joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053bb5
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rax
movabs r8, 0x100000001b3
mov r9, qword [rcx + 0x18]
xor eax, eax
test r9, r9
setne al
mov qword [rsp], rax
mov rax, qword [rdx]
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor rax, r11
imul rax, r8
cmp r10, 8
jne 0x140053bd6
test r9, r9
je 0x140053c18
mov r9, qword [rcx + 8]
test r9, r9
je 0x140053c3b
mov r10, qword [rcx]
xor r11d, r11d
movzx ecx, byte [r10 + r11]
xor rcx, rax
imul rcx, r8
inc r11
mov rax, rcx
cmp r9, r11
jne 0x140053bff
jmp 0x140053c3e
movzx ecx, byte [rcx]
mov qword [rsp], rcx
xor ecx, ecx
movzx r9d, byte [rsp + rcx]
inc rcx
xor rax, r9
imul rax, r8
cmp rcx, 8
jne 0x140053c21
mov qword [rdx], rax
jmp 0x140053c41
mov rcx, rax
mov qword [rdx], rcx
pop rax
ret

Function at 0x140053c43
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140053c7e
mov r15d, 8
sub r15, r11
cmp r8, r15
mov rax, r15
cmovb rax, r8
cmp rax, 3
jbe 0x140053c86
mov r14d, dword [rdx]
mov r10d, 4
jmp 0x140053c8c
xor r15d, r15d
jmp 0x140053d3a
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140053caf
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x140053cc6
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x140053ce6
add r11, r8
jmp 0x140053e09
mov rdi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 8]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x18], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x10], rcx
mov qword [r9 + 8], rsi
xor rax, r14
mov qword [r9], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140053dae
mov rax, qword [r9 + 0x18]
mov rsi, qword [r9]
mov rcx, qword [r9 + 8]
mov rdi, qword [r9 + 0x10]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140053d5c
mov qword [r9 + 0x18], rax
mov qword [r9], rsi
mov qword [r9 + 0x10], rdi
mov qword [r9 + 8], rcx
cmp r11d, 3
jbe 0x140053dc0
mov esi, dword [rdx + r15]
mov r8d, 4
jmp 0x140053dc5
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x140053deb
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x140053e05
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140054854
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r9, rdx
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x14005495f
mov r13, rcx
add rcx, 0x40
mov rdx, r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rax
call fcn.1400539b6
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10d, eax
movzx r15d, ax
movzx r12d, word [r13 + 0x58]
and r15d, r12d
mov rbp, qword [r13]
mov rdi, qword [r13 + 8]
mov r13, qword [r13 + 0x18]
xor r14d, r14d
mov rax, r15
mov r15, rax
mov eax, 0
cmp r15, rdi
jae 0x1400548b8
movzx ecx, word [rbp + r15*4]
cmp rcx, 0xffff
je 0x14005495f
movzx esi, word [rbp + r15*4 + 2]
mov eax, esi
and eax, r12d
mov ebx, r15d
sub ebx, eax
and ebx, r12d
cmp r14, rbx
ja 0x14005495f
cmp si, r10w
jne 0x140054954
cmp rdx, rcx
jbe 0x140054990
imul rax, rcx, 0x68
mov rsi, qword [r13 + rax + 0x18]
test rsi, rsi
sete cl
cmp qword [r9 + 0x18], 0
sete bl
xor bl, cl
jne 0x140054954
add rax, r13
test rsi, rsi
je 0x14005494d
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x140054954
mov rdx, qword [r9]
mov rcx, qword [rax]
mov esi, r10d
call sub.VCRUNTIME140.dll_memcmp
mov r10d, esi
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
test eax, eax
jne 0x140054954
jmp 0x14005498b
mov al, byte [rax]
cmp al, byte [r9]
je 0x14005498b
inc r14
inc r15
jmp 0x1400548b5
xor edi, edi
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140054978
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
call qword [rax + 0x10]
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dil, 1
jmp 0x140054961
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
call fcn.1402a64c0
ud2
Function at 0x14005499e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r9, rdx
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x140054aaf
mov rdi, rcx
add rcx, 0x40
mov rdx, r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rax
call fcn.1400539b6
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10d, eax
movzx r15d, ax
movzx r12d, word [rdi + 0x58]
and r15d, r12d
mov rbp, qword [rdi]
mov r13, qword [rdi + 8]
mov r11, qword [rdi + 0x18]
xor r14d, r14d
mov rax, r15
mov r15, rax
mov eax, 0
cmp r15, r13
jae 0x140054a01
movzx ecx, word [rbp + r15*4]
cmp rcx, 0xffff
je 0x140054aaf
movzx edi, word [rbp + r15*4 + 2]
mov eax, edi
and eax, r12d
mov esi, r15d
sub esi, eax
and esi, r12d
cmp r14, rsi
ja 0x140054aaf
cmp di, r10w
jne 0x140054aa4
cmp rdx, rcx
jbe 0x140054ae6
imul rdi, rcx, 0x68
mov rcx, qword [r11 + rdi + 0x18]
test rcx, rcx
sete al
cmp qword [r9 + 0x18], 0
sete bl
xor bl, al
jne 0x140054aa4
lea rax, [r11 + rdi]
test rcx, rcx
je 0x140054a9d
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x140054aa4
mov rdx, qword [r9]
mov rcx, qword [rax]
mov esi, r10d
mov rbx, r11
call sub.VCRUNTIME140.dll_memcmp
mov r11, rbx
mov r10d, esi
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
test eax, eax
jne 0x140054aa4
jmp 0x140054adc
mov al, byte [rax]
cmp al, byte [r9]
je 0x140054adc
inc r14
inc r15
jmp 0x1400549fe
xor esi, esi
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140054ac8
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
call qword [rax + 0x10]
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [r11 + rdi]
add rsi, 0x20
jmp 0x140054ab1
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
call fcn.1402a64c0
ud2
Function at 0x140068b2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x38], rcx
mov rcx, rdx
call fcn.140053e15
lea rcx, [rdi + 0x40]
mov qword [rsp + 0x40], rcx
mov rdx, rsi
call fcn.1400539b6
mov r9, rsi
mov r10d, eax
movzx eax, ax
movzx r14d, word [rdi + 0x58]
mov r13d, r14d
mov dword [rsp + 0x2c], eax
and r13d, eax
mov r12, qword [rdi]
mov rsi, qword [rdi + 8]
mov r11, qword [rdi + 0x20]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], r11
mov rax, r13
mov r13, rax
mov eax, 0
cmp r13, rsi
jae 0x140068b9f
movzx edi, word [r12 + r13*4]
cmp rdi, 0xffff
je 0x140068c62
movzx eax, word [r12 + r13*4 + 2]
mov ecx, r14d
and ecx, eax
mov edx, r13d
sub edx, ecx
and edx, r14d
cmp rdx, rbp
setb r15b
jb 0x140068c8e
cmp ax, r10w
jne 0x140068c57
cmp r11, rdi
jbe 0x140068d3d
imul rax, rdi, 0x68
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + rax + 0x18]
test rcx, rcx
sete dl
mov rbx, qword [r9 + 0x18]
mov qword [rsp + 0x48], rbx
test rbx, rbx
sete bl
xor bl, dl
jne 0x140068c57
add rax, qword [rsp + 0x50]
test rcx, rcx
je 0x140068c4c
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x140068c57
mov rdx, qword [r9]
mov rcx, qword [rax]
mov ebx, r10d
call sub.VCRUNTIME140.dll_memcmp
mov r11, qword [rsp + 0x58]
mov r10d, ebx
mov r9, qword [rsp + 0x60]
test eax, eax
jne 0x140068c57
jmp 0x140068d20
mov al, byte [rax]
cmp al, byte [r9]
je 0x140068d20
inc rbp
inc r13
jmp 0x140068b9c
cmp rbp, 0x200
setae cl
mov rax, qword [rsp + 0x40]
cmp qword [rax], 2
setne al
and al, cl
mov r8, qword [r9]
mov rdi, qword [r9 + 8]
mov rbx, qword [r9 + 0x10]
mov rcx, qword [r9 + 0x18]
mov r15b, 1
jmp 0x140068cb5
cmp rbp, 0x200
setae cl
mov rax, qword [rsp + 0x40]
cmp qword [rax], 2
setne al
and al, cl
mov r8, qword [r9]
mov rdi, qword [r9 + 8]
mov rbx, qword [r9 + 0x10]
mov rcx, qword [r9 + 0x18]
mov rbp, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x2c]
mov qword [rbp], r8
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], rdx
mov word [rbp + 0x30], si
mov byte [rbp + 0x32], al
test r15b, r15b
jne 0x140068d0e
test rcx, rcx
je 0x140068d0e
mov rax, qword [rcx + 0x10]
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 2
mov r8, r13
mov rdx, qword [rsp + 0x30]
mov rbx, rdx
