joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404e3ce4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
bsf r10w, bx
sub rsp, 0x30
shr r10w, 0x9e
movsxd r10, esp
sub eax, eax
rcr r10b, 0xc5
mov r10d, ecx
clc
jmp 0x1404e3d06
test rdx, rdx
jmp 0x1404e3d0e
jne 0x1404e3d3e
call fcn.1404b51b5
mov ebx, 0x16
jmp 0x1404e3d23
mov dword [rax], ebx
jmp 0x1404e3d2a
call fcn.1404b5e04
mov eax, ebx
cmp dl, 0x95
bt ebx, r13d
add rsp, 0x30
pop rbx
ret
test r8, r8
je 0x1404e3d14
movzx ecx, byte [rsp + 0x60]
test r14d, 0x6b25470e
mov word [rdx], ax
add ah, 0xf1
sal ah, cl
ror al, 0x9f
lea rax, [rcx + 1]
cmp r10b, al
stc
cmp r8, rax
jmp 0x1404e3d6e
ja 0x1404e3d88
call fcn.1404b51b5
mov ebx, 0x22
jmp 0x1404e3d83
jmp 0x1404e3d23
lea eax, [r9 - 2]
xadd rbx, rbx
bts bx, r8w
cmp rbx, 0x5410107d
mov ebx, 0x22
test r13b, bl
cmp eax, ebx
jmp 0x1404e3dab
ja 0x1404e3d14
mov byte [rsp + 0x60], cl
not bl
mov ecx, r10d
add rsp, 0x30
movsx bx, bpl
movsx ebx, dx
pop rbx
jmp 0x1404e3dcc
jmp 0x1404e3dd1
mov qword [rsp + 8], rbx
sub r11b, dil
inc r11w
mov qword [rsp + 0x10], rbp
rol r11w, cl
movzx ebp, r12w
mov qword [rsp + 0x18], rsi
shr r11b, cl
bt r10, 0x88
push rdi
shl bpl, cl
neg bpl
push r14
push r15
movzx r11, di
adc r11d, edx
sub rsp, 0x20
rcr bx, cl
stc
sub r15d, r15d
rcl r11b, cl
shr r11w, cl
mov ebp, r9d
mov rdi, r8
and r11b, 0xa5
or r11, r12
mov r11, rdx
movsx rbx, r12w
add bl, 0x90
mov r10, rdx
add bh, 0xd9
cmovae bx, r11w
bt ebx, 0x4a
mov ebx, r15d
jmp 0x1404e3e49
cmp byte [rsp + 0x60], r15b
je 0x1404e3e7d
lea eax, [r15 + 0x2d]
movsxd rbx, r9d
inc r14w
shrd r9d, eax, 0x61
neg ecx
btc r8, r15
or rbx, rbp
adc r8b, r9b
mov word [rdx], ax
test r8b, r15b
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
mov r8, r10
btc rsi, 0x45
rcr r14b, 0x53
sbb sil, r14b
sub edx, edx
lea rsi, [r10 + 2]
xor r9w, 0x2fc5
sbb r14d, 0x6e025126
mov eax, ecx
bsr cx, bp
movsx r9, sp
sar r9w, cl
mov r9, r10
seta r14b
neg r14w
inc ecx
div ebp
mov ecx, eax
sub al, 0x3b
cmp edx, 9
cdqe
movzx ax, dil
mov eax, 0x57
cmovl r14, r15
lea r14d, [rax - 0x27]
cmovbe ax, r14w
jmp 0x1404e3ee1
inc rbx
test sil, r15b
cmp al, sil
add ax, dx
test dil, r9b
test bh, 0xf3
mov word [r10], ax
test ecx, ecx
jmp 0x1404e3efe
je 0x1404e3f18
mov r10, rsi
test r8b, dil
cmp rbx, rdi
jmp 0x1404e3f12
jb 0x1404e3e8c
cmp rbx, rdi
jmp 0x1404e3f20
jb 0x1404e3f56
mov word [r11], r15w
jmp 0x1404e3f2f
call fcn.1404b51b5
mov ebx, 0x22
jmp 0x1404e3f3e
mov dword [rax], ebx
jmp 0x1404e3f45
call fcn.1404b5e04
mov eax, ebx
jmp 0x1404e3f51
jmp 0x1404e3f95
mov word [rsi], r15w
movzx eax, word [r8]
movzx ecx, word [r9]
cmc
cmp r14b, 0xc2
mov word [r9], ax
cmc
stc
sub r9, 2
stc
cmp r10b, r15b
test ah, bh
mov word [r8], cx
add r8, 2
cmp r8, r9
jb 0x1404e3f5a
sub eax, eax
cmp r15b, r10b
clc
sbb r15d, 0x3b52e7a
mov rbx, qword [rsp + 0x40]
rol rbp, cl
shl dil, 0xa9
movsx r14d, sp
mov rbp, qword [rsp + 0x48]
btr esi, 0xac
mov rsi, qword [rsp + 0x50]
rol di, cl
add rsp, 0x20
mov r15b, 0x7b
movzx rdi, dx
pop r15
bswap di
mov edi, 0x1eb515e3
pop r14
movzx edi, si
cmovg edi, edi
pop rdi
jmp 0x1404e3fd9
ret
Function at 0x1404e5953
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x18], rbx
movsx ax, r12b
push rbp
cmp ecx, 0xb1a709a
rcl bpl, 0x45
sar rbp, cl
push rsi
cmova rbp, rax
push rdi
bsf ebp, edi
cdqe
btc ax, 0xb5
push r12
movsxd rsi, edx
adc al, cl
push r13
push r14
push r15
movsxd r13, r14d
sar r15b, cl
sub rsp, 0x40
dec r14w
movsx r14w, bl
shl r15b, 0x95
mov rax, qword [0x1400b7288]
bt r13w, bx
movsxd rsi, ebx
xor rax, rsp
shl r13b, cl
xor r13b, r15b
test r15d, ebp
mov qword [rsp + 0x30], rax
movsx r13, r10w
shl r13b, 0x36
mov rsi, qword [rdx]
cmp rsp, r14
rcr r14b, cl
or r15b, r10b
mov rbp, r9
sal r14b, cl
shl r15w, 0xe7
setge r14b
mov qword [rsp + 0x20], r9
shld r13d, ecx, 0x7b
mov r13, r8
mov r14, rdx
sar r15b, cl
mov r15, rcx
test dh, 0x1b
clc
stc
test rcx, rcx
jmp 0x1404e5a05
je 0x1404e5b21
mov rbx, rcx
sar cx, 0xb7
mov rdi, rsi
shr r8b, cl
xor r8b, 0x5c
movzx edx, word [rsi]
rol cl, cl
and cl, 0xbb
movzx r8, sp
lea r12, [rsp + 0x28]
inc ecx
not r8b
cmp r13, 4
mov r8, rbp
cmovae r12, rbx
movsxd rcx, ebp
not ecx
mov rcx, r12
call fcn.1404e6828
mov rbp, rax
jmp 0x1404e5a54
cmp rax, 0xffffffffffffffff
jmp 0x1404e5a5d
je 0x1404e5b10
cmp r12, rbx
jmp 0x1404e5a6b
je 0x1404e5a8f
cmp r13, rax
jmp 0x1404e5a79
jb 0x1404e5af2
mov r8, rax
mov rdx, r12
bswap ecx
mov rcx, rbx
call fcn.1404a3400
test rbp, rbp
jmp 0x1404e5a97
je 0x1404e5ab0
lea rax, [rbx + rbp]
cmp byte [rax - 1], 0
jmp 0x1404e5aaa
je 0x1404e5ae3
add rsi, 2
cmp r12b, r9b
test rbp, rbp
jmp 0x1404e5abf
cmovne rdi, rsi
sub r13, rbp
test r11w, r13w
stc
add rbx, rbp
mov bpl, 0x51
movzx ebp, r14w
movzx rbp, r13w
mov rbp, qword [rsp + 0x20]
jmp 0x1404e5a1c
xor edi, edi
stc
movzx bx, dh
lea rbx, [rax - 1]
bts eax, r14d
sub rbx, r15
movzx eax, sp
mov qword [r14], rdi
movsxd rax, r13d
movzx rax, sp
cwde
mov rax, rbx
jmp 0x1404e5b0b
jmp 0x1404e5b93
mov qword [r14], rdi
or rax, 0xffffffffffffffff
jmp 0x1404e5b1c
jmp 0x1404e5b93
xor ebx, ebx
movzx r8d, r10w
movzx edx, word [rsi]
movsx r8w, cl
jmp 0x1404e5b34
lea rcx, [rsp + 0x28]
mov r8, rbp
jmp 0x1404e5b41
call fcn.1404e6828
cmp rax, 0xffffffffffffffff
je 0x1404e5b93
test rax, rax
je 0x1404e5b69
cmp byte [rsp + rax + 0x27], 0
jmp 0x1404e5b63
je 0x1404e5b7f
lea rbx, [rbx + rax]
test cx, r12w
add rsi, 2
jmp 0x1404e5b7a
jmp 0x1404e5b27
dec rax
sar ch, cl
bsr cx, r15w
lea rax, [rax + rbx]
add ecx, 0x765e445a
mov rcx, qword [rsp + 0x30]
cmp bx, dx
xor rcx, rsp
call fcn.14049f715
mov rbx, qword [rsp + 0x90]
xor si, 0x245d
add rsp, 0x40
pop r15
pop r14
movsxd rdi, esi
cmovle si, sp
not r13b
pop r13
setnp dil
pop r12
jmp 0x1404e5bd6
pop rdi
setge sil
pop rsi
pop rbp
jmp 0x1404e5be2
ret
Function at 0x140056ae0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140056aed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140056afd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140056ae5
lea eax, [rcx + 1]
jmp 0x140056b0b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140056b1e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140056b04
sub eax, 3
jb 0x140056b3e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140056b8d
sar eax, 1
movsxd rbp, eax
jb 0x140056b74
jmp 0x140056b4c
add ebx, ebx
jne 0x140056b4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140056b74
inc ecx
add ebx, ebx
jne 0x140056b5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140056b74
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140056b6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140056b5c
add ecx, 2
jmp 0x140056b79
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140056aa2
jmp 0x140056aed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140056bd9
cmp rsi, rcx
jae 0x140056be1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140056bc0
cmp al, 0x8f
ja 0x140056bc0
cmp byte [rsi - 2], 0xf
je 0x140056bc6
sub al, 0xe8
cmp al, 1
ja 0x140056baa
cmp rsi, rcx
jae 0x140056be1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140056bb0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140056be1
lodsb al, byte [rsi]
jmp 0x140056bc0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x54000]
mov eax, dword [rdi]
or eax, eax
je 0x140056c4a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5773c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140056bee
jns 0x140056c23
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140056c2d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140056c44
mov qword [rbx], rax
add rbx, 8
jmp 0x140056c0e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140056c84
cmp al, 0xef
ja 0x140056c76
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140056c56
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140056c65
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140056cd8
sub rsp, 0xffffffffffffff80
jmp 0x14000b310
Function at 0x140002670
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp r8, qword [rsp + 0x70]
jne 0x1400026e1
test r8, r8
je 0x1400026d8
mov r10b, byte [rcx]
mov bpl, byte [rcx + 1]
xor r11d, r11d
nop
add r10b, 1
movzx esi, r10b
movzx ebx, byte [rcx + rsi + 2]
add bpl, bl
movzx edi, bpl
movzx eax, byte [rcx + rdi + 2]
mov byte [rcx + rsi + 2], al
mov byte [rcx + rdi + 2], bl
add bl, byte [rcx + rsi + 2]
movzx eax, byte [rdx + r11]
movzx esi, bl
xor al, byte [rcx + rsi + 2]
mov byte [r9 + r11], al
lea rax, [r11 + 1]
mov r11, rax
cmp r8, rax
jne 0x140002690
mov byte [rcx], r10b
mov byte [rcx + 1], bpl
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_input.len____output.len__assertion_failed:_key.len_____1__key.len_____256C:UsersAdministrator.cargo_registry_srcmirrors.ustc.edu.cn_12df342d903acd47_rust_crypto_0.2.36_src_rc4.rs
lea r8, [0x14001dfb8]
mov edx, 0x2d
call fcn.14001c050
ud2
Function at 0x140004f50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140004fd2
jmp 0x140005020
mov rsi, r8
jae 0x14000507d
cmp rsi, 0x201
jb 0x140005020
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x140004ffd
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.14001b730
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x14000502d
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x140005050
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400050c5
mov r8d, edi
cmp rsi, r8
jne 0x140004fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000511c
add rsi, rsi
cmp rsi, 0x201
jae 0x140004fd2
jmp 0x140005020
cmp r14, r8
jb 0x140005136
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1400066f0
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x1400050f2
jmp 0x140005105
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x140005105
add rdx, rdx
je 0x140005105
mov r8d, 2
mov rcx, r13
call fcn.140002460
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_code_rustc_4b91a6ea7258a947e59c6522cd5898e7c0a6a88flibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001c050
jmp 0x14000514b
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001c2b0
ud2
Function at 0x1400151f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x1400153ba
mov r9, rdx
mov edx, 1
test r9, r9
je 0x14001522c
mov al, byte [rcx]
cmp al, 0x2d
je 0x140015234
cmp al, 0x2b
jne 0x140015245
add r9, 0xffffffffffffffff
je 0x14001523a
add rcx, 1
jmp 0x140015245
xor r10d, r10d
jmp 0x1400153a2
cmp r9, 1
jne 0x140015245
mov r10d, pe_nt_image_headers64
jmp 0x1400153a2
cmp r8d, 0x10
ja 0x1400152ad
cmp r9, 9
jae 0x1400152ad
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14001531b
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x140015283
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x14001537a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x140015270
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x140015270
mov edx, 0x101
jmp 0x140015396
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140015344
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x1400152ff
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x14001537e
add eax, edi
jb 0x140015391
add r10, 1
cmp r9, r10
jne 0x1400152d0
jmp 0x140015377
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x1400152a3
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x140015320
jmp 0x14001537a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x14001537e
test dl, dl
jne 0x14001537e
add eax, edi
jb 0x140015391
add r10, 1
cmp r9, r10
jne 0x140015350
xor r10d, r10d
xor edx, edx
jmp 0x1400153a2
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x140015396
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x14001a280]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.14001c1c0
ud2
jmp 0x1400151f0
Function at 0x1400195c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001963a
mov r11, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [rdx + r8*2]
xor eax, eax
mov rbx, rdx
movzx edi, byte [rdx + 1]
add rdx, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140019630
cmp r10, rax
jb 0x1400196cd
cmp r10, r11
ja 0x1400196da
add rax, r9
xor ebx, ebx
nop dword [rax + rax]
cmp rdi, rbx
je 0x140019632
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140019610
jmp 0x1400196a2
ja 0x14001963a
mov rax, r10
cmp rdx, r8
jne 0x1400195dd
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400196a6
mov rbx, qword [rsp + 0x78]
add rdx, rbx
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop
lea rsi, [rbx + 1]
movzx edi, byte [rbx]
test dil, dil
js 0x140019680
mov rbx, rsi
sub ecx, edi
jns 0x140019699
jmp 0x1400196a8
cmp rsi, rdx
je 0x1400196b3
and edi, 0x7f
shl edi, 8
movzx ebp, byte [rbx + 1]
add rbx, 2
or edi, ebp
sub ecx, edi
js 0x1400196a8
xor al, 1
cmp rbx, rdx
jne 0x140019660
jmp 0x1400196a8
xor eax, eax
jmp 0x1400196a8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__value:
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001c050
ud2
mov rcx, rax
mov rdx, r10
call fcn.14001c2c0
ud2
mov rcx, r10
mov rdx, r11
call fcn.14001c2b0
ud2
Function at 0x1400198e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x1400153ba
mov r9, rdx
mov edx, 1
test r9, r9
je 0x14001522c
mov al, byte [rcx]
cmp al, 0x2d
je 0x140015234
cmp al, 0x2b
jne 0x140015245
add r9, 0xffffffffffffffff
je 0x14001523a
add rcx, 1
jmp 0x140015245
xor r10d, r10d
jmp 0x1400153a2
cmp r9, 1
jne 0x140015245
mov r10d, pe_nt_image_headers64
jmp 0x1400153a2
cmp r8d, 0x10
ja 0x1400152ad
cmp r9, 9
jae 0x1400152ad
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14001531b
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x140015283
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x14001537a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x140015270
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x140015270
mov edx, 0x101
jmp 0x140015396
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140015344
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x1400152ff
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x14001537e
add eax, edi
jb 0x140015391
add r10, 1
cmp r9, r10
jne 0x1400152d0
jmp 0x140015377
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x1400152a3
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x140015320
jmp 0x14001537a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x14001537e
test dl, dl
jne 0x14001537e
add eax, edi
jb 0x140015391
add r10, 1
cmp r9, r10
jne 0x140015350
xor r10d, r10d
xor edx, edx
jmp 0x1400153a2
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x140015396
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x14001a280]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.14001c1c0
ud2
jmp 0x1400151f0
Function at 0x1404ff54e
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x20]
jae 0x140518134
Function at 0x141953582
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rbx, rsi
mov r11, rsp
btc si, 0x2c
sub rsp, 0x180
dec ax
cbw
and rsp, 0xfffffffffffffff0
mov r10, rbx
not r8b
movabs rsi, 0
shld r8, rsi, 5
test r15d, 0x5d8c47d6
sub r10, rsi
sal r8b, 0xdb
lea r8, [0x141927e00]
mov eax, dword [rbx]
clc
cmc
add rbx, 4
clc
xor eax, r10d
cmp di, 0x3b25
cmp sp, r8w
xor eax, 0x7fcf73df
test dil, 0xe3
sub eax, 0x69f55961
neg eax
cmc
jmp 0x1419a6683
jmp r8
push rax
push rsi
push rdx
mov sil, r12b
push r12
cdq
push r15
cwd
rdtsc
pushfq
bts edx, r10d
movzx edx, di
rcl dh, 0xb0
push rcx
rol dx, cl
push r9
push r10
mov esi, 0x21e70660
btr r10w, bx
push r11
movzx r10d, cx
push rdi
rcl ax, 0x73
rol r11w, cl
push r13
push rbx
rol r10b, cl
bts r10, rcx
lahf
push r8
not dl
push r14
rdtsc
push rbp
movabs rdx, 0
rcl r8w, cl
cmc
not bx
push rdx
rcr r11b, 0x78
cmc
cmovg eax, ebx
mov rbx, qword [rsp + 0x90]
lahf
cbw
stc
ror ebx, 1
cwde
movsx r10, bx
inc ebx
shl r8b, cl
shl eax, 0x1d
neg ebx
rcl r8d, cl
sar r10b, cl
sbb ax, 0x5fd
sub ebx, 0x3d304d32
sal al, 0x1f
lea rbx, [rbx + rdx]
dec ah
btr r8w, 0x7a
shld r8d, r10d, 0x1f
movabs rsi, 0x100000000
mov r8w, 0x3c28
jmp 0x141927dbf
bswap eax
push r10
xor r10b, 0xab
movsx r10d, r15w
xor dword [rsp], eax
test r13b, 0xb9
pop r10
movsxd rax, eax
test bp, 0x639d
add r8, rax
jmp 0x14193c1f9
Function at 0x1400840d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400840dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400840ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400840d5
lea eax, [rcx + 1]
jmp 0x1400840fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14008410e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400840f4
sub eax, 3
jb 0x14008412e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14008417d
sar eax, 1
movsxd rbp, eax
jb 0x140084164
jmp 0x14008413c
add ebx, ebx
jne 0x14008413a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140084164
inc ecx
add ebx, ebx
jne 0x14008414a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140084164
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14008415d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14008414c
add ecx, 2
jmp 0x140084169
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140084092
jmp 0x1400840dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x46400
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400841c9
cmp rsi, rcx
jae 0x1400841d1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400841b0
cmp al, 0x8f
ja 0x1400841b0
cmp byte [rsi - 2], 0xf
je 0x1400841b6
sub al, 0xe8
cmp al, 1
ja 0x14008419a
cmp rsi, rcx
jae 0x1400841d1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400841a0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400841d1
lodsb al, byte [rsi]
jmp 0x1400841b0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x81000]
mov eax, dword [rdi]
or eax, eax
je 0x14008422e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa6754]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400841de
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140084228
mov qword [rbx], rax
add rbx, 8
jmp 0x1400841fe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140084268
cmp al, 0xef
ja 0x14008425a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14008423a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140084249
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400842bc
sub rsp, 0xffffffffffffff80
jmp 0x140046104