joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001cc00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x14001cc96
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14026e5a0]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14026e5b0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010e770
test rdi, rdi
je 0x14001cd16
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14001cd2f
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14001ce27
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14001cea8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x14001ce34
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x14001ccf0
add r8, rcx
cmp r9, 8
jae 0x14001ce3d
jmp 0x14001cea8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14010e770
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14001cea8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14001cea8
mov r8, rcx
cmp r9, 8
jb 0x14001cea8
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14001ce40
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140029640
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x4a8
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140029660
test al, 1
je 0x140029730
test al, 2
jne 0x140029748
test al, 8
jne 0x1400296a7
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
call fcn.140029290
jmp 0x1400296c5
test al, 0x10
je 0x1400296c5
mov rax, qword [rsi + 0x468]
test rax, rax
je 0x1400297cc
mov rcx, qword [rsi + 0x470]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402507c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140029760
jne 0x140029722
mov rcx, rsi
call fcn.1400107b0
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x1400298a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400298c0
test al, 1
je 0x140029990
test al, 2
jne 0x1400299a8
test al, 8
jne 0x140029907
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
call fcn.140029080
jmp 0x140029925
test al, 0x10
je 0x140029925
mov rax, qword [rsi + 0x1c8]
test rax, rax
je 0x140029a2c
mov rcx, qword [rsi + 0x1d0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140252ee0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400299c0
jne 0x140029982
mov rcx, rsi
call fcn.140010940
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x140029b00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140029b20
test al, 1
je 0x140029bf0
test al, 2
jne 0x140029c08
test al, 8
jne 0x140029b67
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
call fcn.140029080
jmp 0x140029b85
test al, 0x10
je 0x140029b85
mov rax, qword [rsi + 0x1c8]
test rax, rax
je 0x140029c8c
mov rcx, qword [rsi + 0x1d0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402507c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140029c20
jne 0x140029be2
mov rcx, rsi
call fcn.1400106f0
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x140029d60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140029d80
test al, 1
je 0x140029e4a
test al, 2
jne 0x140029e62
test al, 8
jne 0x140029dc1
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x80], 3
lea rdx, [rsp + 0x80]
call fcn.140029180
jmp 0x140029ddf
test al, 0x10
je 0x140029ddf
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x140029ee6
mov rcx, qword [rsi + 0x280]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402507c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140029e7a
jne 0x140029e3c
mov rcx, rsi
call fcn.140011730
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x140029fb0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x4a8
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140029fd0
test al, 1
je 0x14002a0a0
test al, 2
jne 0x14002a0b8
test al, 8
jne 0x14002a017
lea rcx, [rsi + 0x20]
movabs rax, 0x8000000000000001
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x80]
call fcn.140029290
jmp 0x14002a035
test al, 0x10
je 0x14002a035
mov rax, qword [rsi + 0x468]
test rax, rax
je 0x14002a13c
mov rcx, qword [rsi + 0x470]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140252ee0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14002a0d0
jne 0x14002a092
mov rcx, rsi
call fcn.140010a00
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x14002a210
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14002a230
test al, 1
je 0x14002a2fa
test al, 2
jne 0x14002a312
test al, 8
jne 0x14002a271
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x80], 3
lea rdx, [rsp + 0x80]
call fcn.140029180
jmp 0x14002a28f
test al, 0x10
je 0x14002a28f
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x14002a396
mov rcx, qword [rsi + 0x280]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140252ee0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14002a32a
jne 0x14002a2ec
mov rcx, rsi
call fcn.1400117e0
mov r8, qword [rsi - 8]
mov rcx, qword [0x14037f2d0]
xor edx, edx
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402699cc
nop
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140344520]
mov edx, 0x23
call fcn.1400a7990
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140344560]
mov edx, 0x25
call fcn.1400a7990
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:_xE4_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1403445a8]
lea rcx, [rsp + 0x50]
call fcn.1400a6c30
lea rax, str.HA4_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x140347980]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, str.__4_
lea rcx, [rsp + 0x80]
call fcn.1400a6c30
ud2
Function at 0x14002a460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x14026d228]