mov rbp, qword [rsp + 0x38]
mov esi, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x48]
jmp 0x140068cc3
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rcx, rdi
mov rdx, r11
call fcn.1402a64c0
ud2
Function at 0x1400697b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x1400698cf
mov qword [rsp + 0x30], rcx
lea rcx, [rsi + 0x40]
mov rdx, r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], rax
call fcn.1400539b6
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov ebp, eax
movzx r12d, ax
movzx edi, word [rsi + 0x58]
and r12d, edi
mov r14, qword [rsi]
mov r15, qword [rsi + 8]
mov qword [rsp + 0x28], rsi
mov r10, qword [rsi + 0x18]
xor r13d, r13d
mov rax, r12
mov r12, rax
mov eax, 0
cmp r12, r15
jae 0x14006981c
movzx ebx, word [r14 + r12*4]
cmp rbx, 0xffff
je 0x1400698c1
movzx eax, word [r14 + r12*4 + 2]
mov ecx, eax
and ecx, edi
mov esi, r12d
sub esi, ecx
and esi, edi
cmp r13, rsi
ja 0x1400698c1
cmp ax, bp
jne 0x1400698b6
cmp rdx, rbx
jbe 0x14006992a
imul rax, rbx, 0x68
mov rsi, qword [r10 + rax + 0x18]
test rsi, rsi
sete r8b
cmp qword [r9 + 0x18], 0
sete cl
xor cl, r8b
jne 0x1400698b6
add rax, r10
test rsi, rsi
je 0x1400698af
mov r8, qword [rax + 8]
cmp r8, qword [r9 + 8]
jne 0x1400698b6
mov rdx, qword [r9]
mov rcx, qword [rax]
mov rsi, r10
call sub.VCRUNTIME140.dll_memcmp
mov r10, rsi
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
test eax, eax
jne 0x1400698b6
jmp 0x140069919
mov al, byte [rax]
cmp al, byte [r9]
je 0x140069919
inc r13
inc r12
jmp 0x140069819
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
xor eax, eax
jmp 0x1400698d1
xor eax, eax
mov qword [rcx + 0x10], rsi
mov qword [rcx], rax
mov qword [rcx + 8], rbx
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140069907
mov rax, qword [rax + 0x10]
lea rcx, [r9 + 0x10]
mov rdx, qword [r9]
mov r8, qword [r9 + 8]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
jmp 0x1400698d1
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823http_0.2.9_srcheadermap.rs
mov rcx, rbx
call fcn.1402a64c0
ud2
Function at 0x14007b9f8
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.14007e01e
test rax, rax
je 0x14007ba35
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14007ba6e
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.14007dfb7
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.14007bb2b
Function at 0x14007e01e
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdx, rcx
mov ebx, 0x20
xor r14d, r14d
mov r15d, 0xffffffff
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test rbx, rbx
je 0x14007e099
cmp rbx, r15
mov r8d, 0xffffffff
cmovb r8, rbx
sub rbx, r8
lea rsi, [rdx + r8]
xor ecx, ecx
mov r9d, 2
call r12
mov rdx, rsi
cmp eax, 0xc0000000
jb 0x14007e043
mov edi, eax
xor edi, 0x80000000
je 0x14007e096
mov ecx, 4
mov edx, 4
call fcn.1400235d0
test rax, rax
je 0x14007e0aa
mov r14, rax
mov dword [rax], edi
jmp 0x14007e099
xor r14d, r14d
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1402a5fb0
ud2

Function at 0x14009f5bd
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14009f69f
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov r10, qword [rdx]
movabs rax, 0xcbf29ce484222325
xor rax, r10
movabs rcx, 0x100000001b3
imul rax, rcx
movzx r8d, byte [rdx + 8]
xor rax, r8
imul rax, rcx
movzx r9d, byte [rdx + 9]
xor rax, r9
imul rax, rcx
xor r11d, r11d
xor edx, edx
div rdi
mov r12, rdx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x20]
mov rax, qword [rbx + r12*8]
lea rcx, [rax + rax*2]
lea rcx, [rdi + rcx*8]
cmp rax, rdx
cmovae rcx, r11
jae 0x14009f65d
cmp qword [rcx], r10
jne 0x14009f65d
cmp byte [rcx + 8], r8b
jne 0x14009f65d
cmp byte [rcx + 9], r9b
jne 0x14009f65d
mov rdx, qword [rcx + 0x10]
mov eax, 1
jmp 0x14009f691
lea rcx, [rsi + 0x10]
mov qword [rbx + r12*8], rdx
cmp rdx, qword [rcx]
jne 0x14009f677
call fcn.14007e5bc
mov rdi, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x20]
lea rax, [rdx + rdx*2]
movups xmm0, xmmword [r15]
movups xmmword [rdi + rax*8], xmm0
mov qword [rdi + rax*8 + 0x10], r14
inc rdx
mov qword [rsi + 0x20], rdx
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x14030ef40]
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_1.7.3_srccompile.rs
mov edx, 0x39
call fcn.1402a6560
ud2
Function at 0x1400a042a
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x18]
mov rax, qword [rdi + 0x70]
mov rcx, qword [rcx]
cmp rax, 3
jb 0x1400a046c
mov rdx, rcx
sub rdx, qword [rsi + 8]
jb 0x1400a046c
mov rbp, qword [rdi + 0x68]
add rbp, rbp
lea rbp, [rbp + rbp*4]
cmp rdx, rbp
jbe 0x1400a05f5
mov qword [rsi + 8], rcx
inc rax
mov qword [rdi + 0x70], rax
mov edx, 0xbfffffff
and edx, dword [rsi + 0x20]
mov rcx, rdi
call fcn.1400a03d4
mov r13, qword [rax]
lock inc qword [r13]
jle 0x1400a060a
mov r12, qword [rax + 8]
mov edx, dword [rsi + 0x24]
cmp edx, 0x20000000
jae 0x1400a04bf
mov rcx, rdi
call fcn.1400a03d4
mov r15, qword [rax]
lock inc qword [r15]
jle 0x1400a060a
mov r14, qword [rax + 8]
jmp 0x1400a04c2
xor r15d, r15d
mov rax, qword [rdi + 0xa8]
add rax, qword [rdi + 0x90]
shl rax, 2
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x18], 0
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x38]
call fcn.14009977d
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x1400a0505
mov rcx, qword [rdi + 0x38]
lea r8, [rbx + 0x11]
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rdi + 0x30], rax
lea rcx, [rbx + 1]
mov rdx, rcx
shr rdx, 3
and rcx, 0xfffffffffffffff8
sub rcx, rdx
cmp rbx, 8
cmovb rcx, rbx
mov qword [rdi + 0x28], rcx
mov rbx, qword [rdi + 0x60]
mov rbp, qword [rdi + 0x68]
mov qword [rdi + 0x68], rax
test rbp, rbp
je 0x1400a0565
shl rbp, 4
xor edi, edi
mov rax, qword [rbx + rdi]
lock dec qword [rax]
jne 0x1400a0558
mov rcx, qword [rbx + rdi]
mov rdx, qword [rbx + rdi + 8]
call fcn.1400996f0
add rdi, 0x10
cmp rbp, rdi
jne 0x1400a0540
mov rdi, qword [rsi + 0x18]
mov rax, qword [rdi + 0x90]
test rax, rax
je 0x1400a058e
mov rcx, qword [rdi + 0x88]
shl rax, 2
xor edx, edx
mov dword [rcx + rdx], 0x80000000
add rdx, 4
cmp rax, rdx
jne 0x1400a057e
mov rbx, qword [rsi + 0x10]
mov rcx, rbx
mov rdx, rdi
mov r8, r13
mov r9, r12
call fcn.1400a0638
test eax, eax
je 0x1400a060e
mov ebp, edx
cmp byte [rbx + 0x2db], 0
jne 0x1400a05d0
mov rcx, rbx
call fcn.140099f84
test rax, rax
je 0x1400a05d0
mov eax, ebp
or eax, 0x40000000
cmp byte [rbx + 0x2dc], 0
cmove ebp, eax
mov dword [rsi + 0x20], ebp
mov bpl, 1
test r15, r15
je 0x1400a05f7
mov rcx, rbx
mov rdx, rdi
mov r8, r15
mov r9, r14
call fcn.1400a0638
test eax, eax
je 0x1400a061e
mov dword [rsi + 0x24], edx
jmp 0x1400a05f7
xor ebp, ebp
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_1.7.3_srcdfa.rs
jmp 0x1400a062c
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.C:UsersBraVera.cargo_registry_srcgithub.com_1ecc6299db9ec823_regex_1.7.3_srcdfa.rs
mov edx, 0x2b
call fcn.1402a6560
ud2
Function at 0x1400cc3e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov qword [rsp + 0x40], r9
mov byte [rsp + 0x33], r8b
mov dword [rsp + 0x34], edx
mov r14, rcx
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x1e0]
mov r15, qword [rdi + 8]
mov ebp, dword [rdi]
mov esi, dword [rdi + 4]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.14004f58c
mov bl, byte [rax + 0x60]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.14004f58c
mov r12b, byte [rax + 0x60]
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.14004f58c
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x50], rax
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.14004f58c
mov r13d, dword [rax + 0xb8]
cmp bl, 5
ja 0x1400cc4a3
cmp bl, 3
jne 0x1400cc505
mov rbx, r14
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.140050feb
mov r14, rax
movzx eax, byte [rax + 0x60]
lea ecx, [rax - 6]
cmp cl, 6
jb 0x1400cc4de
cmp eax, 4
ja 0x1400cc4de
cmp eax, 3
je 0x1400cc4de
mov rcx, r14
add rcx, 0x60
call fcn.14010181b
mov byte [r14 + 0x60], 0
mov al, byte [rsp + 0x33]
mov byte [r14 + 0x61], al
mov dword [r14 + 0x64], r13d
mov eax, dword [rsp + 0x34]
mov dword [r14 + 0x68], eax
cmp r12b, 5
ja 0x1400cc519
cmp qword [rsp + 0x50], 0
jne 0x1400cc519
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov r14, qword [rsp + 0x40]
mov rdx, r14
mov r8, rdi
call fcn.14010627c
mov rcx, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x20]
mov r8d, ebp
mov r9d, esi
call fcn.14004f58c
mov eax, dword [rax + 0xb8]
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdx + 8], eax
mov byte [rdx], 8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r8, r14
mov r9, rdi
call fcn.140106400
mov rcx, rbx
mov rdx, rdi
mov r8, qword [rsp + 0x48]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140057e73
Function at 0x1400cceb4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400ccedc
mov rax, qword [rcx]
mov rsi, qword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x1400cd040
lea rcx, [0x140166c50]
call fcn.140063a1c
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r14, 0x646f72616e646f6d
xor r14, rdx
movabs r9, 0x6c7967656e657261
xor r9, rax
add r8, r14
rol r14, 0xd
xor r14, r8
rol r8, 0x20
mov r10, r14
rol r10, 0x11
mov r15d, 1
movabs r11, 0x7465646279746573
mov rax, rdx
xor rax, r15
xor rax, r11
lea rdi, [rax + r9]
rol rax, 0x10
xor rax, rdi
lea rbx, [rax + r8]
rol rax, 0x15
xor rax, rbx
add rdi, r14
mov rsi, rdi
xor rsi, r10
rol rdi, 0x20
xor rbx, r15
add rbx, rsi
rol rsi, 0xd
mov rcx, rax
xor rsi, rbx
rol rbx, 0x20
btc rcx, 0x3b
add rdi, rcx
shrd rcx, rax, 0x30
xor rcx, rdi
add rbx, rcx
rol rcx, 0x15
add rdi, rsi
rol rsi, 0x11
xor rcx, rbx
xor rsi, rdi
rol rdi, 0x20
btc rbx, 0x3b
add rbx, rsi
rol rsi, 0xd
xor rsi, rbx
rol rbx, 0x20
xor rdi, 0xff
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rbx, rcx
rol rcx, 0x15
add rdi, rsi
rol rsi, 0x11
xor rsi, rdi
rol rdi, 0x20
xor rcx, rbx
add rbx, rsi
rol rsi, 0xd
xor rsi, rbx
rol rbx, 0x20
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rbx, rcx
rol rcx, 0x15
add rdi, rsi
rol rsi, 0x11
xor rsi, rdi
rol rdi, 0x20
xor rcx, rbx
add rbx, rsi
rol rsi, 0xd
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
rol rcx, 0x15
xor rsi, rbx
add rdi, rsi
rol rsi, 0x11
mov rax, rdi
rol rax, 0x20
xor rsi, rdi
xor rsi, rcx
inc r15
xor rsi, rax
je 0x1400ccf34
mov eax, dword [0x1403ce748]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x28], 1
mov qword [rax + 0x30], rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d210a
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov r14, rcx
lea rsi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rsi
mov rdx, rax
call fcn.1400d1e22
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r12, [rsp + 0x3c]
mov dword [r12], 0
mov ecx, 0x800
call fcn.14017f18f
mov rdi, rdx
lea r15, [rsp + 0x40]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9, r12
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400d21bf
mov r8d, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
cmp rax, r8
jae 0x1400d2177
mov rcx, r15
call fcn.1402acc40
mov rdi, qword [rsp + 0x48]
jmp 0x1400d2177
test eax, eax
jne 0x1400d21e1
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x1400d220d
movabs rax, 0xde00000002
jmp 0x1400d21e9
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
cmp qword [rsp + 0x40], 0
je 0x1400d2223
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400d2223
mov rcx, qword [rsp + 0x50]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
cmp qword [rsp + 0x58], 0
je 0x1400d223f
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret