joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3cc9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140195fc0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140195940
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140195fff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402fc020]
jmp 0x140196009
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400d3f58
Capabilities:
Query environment variable

Disassembly:
jmp 0x140253930
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140253760
lea rcx, [rsp + 0x40]
call fcn.1402538e0
movzx eax, al
test eax, eax
jne 0x140253978
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140253790
mov rax, qword [rsp + 0x70]
jmp 0x140253b49
lea rcx, [rsp + 0x40]
call fcn.1402538b0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140253850
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1402538b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400d5227
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140253a1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140253790
mov rax, qword [rsp + 0x80]
jmp 0x140253b49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400d3b0c
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400d38d2
lea rcx, [rsp + 0x48]
call fcn.1400d32ba
movzx eax, al
test eax, eax
jne 0x140253a85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400d1dbb
lea rcx, [rsp + 0x40]
call fcn.140253790
mov rax, qword [rsp + 0x88]
jmp 0x140253b49
lea rcx, [rsp + 0x48]
call fcn.1400d4499
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1402538b0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400d5227
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140253b1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400d1dbb
lea rcx, [rsp + 0x40]
call fcn.140253790
mov rax, qword [rsp + 0xa0]
jmp 0x140253b49
lea rcx, [rsp + 0x48]
call fcn.1400d3887
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400d1dbb
lea rcx, [rsp + 0x40]
call fcn.140253790
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400d3f76
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140195ef0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401958c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140195f31
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402fc020]
jmp 0x140195f37
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400d4043
Capabilities:
Get geographical location

Disassembly:
jmp 0x140231150
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140230080
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1402311b7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402fc030]
jmp 0x1402311d9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400d3215
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400d4057
Capabilities:
Terminate process

Disassembly:
jmp 0x140173710
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400d4426
Capabilities:
Print debug messages

Disassembly:
jmp 0x1402658c0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402de140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1402658e6
jmp 0x140265963
mov rcx, qword [rbp + 0x30]
call fcn.1400d371f
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1402658ff
jmp 0x140265963
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14026591c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d2009
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400d2658
test eax, eax
jne 0x140265963
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400d3a21
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400d47d2
Capabilities:
Create process on windows

Disassembly:
jmp 0x140262850
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400d302b
lea rcx, [rsp + 0xb8]
call fcn.1400d302b
lea rcx, [rsp + 0x88]
call fcn.1400d302b
call fcn.1400d3ebd
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400d2cd9
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1402628f2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400d35b7
lea rcx, [rsp + 0xb8]
call fcn.1400d35b7
lea rcx, [rsp + 0xe8]
call fcn.1400d35b7
mov eax, dword [rsp + 0x54]
jmp 0x140262a98
call fcn.1400d3ebd
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400d2cd9
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140262952
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400d35b7
lea rcx, [rsp + 0xb8]
call fcn.1400d35b7
lea rcx, [rsp + 0xe8]
call fcn.1400d35b7
mov eax, dword [rsp + 0x5c]
jmp 0x140262a98
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1402629d8
call fcn.1400d3ebd
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400d2cd9
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1402629c6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400d35b7
lea rcx, [rsp + 0xb8]
call fcn.1400d35b7
lea rcx, [rsp + 0xe8]
call fcn.1400d35b7
mov eax, dword [rsp + 0x64]
jmp 0x140262a98
lea rcx, [rsp + 0x88]
call fcn.1400d2f3b
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400d2f3b
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400d2f3b
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400d35b7
lea rcx, [rsp + 0xb8]
call fcn.1400d35b7
lea rcx, [rsp + 0xe8]
call fcn.1400d35b7
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret

Function at 0x1400d4895
Capabilities:
Set environment variable

Disassembly:
jmp 0x140255a50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400d4c0f
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401752e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140175300
xor al, al
jmp 0x140175381
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140175313
xor al, al
jmp 0x140175381
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14017533d
xor al, al
jmp 0x140175381
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140175351
xor al, al
jmp 0x140175381
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140175363
xor al, al
jmp 0x140175381
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14017537f
xor al, al
jmp 0x140175381
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d54f7
Capabilities:
Terminate process

Disassembly:
jmp 0x140196fb0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140196fde
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400d6159
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d61db
Capabilities:
Print debug messages

Disassembly:
jmp 0x14022e7a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400d634d
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140196030
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140195980
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140196079
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402fc020]
jmp 0x140196088
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400d646f
Capabilities:
Set environment variable

Disassembly:
jmp 0x140271cf0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400d302b
lea rcx, [rsp + 0x48]
call fcn.1400d302b
call fcn.1400d3ebd
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400d2cd9
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140271d5f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400d35b7
lea rcx, [rsp + 0x78]
call fcn.1400d35b7
mov eax, dword [rsp + 0x24]
jmp 0x140271df0
call fcn.1400d3ebd
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400d2cd9
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140271da6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400d35b7
lea rcx, [rsp + 0x78]
call fcn.1400d35b7
mov eax, dword [rsp + 0x2c]
jmp 0x140271df0
lea rcx, [rsp + 0x48]
call fcn.1400d2f3b
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400d2f3b
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400d35b7
lea rcx, [rsp + 0x78]
call fcn.1400d35b7
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1402351a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400d2009
sub rsp, rax
mov rax, qword [0x1402de140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402e2e70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140235392
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1402352e6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1402352e6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1402352cb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140235268
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140235352
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402353b1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14023538d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402353b1
jmp 0x14023523e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400d3a21
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140235460
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400d2009
sub rsp, rax
mov rax, qword [0x1402de140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402e2e70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14023566d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1402355b9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1402355b9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140235599
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140235528
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14023562d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14023568c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140235668
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14023568c
jmp 0x1402354fe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400d3a21
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14000a4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000a560
cmp r11, r10
ja 0x14000a5d6
cmp r10, rdx
ja 0x14000a5e8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000a562
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000a540
jmp 0x14000a5c4
ja 0x14000a56a
mov r11, r10
cmp rax, r8
jne 0x14000a504
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000a5a0
mov rdi, r8
sub ecx, edx
jns 0x14000a5bb
jmp 0x14000a5c6
cmp r8, rsi
je 0x14000a5f7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000a5c6
xor al, 1
cmp rdi, rsi
jne 0x14000a580
jmp 0x14000a5c6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140043180
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140042f00
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140042f80
int3
Function at 0x14000bd70
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov esi, edx
mov edi, ecx
call fcn.14000c7d0
test rax, rax
je 0x14000bda9
mov rsi, rdx
mov rax, rsi
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov word [rbp + 0x26], di
mov word [rbp + 0x24], si
test di, di
mov qword [rbp + 0x18], rdx
js 0x14000bdef
test si, si
js 0x14000be47
mov rcx, qword [rdx + 0x10]
shl esi, 0x10
movzx edx, di
or edx, esi
call sub.KERNEL32.dll_SetConsoleCursorPosition
test eax, eax
je 0x14000beb8
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000bdeb
call fcn.14000b450
xor esi, esi
jmp 0x14000bd9b
lea rax, [rbp + 0x26]
mov qword [rbp + 8], rax
lea rax, [0x14000af70]
mov qword [rbp + 0x10], rax
lea rax, str.Argument_Out_of_Range_Exception_when_setting_cursor_position_to_X:
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 1
mov qword [rbp - 8], 0
lea rax, [rbp + 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 1
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.140006bf0
lea rdx, [rbp - 0x40]
mov cl, 0x27
call fcn.14000b910
jmp 0x14000be9d
lea rax, [rbp + 0x24]
mov qword [rbp + 8], rax
lea rax, [0x14000af70]
mov qword [rbp + 0x10], rax
lea rax, [0x14009fc60]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 1
mov qword [rbp - 8], 0
lea rax, [rbp + 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 1
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x28]
call fcn.140006bf0
lea rdx, [rbp - 0x58]
mov cl, 0x27
call fcn.14000b910
mov rsi, rax
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000bd9b
call fcn.14000b450
jmp 0x14000bd9b
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
call rsi
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, qword [rbp + 0x18]
lock dec qword [rcx]
jne 0x14000bd9b
jmp 0x14000beae

Function at 0x14000f2b0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14000f2e5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14000f2ea
call fcn.14002e8f0
mov ecx, dword [0x1400b6d34]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret
Function at 0x14000ff20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000ff62
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14000ff6a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000ff7b
jmp 0x14000ff92
xor r10d, r10d
jmp 0x14001001d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000ff92
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000ffa9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000ffc9
add r11, r8
jmp 0x1400100fa
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140010092
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140010040
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400100b0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400100c2
jmp 0x1400100dc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400100dc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400100f6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret