cmp rdx, rax
jae 0x14000ca1b
lea rcx, [rdi + 0x188]
mov rdx, rax
call fcn.14005aeaa
mov rdx, qword [rdi + 0x198]
mov rcx, qword [rdi + 0x190]
lea rax, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r13
mov r9, r15
call fcn.14013d664
lea rcx, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r14
call fcn.1401c59a4
mov rcx, qword [rdi + 0x190]
mov rdx, qword [rdi + 0x198]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov r8, r13
call fcn.140008db8
mov qword [rsp + 0x70], rax
mov rbp, rdx
xor ecx, ecx
test rax, rax
cmove ebp, ecx
mov rcx, qword [rdi + 0x190]
mov rdx, qword [rdi + 0x198]
lea rax, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r13
mov r9, r15
call fcn.14013d664
mov r13, rax
mov r12, rdx
test rax, rax
mov eax, 0
cmove r12d, eax
mov rcx, qword [rdi + 0x190]
mov rdx, qword [rdi + 0x198]
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov r8, r15
call fcn.140009092
test rax, rax
mov ecx, 0
cmove edx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x78]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rdi + 0x1f8]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x14000cb64
mov edx, eax
shl rdx, 0x20
or rdx, 2
jmp 0x14000cba5
movabs rdx, 0x8009031700000002
jmp 0x14000cba5
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
cmp qword [rdi + 0x198], rax
jb 0x14000cb80
mov qword [rdi + 0x198], rax
and qword [rdi + 0x1a0], 0
mov qword [rdi + 0x220], r14
mov rcx, rdi
call fcn.14000a9eb
test rax, rax
jne 0x14000cba5
mov rdx, qword [rdi + 0x220]
xor esi, esi
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012393
Capabilities:
Query environment variable

Disassembly:
lea rdx, str.RUST_MIN_STACKlibrary_std_src_threadmod.rsfailed_to_spawn_thread
mov r8d, 0xe
jmp fcn.1401922b0

Function at 0x1400140e8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14001410e
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x1400140f8
mov qword [rcx], rax
ret
Function at 0x14002c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14002c680
cmp r11, r10
ja 0x14002c6f7
cmp r10, rdx
ja 0x14002c709
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14002c682
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14002c660
jmp 0x14002c6e4
ja 0x14002c68a
mov r11, r10
cmp rax, r8
jne 0x14002c62e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14002c6c0
mov rdi, r8
sub ecx, edx
jns 0x14002c6db
jmp 0x14002c6e6
cmp r8, rsi
je 0x14002c718
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14002c6e6
xor al, 1
cmp rdi, rsi
jne 0x14002c6a0
jmp 0x14002c6e6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401c7190
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401c6f20
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1401c7290
int3
Function at 0x1400300b5
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x1401d7a08]
mov ebx, 0xff
lea rsi, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.0_src_baseline.rs
cmp r9, 0x40
jb 0x1400301e5
mov r14d, 4
sub r14, 1
jb 0x1400300da
cmp r9, 0xf
jbe 0x140030212
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.1400306f8
mov r9, rdx
mov ecx, ebp
jmp 0x1400300ea
xor edx, edx
cmp r9, rdx
je 0x140030203
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x1400301e7
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.0_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.1401c6eb0
int3
Function at 0x14005a2da
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov r12, r8
mov rbx, rdx
mov qword [rbp - 0x58], rcx
lea r8, [0x14024f348]
push 3
pop r9
mov rcx, rdx
ror dword [rcx + rcx*4 - 0x1e], 1
call fcn.14005a06a
movabs r14, 0x8000000000000002
add byte [rax], al
add byte [rax], al
invalid
test al, al
je 0x14005a35b
movups xmm0, xmmword [0x1401fd860]
movups xmmword [rbp - 0x21], xmm0
movups xmm0, xmmword [0x1401fd851]
movaps xmmword [rbp - 0x30], xmm0
push 1
pop rdi
xor eax, eax
mov qword [rbp + 0x18], rax
xor esi, esi
xor eax, eax
xor r13d, r13d
xor r15d, r15d
xor edx, edx
jmp 0x14005a845
push 1
pop rax
lea rcx, [rbx + r12]
mov qword [rbp + 0x58], rcx
xor ecx, ecx
lea rdx, [0x1401fd948]
mov r15b, 1
cmp r12, rcx
je 0x14005a41b
mov rdi, rcx
movzx r13d, byte [rbx + rcx]
inc rcx
cmp byte [r13 + rdx], 0
jne 0x14005a36f
mov r9b, 3
cmp r13b, 0x2f
jne 0x14005a42c
test rdi, rdi
je 0x14005a42c
lea rsi, [rbx + rdi]
inc rsi
xor edx, edx
mov qword [rbp + 8], rdx
mov qword [rbp + 0x68], rcx
mov r14, qword [rbp + 0x68]
cmp rsi, qword [rbp + 0x58]
je 0x14005a434
mov rdx, rsi
inc rsi
movzx r13d, byte [rdx]
lea r8, [r14 + 1]
mov qword [rbp + 0x68], r8
cmp r13d, 0x2b
je 0x14005a3e7
cmp r13d, 0x3b
jne 0x14005a3ec
cmp r14, rcx
jbe 0x14005a3ec
jmp 0x14005a486
cmp r14, rcx
ja 0x14005a400
lea rdx, [0x1401fd948]
cmp byte [r13 + rdx], 0
jne 0x14005a3b5
jmp 0x14005a481
lea r8, [r14 + 1]
mov qword [rbp + 0x68], r8
inc rdx
mov rsi, rdx
mov rdx, rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], r14
jmp 0x14005a3b5
xor r9d, r9d
mov rdi, r12
mov r15b, 1
mov r14, r12
jmp 0x14005a842
mov r14, rdi
jmp 0x14005a842
lea r14, [rbp + 0x30]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.14005a08f
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x19], rax
movups xmm0, xmmword [r14]
invalid
movups xmmword [rbp - 0x29], xmm0
mov rcx, qword [rbp + 0x10]
jmp 0x14005a842
lea rcx, [rbp + 0x30]
Function at 0x14006649a
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov r8d, 0x20
call fcn.140068391
test rax, rax
je 0x1400664de
lea rdx, fcn.140009390
mov rcx, rax
call fcn.140065773
mov rax, qword [rdi + 0x30]
jmp 0x14006651b
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.140065a23
mov rax, qword [rdi + 0x30]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
and qword [rdi + 0x40], 0
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140065a78
Function at 0x140068391
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140068424
mov rdi, r8
mov rbx, rdx
mov r12d, 0xffffffff
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
test rdi, rdi
je 0x140068424
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call r13
cmp eax, 0xc0000000
jb 0x1400683c0
mov ebp, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x1400683c0
and ebp, 0x7fffffff
je 0x140068424
mov al, byte [0x1402c6358]
mov edx, 4
xor ecx, ecx
call fcn.1401a7480
test rax, rax
je 0x14006843e
mov dword [rax], ebp
jmp 0x140068426
xor eax, eax
lea rdx, fcn.140009390
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1401c6700
int3

Function at 0x140072e96
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
movzx ebx, word [rdx + 0x26]
lea eax, [rbx + 0xa]
test ax, ax
jle 0x140072f16
movzx ecx, bx
mov r14d, 0x3fff
add r14d, dword [rdi + 0x18]
and r14d, 0xffff8000
or r14d, 0x4000
and cl, 0x1f
xor cl, 0x10
push 0xffffffffffffffff
pop r15
shl r15d, cl
not r15d
mov ecx, ebx
and cl, 0x1f
xor cl, 0x10
mov edx, r14d
shr edx, cl
mov rcx, rdi
call fcn.140072e04
and r14d, r15d
lea eax, [rbx + 0xa]
lea ecx, [rbx - 8]
shr r15d, 8
mov ebx, ecx
cmp ax, 9
jae 0x140072eec
mov rbx, qword [rdi + 0x10]
lea r14, [rbp - 0x28]
mov rcx, r14
mov rdx, rbx
mov r8b, 1
call fcn.1401c24b1
cmp qword [r14], 0
mov r8, qword [r14 + 8]
jne 0x140072f93
mov r9, qword [rbp - 0x18]
mov rax, qword [rdi + 8]
lea rcx, [rbx - 1]
xor edx, edx
cmp rcx, 0xffffffffffffffff
je 0x140072f62
test rbx, rbx
je 0x140072f7a
add dx, word [rax + rcx*2]
movzx edx, dx
mov byte [r9 + rcx], dl
shr edx, 8
dec rcx
jmp 0x140072f44
mov qword [rsi], r8
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 8], r9
mov qword [rbp - 0x10], r8
lea r8, [0x1402189e8]
mov rdx, rbx
call fcn.1401c6eb0
ud2
mov rdx, qword [rbp - 0x18]
mov rcx, r8
call fcn.1401c66e0
int3