joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013f000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [rcx]
mov r12, qword [rcx + 8]
mov bl, 3
cmp rax, r12
je 0x14013f144
mov rsi, r8
mov rdi, rcx
mov r13, qword [rdx]
lea r14, [rsp + 0x2c]
lea r15, [rsp + 0x20]
lea rbp, [rax + 1]
mov qword [rdi], rbp
movzx r8d, byte [rax]
movzx edx, r8b
test dl, dl
jns 0x14013f0c0
mov ecx, edx
and ecx, 0x1f
lea rbp, [rax + 2]
mov qword [rdi], rbp
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp dl, 0xdf
jbe 0x14013f0a9
lea rbp, [rax + 3]
mov qword [rdi], rbp
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x14013f0b3
lea rbp, [rax + 4]
mov qword [rdi], rbp
movzx edx, byte [rax + 3]
and ecx, 7
shl ecx, 0x12
shl r9d, 6
and edx, 0x3f
or edx, r9d
or edx, ecx
cmp edx, 0x110000
jne 0x14013f0c0
jmp 0x14013f144
shl ecx, 6
or ecx, r10d
mov edx, ecx
jmp 0x14013f0c0
shl ecx, 0xc
or r9d, ecx
mov edx, r9d
nop dword [rax]
mov rcx, r14
call fcn.1401f1310
mov rcx, r15
mov rdx, r14
call fcn.1401e6ec0
mov eax, dword [rsp + 0x28]
mov dword [rsi + 8], eax
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
nop word cs:[rax + rax]
mov rcx, rsi
call fcn.1401e6e50
cmp eax, 0x110000
je 0x14013f130
mov rcx, qword [r13]
cmp rcx, qword [r13 + 8]
je 0x14013f13e
lea rdx, [rcx + 1]
mov qword [r13], rdx
movzx ecx, byte [rcx]
lea edx, [rcx - 0x41]
mov r8d, ecx
xor r8d, 0x20
cmp edx, 0x1a
cmovae r8d, ecx
cmp r8d, eax
je 0x14013f0f0
jmp 0x14013f142
mov rax, rbp
cmp rbp, r12
jne 0x14013f035
jmp 0x14013f144
mov bl, 1
jmp 0x14013f144
mov bl, 2
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140142d20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x10
test rdx, rdx
je 0x140142e4f
movzx r8d, byte [rcx]
dec rdx
inc rcx
mov eax, edx
and eax, 0xf
mov r9, rdx
and r9, 0xfffffffffffffff0
je 0x140142daa
xor r10d, r10d
movdqa xmm0, xmmword [0x140206bc0]
movdqa xmm1, xmmword [0x1401fdfa0]
nop dword [rax]
movdqu xmm2, xmmword [rcx + r10]
movzx r8d, r8b
movd xmm3, r8d
movdqa xmm4, xmm0
pandn xmm4, xmm3
movdqa xmm3, xmm2
pslldq xmm3, 1
por xmm3, xmm4
movdqa xmm4, xmm2
psubb xmm4, xmm3
pxor xmm4, xmm1
movdqu xmmword [rcx + r10], xmm4
movdqa xmmword [rsp], xmm2
movzx r8d, byte [rsp + 0xf]
add r10, 0x10
cmp r9, r10
jne 0x140142d60
test rax, rax
je 0x140142e4f
add rcx, r9
and rdx, 3
je 0x140142de6
mov r11, rcx
nop
lea r9, [r11 + 1]
movzx r10d, byte [r11]
mov ebx, r10d
sub bl, r8b
add bl, 0x80
mov byte [r11], bl
mov r8d, r10d
mov r11, r9
dec rdx
jne 0x140142dc0
cmp eax, 4
jae 0x140142df1
jmp 0x140142e4f
mov r10d, r8d
mov r9, rcx
cmp eax, 4
jb 0x140142e4f
add rcx, rax
nop word cs:[rax + rax]
movzx eax, byte [r9]
movzx edx, byte [r9 + 1]
mov r8d, edx
sub r8b, al
sub al, r10b
add al, 0x80
mov byte [r9], al
add r8b, 0x80
mov byte [r9 + 1], r8b
movzx eax, byte [r9 + 2]
mov r8d, eax
sub r8b, dl
add r8b, 0x80
mov byte [r9 + 2], r8b
movzx r10d, byte [r9 + 3]
mov edx, r10d
sub dl, al
add dl, 0x80
mov byte [r9 + 3], dl
lea rax, [r9 + 4]
mov r9, rax
cmp rax, rcx
jne 0x140142e00
add rsp, 0x10
pop rbx
ret
Function at 0x14016bbc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14016bddd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x140265610]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14016bc30
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x140265620]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14016bd5a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x14016bd30
movdqa xmm1, xmmword [0x140265620]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140265630], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14016bdfb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14016b690
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140190b20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x20]
movups xmm1, xmmword [rdx + 0x30]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
mov rax, qword [rdx + 0x10]
movzx r14d, byte [rdx + 0x18]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x20], r14b
movzx eax, byte [0x1402f7215]
mov ecx, 0x5f0
mov edx, 8
call fcn.1400a8e60
test rax, rax
mov qword [rbp - 8], rbx
je 0x140190d9b
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x60]
mov qword [rbp - 0x10], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
nop word cs:[rax + rax]
mov r12d, 1
lock xadd qword [0x1402f7228], r12
mov r15, r12
xor r15, rcx
lea rax, [r15 + rdx]
mov rbx, r15
rol rbx, 0x10
xor rbx, rax
lea rax, [rbx + r8]
rol rbx, 0x15
xor rbx, rax
add r15, r9
mov r13, r15
xor r13, r10
rol r15, 0x20
xor r12, rax
add r12, r13
rol r13, 0xd
mov rax, rbx
xor r13, r12
rol r12, 0x20
xor rax, r11
add r15, rax
shrd rax, rbx, 0x30
xor rax, r15
add r12, rax
rol rax, 0x15
add r15, r13
rol r13, 0x11
xor rax, r12
xor r13, r15
rol r15, 0x20
xor r12, r11
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
xor r15, 0xff
add r15, rax
rol rax, 0x10
xor rax, r15
add r12, rax
rol rax, 0x15
add r15, r13
rol r13, 0x11
xor r13, r15
rol r15, 0x20
xor rax, r12
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
add r15, rax
rol rax, 0x10
xor rax, r15
add r12, rax
rol rax, 0x15
add r15, r13
rol r13, 0x11
xor r13, r15
rol r15, 0x20
xor rax, r12
add r12, r13
rol r13, 0xd
add r15, rax
rol rax, 0x10
xor rax, r15
rol rax, 0x15
xor r13, r12
add r15, r13
rol r13, 0x11
mov rbx, r15
rol rbx, 0x20
xor rbx, r13
xor rbx, rax
xor rbx, r15
je 0x140190bf0
mov rdx, qword [rbp - 8]
mov rax, qword [rdx + 0x40]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rcx, qword [rbp - 0x18]
mov qword [rsi + 0x138], rcx
mov byte [rsi + 0x140], r14b
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov rcx, qword [rbp - 0x10]
mov qword [rsi + 0x100], rcx
mov qword [rsi + 0x108], rbx
mov qword [rsi + 0x110], rax
mov rcx, qword [rdx + 0x48]
test rcx, rcx
je 0x140190d87
mov rdx, qword [rdx + 0x50]
test rdx, rdx
je 0x140190d87
mov r8d, 1
call fcn.1400a8e70
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.1401fbeb0
ud2
Function at 0x1401915c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1401915e8
mov rax, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rbp
ret
lea rdx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorkind
lea rcx, [rbp - 0x38]
mov r8d, send
call fcn.1401c9d40
movzx eax, byte [rbp - 0x20]
cmp eax, 2
je 0x14019166f
cmp eax, 3
jne 0x140191657
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14019166f
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x10], rdx
call fcn.1401ef620
movzx ebx, byte [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14019164e
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.1400a8e70
test bl, bl
jne 0x14019166f
jmp 0x1401916d9
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14019166f
mov rcx, qword [rbp - 0x38]
mov r8d, 1
call fcn.1400a8e70
lea rdx, [0x14026dab9]
lea rcx, [rbp - 0x38]
mov r8d, send
call fcn.1401c9d40
movzx eax, byte [rbp - 0x20]
cmp eax, 2
je 0x1401916fc
cmp eax, 3
jne 0x1401916e4
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x1401916fc
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x10], rdx
call fcn.1401ef620
movzx ebx, byte [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1401916d5
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.1400a8e70
test bl, bl
jne 0x1401916fc
test rsi, rsi
jne 0x1401915dd
jmp 0x1401916fc
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x1401916fc
mov rcx, qword [rbp - 0x38]
mov r8d, 1
call fcn.1400a8e70
nop
add rsp, 0x60
pop rbx
pop rsi
pop rbp
jmp 0x1401b2470
Function at 0x14019dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
cmp rdx, r9
jne 0x14019e10b
test rdx, rdx
je 0x14019e10f
mov r10, qword [rcx]
mov al, 1
cmp r10, qword [r8]
jne 0x14019e111
mov al, 1
mov r9d, 1
mov r11, r8
mov rsi, rcx
nop dword [rax + rax]
cmp r10, 2
jne 0x14019e0e0
mov r10, qword [rsi + 0x18]
cmp r10, qword [r11 + 0x18]
jne 0x14019e111
test r10, r10
je 0x14019e0e0
mov r11, qword [r11 + 8]
mov rsi, qword [rsi + 8]
movzx edi, byte [rsi]
movzx ebx, byte [r11]
lea ebp, [rdi - 0x41]
cmp bpl, 0x1a
setb bpl
shl bpl, 5
lea r14d, [rbx - 0x41]
cmp r14b, 0x1a
setb r14b
shl r14b, 5
or bpl, dil
or r14b, bl
cmp bpl, r14b
jne 0x14019e111
lea rdi, [r10 - 1]
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14019e0e0
movzx r14d, byte [rsi + rbx + 1]
movzx r15d, byte [r11 + rbx + 1]
lea ebp, [r14 - 0x41]
cmp bpl, 0x1a
setb bpl
shl bpl, 5
lea r12d, [r15 - 0x41]
cmp r12b, 0x1a
setb r12b
shl r12b, 5
or bpl, r14b
or r12b, r15b
inc rbx
cmp bpl, r12b
je 0x14019e090
cmp rbx, r10
jb 0x14019e111
nop word cs:[rax + rax]
cmp r9, rdx
setb al
je 0x14019e111
lea rdi, [r9 + 1]
shl r9, 5
lea rsi, [rcx + r9]
lea r11, [r8 + r9]
mov r10, qword [rcx + r9]
cmp r10, qword [r8 + r9]
mov r9, rdi
je 0x14019e020
jmp 0x14019e111
xor eax, eax
jmp 0x14019e113
xor eax, eax
xor al, 1
and al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401ac1e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
test r9, r9
je 0x1401ac234
mov rdi, r9
mov rbx, r8
mov r15d, 0xffffffff
nop dword [rax]
cmp rdi, r15
mov r14d, 0xffffffff
cmovb r14, rdi
mov rcx, rbx
mov edx, r14d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1401ac23a
add rbx, r14
sub rdi, r14
jne 0x1401ac210
mov byte [rsi + 0x20], 5
jmp 0x1401ac290
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp - 8], rdi
movzx eax, byte [0x1402f7215]
mov ecx, 8
mov edx, 8
call fcn.1400a8e60
test rax, rax
je 0x1401ac2a0
mov qword [rax], rdi
lea rcx, str.couldnt_generate_random_bytes
mov qword [rsi], rcx
mov qword [rsi + 8], 0x1e
mov qword [rsi + 0x10], rax
lea rax, fcn.1401ac130
mov qword [rsi + 0x18], rax
mov byte [rsi + 0x20], 0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 8
call fcn.1401fbeb0
ud2

Function at 0x1401ac840
Capabilities:
Encode data using xor

Disassembly:
movabs rdx, 0x67452301efcdab89
mov rax, qword [rcx]
movabs r10, 0x98badcfe10325476
xor r8d, r8d
xor r9d, r9d
nop dword [rax]
bt rax, r9
mov r11, rdx
cmovae r11, r8
xor r11, r10
shld r11, r10, 1
lea r10d, [r9 + 1]
movzx r10d, r10b
bt rax, r10
mov r10, rdx
cmovae r10, r8
xor r10, r11
shld r10, r11, 1
add r9, 2
cmp r9, 0x40
jne 0x1401ac860
xor r10, rax
mov qword [rcx], r10
ret
Function at 0x1401aca00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x868
mov rdi, rcx
mov rbp, qword [rcx + 8]
call rbp
mov rsi, rax
xor r12d, r12d
lea rbx, [rsp + 0x58]
mov r8d, 0x800
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x858], rsi
mov qword [rsp + 0x860], 0
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
xor r15d, r15d
xor esi, esi
xor eax, eax
mov qword [rsp + 0x28], rax
mov r13, r12
cmp r12, 0x65
mov r12d, 0x64
cmovae r12, r13
inc r12
nop dword [rax]
cmp r13, 0x190
jae 0x1401acb4d
call rbp
mov r14, rax
mov rcx, rdi
mov rdx, rbx
mov r8b, 1
call fcn.1401ac7d0
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.1401ac6c0
mov rbp, qword [rdi + 8]
call rbp
xor edx, edx
test r14, r14
je 0x1401acbc6
test rax, rax
je 0x1401acbc6
mov rcx, rax
sub rcx, r14
test ecx, ecx
je 0x1401acbc4
inc r13
cmp r12, r13
jne 0x1401aca80
mov edx, dword [rsp + 0x860]
mov dword [rsp + 0x860], ecx
sub edx, ecx
sete r8b
cmp edx, dword [rsp + 0x864]
sete r9b
or r9b, r8b
movzx r8d, r9b
add qword [rsp + 0x30], r8
cmp r14, rax
sbb r15d, 0xffffffff
imul eax, ecx, 0xc28f5c29
add eax, 0x51eb850
ror eax, 2
cmp eax, 0x28f5c29
adc qword [rsp + 0x38], 0
mov eax, ecx
sub eax, esi
mov r8d, eax
neg r8d
cmovs r8d, eax
mov dword [rsp + 0x864], edx
movsxd rax, r8d
add qword [rsp + 0x28], rax
mov esi, ecx
jmp 0x1401aca65
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
mov dl, 2
cmp r15d, 3
jg 0x1401acbc6
mov dl, 3
cmp qword [rsp + 0x28], 0x12c
jb 0x1401acbc6
mov dl, 1
cmp qword [rsp + 0x38], 0x10e
ja 0x1401acbc6
mov dl, 4
cmp qword [rsp + 0x30], 0x10e
ja 0x1401acbc6
movabs rcx, 0x6d3a06d3a06d3a07
mov r8, qword [rsp + 0x28]
mov rax, r8
mul rcx
shr rdx, 7
cmp r8, 0x12bf
jbe 0x1401acbdc
bsr rax, rdx
xor eax, 0x3f
mov cl, 0xbf
sub cl, al
mov dl, 0x40
sub dl, al
movzx eax, cl
div dl
mov edx, eax
jmp 0x1401acbed
mov dl, 1
mov al, 1
add rsp, 0x868
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [0x140272050]
movaps xmmword [rsp + 0x40], xmm0
movzx edx, byte [rsp + rdx + 0x40]
xor eax, eax
jmp 0x1401acbc8
Function at 0x1401b2470
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x14001b2ca
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x1401fec78]
lea rcx, [rbp - 0x20]
mov r8d, send
call fcn.1401c9d40
movzx eax, byte [rbp - 8]
cmp eax, 2
je 0x14001b35b
cmp eax, 3
jne 0x14001b343
mov rdi, qword [rbp - 0x20]
movups xmm0, xmmword [rbp - 0x18]
movaps xmmword [rbp - 0x40], xmm0
test rdi, rdi
je 0x14001b35b
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x20], rdi
mov r8, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.1401ef620
movzx ebx, byte [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001b33a
mov r8d, 1
mov rcx, rdi
call fcn.1400a8e70
test bl, bl
jne 0x14001b35b
jmp 0x14001b3cf
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001b35b
mov rcx, qword [rbp - 0x20]
mov r8d, 1
call fcn.1400a8e70
lea rdx, [0x1401fec89]
lea rcx, [rbp - 0x20]
mov r8d, send
call fcn.1401c9d40
movzx eax, byte [rbp - 8]
cmp eax, 2
je 0x14001b3f2
cmp eax, 3
jne 0x14001b3da
mov rdi, qword [rbp - 0x20]
movups xmm0, xmmword [rbp - 0x18]
movaps xmmword [rbp - 0x40], xmm0
test rdi, rdi
je 0x14001b3f2
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x20], rdi
mov r8, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.1401ef620
movzx ebx, byte [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001b3cb
mov r8d, 1
mov rcx, rdi
call fcn.1400a8e70
test bl, bl
jne 0x14001b3f2
test rsi, rsi
jne 0x14001b2be
jmp 0x14001b3f2
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001b3f2
mov rcx, qword [rbp - 0x20]
mov r8d, 1
call fcn.1400a8e70
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x1401b2470
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1401c9ae0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1401c9b70
jmp 0x1401c9b5f
jae 0x1401c9c30
cmp r8, 0x201
jae 0x1401c9b70
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1401c9bc8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1401c9b9f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1401facd0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1401c9bf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401c9c98
mov r8d, r14d
cmp r15, r8
jne 0x1401c9b50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401c9cbb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1401c9b5f
jmp 0x1401c9b70
cmp rsi, r8
jb 0x1401c9cd5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1401ce3b0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1401c9c81
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400a8e70
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1401c9c69
jmp 0x1401c9c81
lea rcx, str.internal_error:_entered_unreachable_code_rustc_d5c2e9c342b358556da91d61ed4133f6f50fc0c3library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1401fc0d0
jmp 0x1401c9cea
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1401fc600
ud2
Function at 0x1401ce1f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x1401ce242
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401ce259
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1401ce2e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1401ce31a
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401ce331
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1401ce340
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1401ce374
cdqe
jmp 0x1401ce383
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1401ce38b
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401ce39c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret