joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ff930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov eax, gethostname
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm8
mov rbx, rcx
movsd xmm8, qword [0x140127e60]
cvtsi2sd xmm6, rax
test rax, rax
jns 0x1400ff969
addsd xmm6, xmm8
movaps xmm0, xmm8
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2]
divsd xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
movsd xmm6, qword [0x140127e58]
mov ecx, 1
cvttsd2si eax, xmm0
xorps xmm7, xmm7
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1400ffaa3
mov qword [rsp + 0x60], rbp
movabs rbp, 0x38eb3ffff6d3
mov qword [rsp + 0x68], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x70], rdi
mov edi, eax
mov eax, dword [rbx]
cmp eax, 0x138
jne 0x1400ffa1c
lea r8, [rbx + 0x10]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400ff9e0
jmp 0x1400ffa2b
cmp eax, 0x270
jb 0x1400ffa2b
mov rcx, rbx
call fcn.140101040
mov eax, dword [rbx]
xorps xmm1, xmm1
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rbp
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
cvtsi2sd xmm1, rax
jns 0x1400ffa7d
addsd xmm1, xmm8
mulsd xmm1, xmm6
mulsd xmm6, xmm8
addsd xmm7, xmm1
sub rdi, 1
jne 0x1400ff9c5
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret

Function at 0x140101040
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
lea r9, [rcx + 0x9c8]
movabs rbx, 0xb5026f5aa96619e9
mov r11d, 0x9c
nop
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x140101060
lea r9, [r10 + 0xea8]
mov r11d, 0x9b
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1401010b0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], r11d
ret
Function at 0x140101b20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140101bcf
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x140101c97
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140101c85
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x140101c85
shr ecx, 1
je 0x140101c43
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x140101c39
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x140101c30
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1401019b0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.140101610
jmp 0x140101c9f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1400933a0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.140106d80
add rsp, 0xae0
pop rbx
ret
Function at 0x140101d10
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1401280b0]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1401280b4]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x140128098]
mov word [rsp + 0x6c], ax
mov eax, gethostbyname
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1401280a8]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140101e14
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140101dc8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x140101e37
inc ax
mov word [rsp + 0x6a], ax
jmp 0x140101de3
cmp eax, 0xe7
jne 0x140101e37
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140101e37
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140101da8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140106d80
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x140101e19

Function at 0x140101e40
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140101e60
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x140101e56
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140101e56
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140101eeb
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x140101f00
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140101ed4
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.140101cc0
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140101f10
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x140101f26
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x140101f33
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140101f2b
test rdx, rdx
je 0x140101f2b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140101f6a
cmp dword [rsp + 0x50], edi
jne 0x140101f6a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140106b30
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140106bb4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140106bb4
dec r8
sub rdx, 1
jne 0x140106b9a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140107f1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140107f66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140107f66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140107f66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140107f66
cmp dword [rcx + 0x84], 0xe
jbe 0x140107f66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140107f68
xor al, al
add rsp, 0x28
ret
Function at 0x1401b35a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401b35cd
xor al, al
jmp 0x1401b372f
mov rax, qword [0x1401d36b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401d36b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401d36c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401d36c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401d36d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401d36d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401d36e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401d36e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401d36f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401b3721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401b3679
mov r11d, 2
jmp 0x1401b369d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401b3693
mov r11d, 1
jmp 0x1401b369d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1401b3745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401b36e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401b36fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401b370a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401b3718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1401b3660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401b372a
Function at 0x4025f7
Capabilities:
Hash data using sha256

Disassembly:
add qword [rcx + 0x20], r8
jmp 0x559eff

Function at 0x4033a6
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x41ac4f
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x44731f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, rdx
mov r15, rcx
mov r9, qword [rdx]
mov rsi, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
cmp r9, rsi
je 0x4473a3
lea r14, [r9 + 0x10]
mov qword [rdi], r14
mov rcx, qword [rbx + 0x90]
mov rdx, qword [rbx + 0xa0]
mov r8, qword [r9]
mov r9, qword [r9 + 8]
call fcn.00442c6c
mov r9, r14
test rax, rax
je 0x447343
cmp qword [rax + 0x1f8], 0
jne 0x4473bb
cmp dword [rax + 0x218], 0x110000
jne 0x4473bb
mov rdi, qword [rax + 0x178]
cmp rdi, 1
je 0x4473d9
test rdi, rdi
jne 0x447402
mov rdx, qword [rax + 0x68]
mov r8, qword [rax + 0x70]
jmp 0x4473e7
and qword [r15], 0
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
mov rdx, rax
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.00443aac
mov rax, qword [rax + 0x168]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r15
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x43fc91
mov qword [rsp + 0x30], r15
mov r12, qword [rax + 0x168]
mov rcx, rdi
call fcn.00441ad6
lea r14, [rsp + 0xa0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
mov rcx, r14
mov rdx, rdi
call fcn.00441b38
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x28], rax
imul r13, rax, 0x18
add r13, qword [r14]
neg rdi
xor ebp, ebp
lea rbx, [0x005b4a00]
lea rsi, [rsp + 0x40]
lea r14, [rsp + 0x88]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 2
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [0x0044751a]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 1
mov rcx, r14
mov rdx, r15
call fcn.0043fc51
mov rax, qword [rsp + 0x98]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [r13], xmm0
dec rbp
add r13, 0x18
add r12, 0x10
cmp rdi, rbp
jne 0x447463
mov r8, qword [rsp + 0x28]
sub r8, rbp
movups xmm0, xmmword [rsp + 0xa0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], r8
mov rdx, qword [rdi]
mov qword [rsp + 0x20], 1
lea r9, [0x0066ecad]
mov rcx, qword [rsp + 0x30]
call fcn.00446fe5
mov rcx, rdi
call fcn.004041ae
jmp 0x4473a7
Function at 0x46a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x46a8f0
cmp r10, r11
jb 0x46a966
cmp r10, rdx
ja 0x46a97a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x46a8f2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x46a8d0
jmp 0x46a954
ja 0x46a8fa
mov r11, r10
cmp rax, r8
jne 0x46a894
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x46a930
mov rdi, r8
sub ecx, edx
jns 0x46a94b
jmp 0x46a956
cmp r8, rsi
je 0x46a98b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x46a956
xor al, 1
cmp rdi, rsi
jne 0x46a910
jmp 0x46a956
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.00465990
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.00464560
ud2
lea rcx, [0x0069f46b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.00464920
ud2

Function at 0x47906d
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.0055d750
dec eax
ret

Function at 0x481264
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x48128a
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x481274
mov qword [rcx], rax
ret

Function at 0x481372
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.00493f7a
test rbx, rbx
je 0x4813ab
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.00481264
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.0048125c
Function at 0x4a5584
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.004a7a12
test rax, rax
je 0x4a55bc
mov edx, 4
mov rcx, rax
call fcn.00417e40
jmp 0x4a55f5
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.004a49a2
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.004a4a67
Function at 0x4a561e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, rcx
lea rcx, [0x005ab068]
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4a5657
mov rsi, rax
cmp qword [rax + 8], 0
je 0x4a5657
add rsi, 8
jmp 0x4a57e7
lea rbx, [0x005ab068]
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4a57e5
mov rsi, rax
test rax, rax
jne 0x4a56ab
mov ecx, 0x10
mov edx, 8
call fcn.004a4972
mov rsi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x4a56c7
mov rbx, qword [rdi]
and qword [rdi], 0
test rbx, rbx
jne 0x4a57d4
xor ecx, ecx
call fcn.004a4952
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.004a7a12
test rax, rax
jne 0x4a57f5
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdi, [rsp + 0x50]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rdi
call fcn.004a49a2
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movups xmmword [rbx - 8], xmm0
movups xmmword [rbx + 8], xmm1
movups xmmword [rbx + 0x18], xmm2
movups xmm0, xmmword [rbx - 0x10]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x30], rax
mov ecx, 0x170
mov edx, 0x10
call fcn.004a4972
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x10]
mov r8d, 0x100
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rbx + 0x110], 0x40
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x118], xmm0
movups xmmword [rbx + 0x128], xmm1
movups xmmword [rbx + 0x138], xmm2
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x148], rax
mov eax, 0x10000
mov qword [rbx + 0x150], rax
mov qword [rbx + 0x158], rax
and qword [rbx + 0x160], 0
add rsi, 8
mov rcx, qword [rsi]
mov qword [rsi], rbx
call fcn.004a4952
jmp 0x4a57e7
xor esi, esi
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], rax
lea rax, [0x00607d68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rax], rdi
lea rdx, str.could_not_initialize_thread_rng:
lea rcx, [rsp + 0x90]
mov qword [rcx], rdx
mov edx, 1
mov qword [rcx + 8], rdx
and qword [rcx + 0x20], 0
lea r8, [0x004a79c3]
mov qword [rax + 8], r8
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_rand_0.8.5_src_rngs_thread.rs
call fcn.00463750
ud2
Function at 0x4a7a12
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x4a7aa3
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x4a7a32
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x4a7a32
xor ebx, 0x80000000
je 0x4a7aa1
mov al, byte [0x006be1f0]
mov ecx, 4
mov edx, 4
call fcn.00417db0
test rax, rax
je 0x4a7ab6
mov rsi, rax
mov dword [rax], ebx
jmp 0x4a7aa3
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.0043b510
ud2