test ecx, ecx
je 0x14002a5ca
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14002a491
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14002a5fc
mov ecx, dword [0x14026d228]
test ecx, ecx
je 0x14002a602
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14002a61f
mov rsi, rax
test rax, rax
jne 0x14002a526
movzx eax, byte [0x14037f348]
mov rcx, qword [0x14037f2d0]
test rcx, rcx
jne 0x14002a4e3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14002a640
mov rcx, rax
mov qword [0x14037f2d0], rax
mov r8d, 0x60
xor edx, edx
call fcn.1402699c4
test rax, rax
je 0x14002a640
mov rsi, rax
lea rax, [0x14026d210]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14026d228]
test ecx, ecx
je 0x14002a62d
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x140342e40]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x140342e30]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x140342e20]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140342e10]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140342e00]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x14002a5fc
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x14002a5fc
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14002a5ec
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14002a5fc
call fcn.140022c50
jmp 0x14002a5fc
lea rcx, [0x14026d210]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14002a483
jmp 0x14002a491
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14002a5fc
call fcn.1400217a0
add rsi, 0x10
jmp 0x14002a621
lea rcx, [0x14026d210]
call fcn.1401f9570
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14002a4b0
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x14026d210]
call fcn.1401f9570
mov ecx, eax
jmp 0x14002a51e
mov ecx, 8
mov edx, 0x60
call fcn.140054b50
int3
Function at 0x1400a3df0
Capabilities:
Manipulate console buffer

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
test dl, dl
je 0x1400a3e1a
lea rdx, [0x14027fa10]
mov r8d, 5
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1400a34b0
xor eax, eax
cmp byte [rcx + 0x78], 0
sete al
or eax, 0xfffffff4
mov ecx, eax
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x3e], 0
lea rdi, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x1400a3eac
movzx ebx, word [rsp + 0x38]
movzx eax, word [rsp + 0x3e]
sub ax, word [rsp + 0x3a]
movzx ebp, word [rsp + 0x36]
mov dword [rsp + 0x30], 0
movsx r14d, ax
shl ebp, 0x10
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov dl, 0x20
mov r8d, r14d
mov r9d, ebp
call sub.kernel32.dll_FillConsoleOutputCharacterA
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov edx, ebx
mov r8d, r14d
mov r9d, ebp
call sub.kernel32.dll_FillConsoleOutputAttribute
mov rcx, rsi
mov edx, ebp
call sub.kernel32.dll_SetConsoleCursorPosition
xor eax, eax
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a4160
Capabilities:
Manipulate console buffer

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rdi, rcx
test dl, dl
je 0x1400a4232
inc rsi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x80], rax
lea rax, [fcn.1400a6d70]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
lea rax, [0x14027f7c8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x30]
call fcn.140055190
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a34b0
mov rdi, rax
test rbx, rbx
je 0x1400a4277
mov rcx, qword [0x14037f2d0]
xor edx, edx
mov r8, rsi
call fcn.1402699cc
jmp 0x1400a4277
xor ecx, ecx
cmp byte [rdi + 0x78], 0
sete cl
or ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x3e], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x1400a4275
shl esi, 0x10
mov rcx, rdi
mov edx, esi
call sub.kernel32.dll_SetConsoleCursorPosition
xor edi, edi
mov rax, rdi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400b0070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400b0100
cmp r11, r10
ja 0x1400b0176
cmp r10, rdx
ja 0x1400b0188
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400b0102
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400b00e0
jmp 0x1400b0164
ja 0x1400b010a
mov r11, r10
cmp rax, r8
jne 0x1400b00a4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400b0140
mov rdi, r8
sub ecx, edx
jns 0x1400b015b
jmp 0x1400b0166
cmp r8, rsi
je 0x1400b0197
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400b0166
xor al, 1
cmp rdi, rsi
jne 0x1400b0120
jmp 0x1400b0166
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400abaa0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400a75f0
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400a7990
int3
Function at 0x1400c7100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400c7196
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_rl]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140270cb0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c7530
test rdi, rdi
je 0x1400c7225
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400c723e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400c7336
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400c73b8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400c7343
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400c7200
cmp r9, 8
jae 0x1400c734c
jmp 0x1400c73b8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c7530
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400c73b8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400c73b8
mov r8, rcx
cmp r9, 8
jb 0x1400c73b8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400c7350
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret