joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400407c0
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140040997
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x10a0
call fcn.140069ef0
sub rsp, rax
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
lea rsi, [rsp + 0x10d0]
xor eax, eax
mov word [rsp + 0x90], ax
xor edx, edx
mov r8d, 0xffe
lea rcx, [rsp + 0x92]
call fcn.140051b60
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x6c]
movzx edx, word [rsp + 0x6a]
movzx edi, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r10d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._.4d__.2d__.2d__.2d:_.2d:_.2d__T_P:_d__d_
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.140050e44
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov edx, 0x7fd
sub rdx, rcx
lea rcx, [rsp + rcx*2 + 0x90]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rsp + 0x10c8]
call fcn.14004e910
test eax, eax
js 0x14004097d
lea r8, [0x14008bab0]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.140050da8
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [0x1400af248]
mov qword [rsp + 0x88], rdx
or edx, 0xffffffff
mov rcx, qword [0x1400af248]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
call fcn.140040720
test rax, rax
je 0x140040970
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140040440
nop
mov rcx, qword [0x1400af248]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.14004e770
add rsp, 0x10a0
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x1400407c9
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140040997
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x10a0
call fcn.140069ef0
sub rsp, rax
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
lea rsi, [rsp + 0x10d0]
xor eax, eax
mov word [rsp + 0x90], ax
xor edx, edx
mov r8d, 0xffe
lea rcx, [rsp + 0x92]
call fcn.140051b60
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x6c]
movzx edx, word [rsp + 0x6a]
movzx edi, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r10d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._.4d__.2d__.2d__.2d:_.2d:_.2d__T_P:_d__d_
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.140050e44
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov edx, 0x7fd
sub rdx, rcx
lea rcx, [rsp + rcx*2 + 0x90]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rsp + 0x10c8]
call fcn.14004e910
test eax, eax
js 0x14004097d
lea r8, [0x14008bab0]
mov edx, 0x800
lea rcx, [rsp + 0x90]
call fcn.140050da8
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [0x1400af248]
mov qword [rsp + 0x88], rdx
or edx, 0xffffffff
mov rcx, qword [0x1400af248]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
call fcn.140040720
test rax, rax
je 0x140040970
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140040440
nop
mov rcx, qword [0x1400af248]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.14004e770
add rsp, 0x10a0
pop rdi
pop rsi
pop rbx
repz ret

Function at 0x14004f6d8
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14004f6ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004f6f0
xor eax, eax
test eax, eax
je 0x14004f700
mov ecx, eax
call fcn.140051994
or eax, 0xffffffff
jmp 0x14004f702
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400522bc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140060ac4
nop
cmp dword [0x1400ade20], 1
je 0x140052268
mov dword [0x1400ade1c], 1
mov byte [0x1400ade18], r12b
test ebx, ebx
jne 0x140052254
mov rcx, qword [0x1400b04b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140052241
mov rcx, qword [0x1400b04a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400521e0
call fcn.140053010
cmp qword [rdi], rax
jne 0x1400521e0
jmp 0x1400521c6
cmp rdi, rsi
jb 0x140052241
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140053010
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400b04b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400b04a8]
call fcn.1400066ee
cmp r14, rbx
jne 0x14005221f
cmp r13, rax
je 0x14005223f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400521c6
lea rdx, [0x1400759f0]
lea rcx, [0x1400759d8]
call fcn.140052010
lea rdx, [0x140075a00]
lea rcx, [0x1400759f8]
call fcn.140052010
nop
test r12d, r12d
je 0x140052277
mov ecx, 8
call fcn.1400609c4
test r12d, r12d
jne 0x1400522a2
mov dword [0x1400ade20], 1
lea ecx, [r12 + 8]
call fcn.1400609c4
mov ecx, r15d
call fcn.140051fa4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140052130

Function at 0x1400522c8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140052130
Function at 0x14005350b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400a6fa0]
jne 0x14004e78a
rol rcx, 0x10
test cx, 0xffff
jne 0x14004e786
repz ret
ror rcx, 0x10
jmp 0x140053464
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400ae410]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400ae508]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400534e9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400ae410]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14005350b
mov rax, qword [rsp + 0x88]
mov qword [0x1400ae508], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400ae4a8], rax
mov rax, qword [0x1400ae508]
mov qword [0x1400ae380], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400ae490], rax
mov dword [0x1400ae370], 0xc0000409
mov dword [0x1400ae374], 1
mov rax, qword [0x1400a6fa0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400a6fa8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400ae408], eax
mov ecx, 1
call fcn.1400566cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140079110]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400ae408], 0
jne 0x140053592
mov ecx, 1
call fcn.1400566cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140060ea0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140053010
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400aecc0], rbx
jne 0x140060fa6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14006107b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006107b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400aecc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140079468]
mov rcx, rsi
mov qword [0x1400aecc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1400aecd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400aece0], rax
test rax, rax
je 0x140060f9d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400aecd8], rax
jmp 0x140060fad
mov rax, qword [0x1400aecd8]
jmp 0x140060fb4
mov rax, qword [0x1400aecd8]
mov r11, qword [0x1400aece0]
cmp rax, rdi
je 0x14006101c
cmp r11, rdi
je 0x14006101c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400aece0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14006101c
test rax, rax
je 0x14006101c
call rsi
test rax, rax
je 0x140061016
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140061016
test byte [rsp + 0x38], 1
jne 0x14006101c
bts ebp, 0x15
jmp 0x14006105a
mov rcx, qword [0x1400aecc8]
cmp rcx, rdi
je 0x14006105a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006105a
call rax
mov rbx, rax
test rax, rax
je 0x14006105a
mov rcx, qword [0x1400aecd0]
cmp rcx, rdi
je 0x14006105a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006105a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400aecc0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006107b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14006107d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401b7490]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1401b74a0]
mov dword [rax], 1
mov rax, qword [0x1401b74b0]
mov dword [rax], 1
mov rax, qword [0x1401b7430]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1401b7480]
mov dword [0x1401f5020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1401b7550]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1401b7530]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1401b73e0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x14002d636
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, rdx
mov r15, rcx
mov r9, qword [rdx]
mov rsi, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
cmp r9, rsi
je 0x14002d6ba
lea r14, [r9 + 0x10]
mov qword [rdi], r14
mov rcx, qword [rbx + 0x90]
mov rdx, qword [rbx + 0xa0]
mov r8, qword [r9]
mov r9, qword [r9 + 8]
call sym.clap_builder::builder::command::Command::find::h3574e5856a9e7509
mov r9, r14
test rax, rax
je 0x14002d65a
cmp qword [rax + 0x1f8], 0
jne 0x14002d6d2
cmp dword [rax + 0x218], 0x110000
jne 0x14002d6d2
mov rdi, qword [rax + 0x178]
cmp rdi, 1
je 0x14002d6f0
test rdi, rdi
jne 0x14002d719
mov rdx, qword [rax + 0x68]
mov r8, qword [rax + 0x70]
jmp 0x14002d6fe
and qword [r15], 0
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
mov rdx, rax
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.__T_as_alloc::string::ToString_::to_string::h6ed82aaff0f2d5a9
mov rax, qword [rax + 0x168]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r15
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym._ZN5alloc3str56__LT_impl_u20_alloc..borrow..ToOwned_u20_for_u20_str_GT_8to_owned17h3f0f009bd1a9657cE.87
mov qword [rsp + 0x30], r15
mov r12, qword [rax + 0x168]
mov rcx, rdi
call sym.alloc::raw_vec::RawVec_T_A_::allocate_in::he2719e988360d00b
lea r14, [rsp + 0xa0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
mov rcx, r14
mov rdx, rdi
call sym.alloc::vec::Vec_T_A_::reserve::hf4bb569e78bd5957
mov rax, qword [r14 + 0x10]
imul r13, rax, 0x18
add r13, qword [r14]
add rax, rdi
mov qword [rsp + 0x28], rax
lea rbx, [sym.__T_as_core::fmt::Display_::fmt::h11e766092dcd5801]
lea rsi, [0x140137608]
lea rbp, [rsp + 0x40]
lea r14, [rsp + 0x88]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 2
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], 1
mov rcx, r14
mov rdx, r15
call sym._ZN5alloc3fmt6format17h520fa2eb8219f004E.109
mov rax, qword [rsp + 0x98]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [r13], xmm0
add r13, 0x18
add r12, 0x10
dec rdi
jne 0x14002d77f
movups xmm0, xmmword [rsp + 0xa0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov r8, qword [rsp + 0x28]
mov qword [rdi + 0x10], r8
mov rdx, qword [rdi]
mov qword [rsp + 0x20], 1
lea r9, str._accept_encodinggzip__brrangeRequest_deadline_overflowed.
mov rcx, qword [rsp + 0x30]
call sym.alloc::str::join_generic_copy::hd597ec3523723b09
mov rcx, rdi
call sym.core::ptr::drop_in_place_alloc::vec::Vec_alloc::string::String__::had757cd894c3176c
jmp 0x14002d6be
Function at 0x14004ea00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14004ea90
cmp r11, r10
ja 0x14004eb06
cmp r10, rdx
ja 0x14004eb1a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14004ea92
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14004ea70
jmp 0x14004eaf4
ja 0x14004ea9a
mov r11, r10
cmp rax, r8
jne 0x14004ea34
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14004ead0
mov rdi, r8
sub ecx, edx
jns 0x14004eaeb
jmp 0x14004eaf6
cmp r8, rsi
je 0x14004eb2b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14004eaf6
xor al, 1
cmp rdi, rsi
jne 0x14004eab0
jmp 0x14004eaf6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call dbg.slice_index_order_fail
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call dbg.slice_end_index_len_fail
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call dbg.panic
ud2
Function at 0x140050a67
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x14013b868]
mov ebx, 0xff
lea rsi, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x140050b97
mov r14d, 4
sub r14, 1
jb 0x140050a8c
cmp r9, 0xf
jbe 0x140050bc4
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call sym.core::slice::index::__impl_core::ops::index::Index_I__for__T__::index::hf44bb6538bc343c9
mov r9, rdx
mov ecx, ebp
jmp 0x140050a9c
xor edx, edx
cmp r9, rdx
je 0x140050bb5
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140050b99
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_crc32fast_1.3.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call dbg.panic_bounds_check
ud2
Function at 0x14005661e
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x140056688
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x14005663a
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14005663a
add ebp, 0x80000000
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140060d2b
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call sym.ring::aead::aes::detect_implementation::h9b6555690c103114
cmp eax, 1
je 0x140060d61
mov eax, eax
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
cmp eax, 2
jne 0x140060d76
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400e8220
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400e67c0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp dbg.ring_core_0_17_7_aes_nohw_encrypt
movups xmm2, xmmword [rcx]
mov eax, dword [r8 + 0xf0]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec eax
movups xmm1, xmmword [r8]
lea r8, [r8 + 0x10]
jne 0x1400e67da
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rdx], xmm2
pxor xmm2, xmm2
ret
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [rdi]
call fcn.1400e8480
call fcn.1400e7b00
movdqu xmmword [rsi], xmm0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret