joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007290
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov edx, 0x18
lea rcx, [rsp + 0x30]
mov r8d, 0xf0000000
mov rdi, r9
call fcn.1800069d0
lea rcx, [rsp + 0x30]
call fcn.180006a20
test rax, rax
jne 0x1800072de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180007367
lea rcx, [rsp + 0x70]
call fcn.180006aa0
mov r9d, dword [rbx + 8]
lea rdx, [rsp + 0x30]
mov r8, qword [rbx]
lea rcx, [rsp + 0x70]
call fcn.180006c00
test eax, eax
jne 0x180007355
lea rcx, [rsp + 0x70]
call fcn.180006ce0
test eax, eax
jne 0x180007355
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
call fcn.180006d10
test eax, eax
jne 0x180007355
lea rcx, [rsp + 0x70]
call fcn.180001d90
test rax, rax
je 0x180007355
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov ebx, eax
call fcn.180006bd0
lea rcx, [rsp + 0x30]
call fcn.1800069f0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180007390
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edx, 4
jmp fcn.1800073a0

Function at 0x1800073a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor r8d, r8d
mov ebx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea edx, [r8 + 1]
call fcn.1800069d0
lea rcx, [rsp + 0x20]
call fcn.180006a20
test rax, rax
je 0x1800073e5
mov r8, rdi
mov edx, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1800073e5
xor ebx, ebx
jmp 0x1800073e8
or ebx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.1800069f0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180007490
Capabilities:
Encode data using base64 via winapi

Disassembly:
jmp 0x180007490
sub rsp, 0x38
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1800074b0
Capabilities:
Decode data using base64 via winapi

Disassembly:
jmp 0x1800074b0
sub rsp, 0x48
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
lea r8d, [rax + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor eax, eax
add rsp, 0x48
ret
Function at 0x180009690
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800096ec
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800096ec
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800096ec
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800096ec
cmp dword [rcx + 0x84], 0xe
jbe 0x1800096ec
cmp dword [rcx + 0xf8], 0
je 0x1800096ec
mov ecx, ebx
call fcn.180009620
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x180015100]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1800094b0
cmp dword [rsp + 0x60], 0
jne 0x18000972f
mov ecx, ebx
call fcn.1800095e0
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1800099e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x180009a1c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.18000dbf0
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x180009ad8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x180009b3e
test ebx, ebx
jne 0x180009b3e
lea ecx, [rax + 2]
call fcn.18000dbf0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.18000d990
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140001fd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14003cd60
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x48]
cmp eax, 1
adc eax, 0
cmp rdi, rax
je 0x14003cdf2
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x48]
test rcx, rcx
je 0x14003cdfe
mov rax, rdi
shr rax, 0x20
je 0x14003cdd2
mov rax, rdi
xor edx, edx
div rcx
jmp 0x14003cdd8
mov eax, edi
xor edx, edx
div ecx
sub rdi, rdx
mov rcx, rdi
call sub.KERNEL32.dll_UnmapViewOfFile
cmp qword [rsi], 0
je 0x14003cdf2
mov rcx, qword [rsi + 8]
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rdi
pop rsi
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero
lea r8, [0x14005f808]
mov edx, 0x39
call fcn.14005de70
ud2

Function at 0x14003ce20
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x48]
cmp eax, 1
adc eax, 0
cmp rax, rbx
je 0x14003cec0
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x48]
test rcx, rcx
je 0x14003cede
mov rax, rbx
shr rax, 0x20
je 0x14003ce95
mov rax, rbx
xor edx, edx
div rcx
jmp 0x14003ce9b
mov eax, ebx
xor edx, edx
div ecx
sub rbx, rdx
add rdi, rdx
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x14003cec4
xor eax, eax
jmp 0x14003ced1
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero
lea r8, [0x14005f7f0]
mov edx, 0x39
call fcn.14005de70
ud2
Function at 0x14003d010
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rdx + 0x20], 0
mov rdi, qword [rdx + 0x10]
mov qword [rbp - 0x20], rdx
mov rdx, qword [rdx + 0x18]
mov eax, 0x20
mov r8d, 0x80
cmove r8d, eax
mov rcx, rdi
call fcn.14003ce20
test rax, rax
je 0x14003d0bd
mov qword [rsi + 8], rax
mov qword [rsi], 2
xorps xmm6, xmm6
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp - 0x40], xmm6
movaps xmmword [rbp - 0x50], xmm6
lea rcx, [rbp - 0x50]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rbp - 0x28]
cmp eax, 1
adc eax, 0
cmp rdi, rax
mov rbx, qword [rbp - 0x20]
je 0x14003d0f9
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp - 0x40], xmm6
movaps xmmword [rbp - 0x50], xmm6
lea rcx, [rbp - 0x50]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x28]
test rcx, rcx
je 0x14003d109
mov rax, rdi
shr rax, 0x20
je 0x14003d0d9
mov rax, rdi
xor edx, edx
div rcx
jmp 0x14003d0df
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x14003d0f9
mov eax, edi
xor edx, edx
div ecx
sub rdi, rdx
mov rcx, rdi
call sub.KERNEL32.dll_UnmapViewOfFile
cmp qword [rbx], 0
je 0x14003d0f9
mov rcx, qword [rbx + 8]
call sub.KERNEL32.dll_CloseHandle
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero
lea r8, [0x14005f808]
mov edx, 0x39
call fcn.14005de70
ud2
Function at 0x140042640
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400426d0
jmp 0x1400426bf
jae 0x140042790
cmp r8, 0x201
jae 0x1400426d0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140042728
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400426ff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14005d1b0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140042751
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400427f8
mov r8d, r14d
cmp r15, r8
jne 0x1400426b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14004281b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400426bf
jmp 0x1400426d0
cmp rsi, r8
jb 0x140042835
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140046cb0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400427e1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.14003cd30
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400427c9
jmp 0x1400427e1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_65ea825f4021eaf77f1b25139969712d65b435a4library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005de70
jmp 0x14004284a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14005e2c0
ud2
Function at 0x14004cae0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400619f0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14004cb24
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14004cb83
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14004cb92
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14004cbca
cmp eax, 0x103
je 0x14004cbd4
test eax, eax
js 0x14004cbaf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14004cbca
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400465f0
mov rcx, rax
call fcn.140040420
mov ecx, 7
int 0x29
ud2
Function at 0x14004cc40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400619f0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14004cc84
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14004ccea
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14004cd21
test eax, eax
js 0x14004ccfb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14004cd14
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400465f0
mov rcx, rax
call fcn.140040420
mov ecx, 7
int 0x29
ud2
Function at 0x14005aed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14005af4a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14005af40
cmp r11, r10
ja 0x14005afe3
cmp r10, rdx
ja 0x14005aff7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14005af42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14005af20
jmp 0x14005afb7
ja 0x14005af4a
mov r11, r10
cmp rax, r8
jne 0x14005aef2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14005afbb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14005af90
mov r8, r10
sub ecx, r9d
jns 0x14005afae
jmp 0x14005afbd
cmp r10, rdx
je 0x14005afc9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14005afbd
xor al, 1
cmp r8, rdx
jne 0x14005af70
jmp 0x14005afbd
xor eax, eax
jmp 0x14005afbd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14005de70
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14005e340
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14005e2c0
ud2

Function at 0x14005cb64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005cbae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005cbae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005cbae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005cbae
cmp dword [rcx + 0x84], 0xe
jbe 0x14005cbae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005cbb0
xor al, al
add rsp, 0x28
ret
Function at 0x411c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411e26
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c800
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x411ceb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x411d00
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x411d25
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x411d39
cmp rbx, 0x1000
jae 0x411cf5
nop dword [rax]
jmp 0x411da9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x411d4d
xor edx, edx
jmp 0x411da0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c800
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x411d2f
jmp 0x411d14
call fcn.00458a60
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00430c00
lea rax, [0x0046ceaf]
mov ebx, 0x18
call fcn.00431500
mov rax, qword [rsp + 0x38]
call fcn.00431200
lea rax, [0x0046cf57]
mov ebx, 0x19
call fcn.00431500
mov rax, qword [rsp + 0x30]
nop
call fcn.00431200
call fcn.00430e60
call fcn.00430c80
lea rax, [0x0046e2ba]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0042f2c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00411c80
Function at 0x411e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41208a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042c880
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x411ed9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x411eec
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x411f10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x411f24
cmp rbx, 0x1000
jae 0x411ee3
jmp 0x411fa5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x411f36
xor esi, esi
jmp 0x411f96
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042c880
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x411f1a
nop
jmp 0x411f02
call fcn.00458a60
xorps xmm15, xmm15
mov r14, qword [0x0051aee0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x412025
call fcn.00430c00
lea rax, [0x0046d0ce]
mov ebx, 0x19
call fcn.00431500
mov rax, qword [rsp + 0x68]
call fcn.00431200
lea rax, [0x0046cf57]
mov ebx, 0x19
call fcn.00431500
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00431200
call fcn.00430e60
call fcn.00430c80
lea rax, [0x0046bae8]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.0042f2c0
cmp eax, 0x5af
je 0x411fc8
call fcn.00430c00
lea rax, [0x0046d0ce]
mov ebx, 0x19
nop dword [rax]
call fcn.00431500
mov rax, qword [rsp + 0x38]
call fcn.00431200
lea rax, [0x0046cf57]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00431500
mov eax, dword [rsp + 0x34]
call fcn.00431200
call fcn.00430e60
call fcn.00430c80
lea rax, [0x0046de16]
mov ebx, 0x1f
call fcn.0042f2c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00411e60