joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074fc0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov r13, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
mov qword [rbp - 8], rcx
je 0x140075039
xor r12d, r12d
mov rax, rsi
shr rax, 0x3d
sete al
jne 0x140075183
lea r15, [rsi*4]
mov r12b, al
shl r12, 2
test r15, r15
je 0x140075043
movzx eax, byte [0x14018d171]
mov rcx, r15
mov rdx, r12
call fcn.1400053b0
mov rbx, rax
test rbx, rbx
jne 0x14007504f
jmp 0x14007518a
mov ebx, 4
xor r15d, r15d
jmp 0x14007504f
mov rbx, r12
test rbx, rbx
je 0x14007518a
mov rcx, rbx
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov r8, qword [rdi + 0x10]
test r8, r8
je 0x1400750e0
xor eax, eax
jmp 0x140075088
inc rax
cmp rax, r8
je 0x1400750e0
mov rcx, qword [r13 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x14007515e
mov edx, dword [rbx + rax*4]
cmp edx, r9d
je 0x140075080
nop word cs:[rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x14007514a
mov edx, dword [rbx + rdx*4]
cmp edx, r9d
jne 0x1400750b0
mov rdx, qword [r13 + 0x10]
cmp rax, rdx
jae 0x140075172
mov rcx, qword [r13]
mov dword [rcx + rax*4], r10d
jmp 0x140075080
lea r8, [r13 + 0x18]
mov rcx, rdi
mov rdx, r13
call fcn.1400732d0
test rsi, rsi
je 0x140075109
shl rsi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rsi
call fcn.1400053c0
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140075138
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.1400053c0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.C:Userslightning.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, rdx
mov rdx, rsi
call fcn.1400fc7e0
jmp 0x140075195
lea r8, str.C:Userslightning.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, rsi
mov rdx, rsi
call fcn.1400fc7e0
jmp 0x140075195
lea r8, str.C:Userslightning.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.1.2_srcutil_remapper.rs
mov rcx, rax
call fcn.1400fc7e0
jmp 0x140075195
call fcn.1400eef40
jmp 0x140075195
mov rcx, r12
mov rdx, r15
call fcn.1400fc520
ud2
Function at 0x1400ba640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov rbx, qword [rdx + 8]
mov r8, qword [r15 + 0xa0]
mov r14, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, r14
call fcn.1400ab100
cmp eax, 0x5c
jne 0x1400ba6a1
mov rcx, rsi
mov rdx, rdi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.1400b6560
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.1400abc90
mov r8, qword [r15 + 0xa0]
mov rcx, rbx
mov rdx, r14
call fcn.1400ab100
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x2c], 0
mov byte [rbp + 8], 2
mov rcx, rdi
call fcn.1400ab220
movups xmm0, xmmword [rbp]
movups xmmword [rsi + 0x68], xmm0
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x58], xmm0
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x48], xmm0
movups xmm0, xmmword [rbp - 0x60]
movups xmm1, xmmword [rbp - 0x50]
movups xmm2, xmmword [rbp - 0x40]
movups xmm3, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x38], xmm3
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov dword [rsi], 0x22
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400cd920
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x14018d171]
mov ecx, 0x1818
mov edx, 4
call fcn.1400053b0
test rax, rax
je 0x1400cda59
xor ecx, ecx
lea rdx, [0x140126208]
movdqa xmm0, xmmword [0x1400ff7a0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rcx], xmm5
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400cd980
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x303
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x40]
call fcn.1400cf620
mov rax, qword [rbp - 0x48]
test rax, rax
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp - 0x40], xmm0
sete byte [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.1400d8ac0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x88
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.1400fc520
ud2

Function at 0x1400cdba0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x14018d171]
mov ecx, 0x200
mov edx, 4
call fcn.1400053b0
test rax, rax
je 0x1400cdcc8
xor ecx, ecx
lea rdx, [0x140127a70]
movdqa xmm0, xmmword [0x1400ff7a0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rcx], xmm5
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400cdc00
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x40
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x40]
call fcn.1400cf620
mov rax, qword [rbp - 0x48]
test rax, rax
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp - 0x40], xmm0
sete byte [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.1400d8ac0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x88
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.1400fc520
ud2
Function at 0x1400d2940
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
movdqa xmmword [rsp + 0x20], xmm6
mov rdi, rcx
mov rsi, r8
sub rsi, rdx
je 0x1400d29a5
js 0x1400d2a7d
mov rbx, r8
mov r14, rdx
mov r15, rsi
shr r15, 0x3d
not r15d
and r15d, 4
movzx eax, byte [0x14018d171]
mov rcx, rsi
mov rdx, r15
call fcn.1400053b0
test rax, rax
je 0x1400d2a84
lea r8, [rsi - 8]
cmp r8, 8
jae 0x1400d29b1
xor ecx, ecx
mov rdx, r14
jmp 0x1400d2a30
xor ecx, ecx
mov eax, 4
jmp 0x1400d2a5a
shr r8, 3
inc r8
mov rcx, r8
and rcx, 0xfffffffffffffffe
lea rdx, [r14 + rcx*8]
xor r9d, r9d
movdqa xmm0, xmmword [0x1400ff7a0]
nop
movdqu xmm1, xmmword [r14 + r9*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + r9*8], xmm5
add r9, 2
cmp rcx, r9
jne 0x1400d29d0
cmp r8, rcx
je 0x1400d2a5a
mov r8d, dword [rdx]
mov r9d, dword [rdx + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
inc rcx
add rdx, 8
cmp rdx, rbx
jne 0x1400d2a30
shr rsi, 3
mov qword [rdi], rax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rcx
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400eef40
ud2
mov rcx, r15
mov rdx, rsi
call fcn.1400fc520
ud2

Function at 0x1400d8ee0
Capabilities:
Open clipboard

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x1400d8f32
lea rcx, [rbp - 0x28]
call fcn.1400d9810
lea rcx, [rbp - 0x10]
call fcn.1400d9730
mov rax, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
test rax, rax
je 0x1400d8f41
mov rcx, qword [rbp - 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rcx
jmp 0x1400d8f79
call fcn.1400e4c00
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp - 0x28], rdi
movzx eax, byte [0x14018d171]
mov ecx, 8
mov edx, 8
call fcn.1400053b0
test rax, rax
je 0x1400d8f84
mov qword [rax], rdi
mov qword [rsi + 8], rax
lea rax, fcn.1400d9210
mov qword [rsi + 0x10], rax
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 8
mov edx, 8
call fcn.1400fc520
ud2
Function at 0x1400d9000
Capabilities:
Open clipboard

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rax, qword [rdx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x38], rdx
mov rsi, qword [rdx + 0x10]
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x1400d90d4
mov rax, qword [rbp - 0x30]
add rsi, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rsi
mov word [rbp - 0x40], 0
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x50]
call fcn.1400d92e0
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x20]
jne 0x1400d906b
lea rcx, [rbp - 0x28]
call fcn.1400d9660
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x28]
mov word [rax + rdx*2], 0
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea rcx, [rax + 1]
mov qword [rbp - 0x18], rcx
lea r8, [rax + rax]
add r8, 2
mov ecx, 0xd
call fcn.1400d9a60
mov rsi, rax
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1400d90b5
mov rcx, qword [rbp - 0x28]
add rdx, rdx
mov r8d, 2
call fcn.1400053c0
lea rcx, [rbp - 0x10]
call fcn.1400d9730
test rsi, rsi
jne 0x1400d90e3
xor edi, edi
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1400d9115
jmp 0x1400d9124
call fcn.1400e4c00
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov qword [rbp - 0x50], rsi
movzx eax, byte [0x14018d171]
mov ecx, 8
mov edx, 8
call fcn.1400053b0
test rax, rax
je 0x1400d9136
mov rdi, rax
mov qword [rax], rsi
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400d9124
mov r8d, 1
mov rcx, qword [rbp - 0x30]
call fcn.1400053c0
lea rdx, fcn.1400d9210
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ecx, 8
mov edx, 8
call fcn.1400fc520
ud2
Function at 0x1400d9810
Capabilities:
Read clipboard data

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov ecx, 0xd
call sub.USER32.dll_GetClipboardData
test rax, rax
je 0x1400d995f
mov rdi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x1400d995f
mov rbx, rax
mov rcx, rdi
call sub.KERNEL32.dll_GlobalSize
mov r14, rax
mov qword [rbp - 0x38], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov r8, rax
shr r8, 2
bt r14d, 1
adc r8, 0
je 0x1400d9893
lea rcx, [rbp - 0x38]
xor edx, edx
call fcn.1400f70e0
and r14, 0xfffffffffffffffe
add r14, rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r14
mov word [rbp - 0x50], 0
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x38]
call fcn.1400d9b40
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x10], rbx
mov r14, qword [rbp - 0x20]
xor r15d, r15d
mov rax, r14
mov r8, rbx
jmp 0x1400d98f6
add r15, rdx
inc r15
lea rax, [r14 + r15]
mov r8, rbx
sub r8, r15
jb 0x1400d99a6
cmp r8, 0x10
jae 0x1400d9930
xor edx, edx
test r8, r8
je 0x1400d9921
nop word cs:[rax + rax]
cmp byte [rax + rdx], 0
je 0x1400d9952
inc rdx
cmp r8, rdx
jne 0x1400d9910
mov rdx, r8
xor eax, eax
cmp rax, 1
je 0x1400d9940
jmp 0x1400d99a6
xor ecx, ecx
mov rdx, rax
call fcn.1400f3050
cmp rax, 1
jne 0x1400d99a6
lea rcx, [r15 + rdx]
cmp rcx, rbx
jae 0x1400d98e0
cmp byte [r14 + rcx], 0
jne 0x1400d98e0
jmp 0x1400d9979
mov eax, 1
cmp rax, 1
je 0x1400d9940
jmp 0x1400d99a6
call fcn.1400e4c00
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400d99bd
cmp rbx, rcx
jb 0x1400d99d0
lea rax, [r14 + rcx]
add r14, rbx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], r14
lea rcx, [rbp - 0x60]
call fcn.1400ef890
mov rcx, rdi
call sub.KERNEL32.dll_GlobalUnlock
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r8, str._rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_alloc_src_string.rs
mov rdx, rbx
call fcn.1400fcc80
ud2
Function at 0x1400d9a60
Capabilities:
Write clipboard data

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r8
mov r14, rdx
mov edi, ecx
mov ecx, 0x42
mov rdx, r8
call sub.KERNEL32.dll_GlobalAlloc
test rax, rax
je 0x1400d9ace
mov rsi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
mov ecx, edi
mov rdx, rsi
call sub.USER32.dll_SetClipboardData
test rax, rax
je 0x1400d9ae1
xor eax, eax
mov qword [rbp - 0x10], rax
jmp 0x1400d9afa
call fcn.1400e4c00
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
jmp 0x1400d9afa
call fcn.1400e4c00
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
mov rcx, rsi
call sub.KERNEL32.dll_GlobalFree
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400dca90
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400dcb20
jmp 0x1400dcb0f
jae 0x1400dcbe0
cmp r8, 0x201
jae 0x1400dcb20
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x1400dcb78
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400dcb4f
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.1400fb5c0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3d8], r13
mov rbx, rdi
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400dcba1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400dcc48
mov r8d, r14d
cmp r15, r8
jne 0x1400dcb00
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400dcc6b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400dcb0f
jmp 0x1400dcb20
cmp rsi, r8
jb 0x1400dcc85
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.1400dfc10
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400dcc31
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400053c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400dcc19
jmp 0x1400dcc31
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400fc740
jmp 0x1400dcc9a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400fcc00
ud2
Function at 0x1400dccf0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400e66e0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x1400dce66
mov qword [rbp + 0x408], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor esi, esi
cmp r8, 0x201
jae 0x1400dcda0
jmp 0x1400dcd8f
jae 0x1400dce78
cmp r8, 0x201
jae 0x1400dcda0
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x1400dcdf7
sub r8, rsi
sub rbx, rsi
cmp rbx, r8
jae 0x1400dcdcf
lea rcx, [rbp + 0x3e8]
mov rdx, rsi
call fcn.1400fb5c0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov esi, 0xffffffff
cmovb rsi, rdi
mov qword [rbp + 0x3f8], rsi
mov rbx, rdi
mov r13, qword [rbp + 0x418]
mov r15, rsi
mov r12, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x1400dce27
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400dcf4b
mov r8d, r14d
cmp r12, r8
jne 0x1400dcd80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400dcf75
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400dcd8f
jmp 0x1400dcda0
lea rcx, [rbp - 0x58]
call fcn.1400da7e0
mov byte [rsi + 0x18], 2
jmp 0x1400dcf0a
cmp r15, r8
jb 0x1400dcf8f
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.1400dfc10
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x1400dcec9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x418]
mov rdx, rdi
call fcn.1400053c0
cmp byte [rbp + 0x3d8], 2
jne 0x1400dcf21
mov rsi, qword [rbp + 0x408]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400da7e0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x1400dcf0a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
call fcn.1400053c0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x408]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
jne 0x1400dcef5
jmp 0x1400dcf0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x1400dceb1
jmp 0x1400dcec9
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400fc740
jmp 0x1400dcfa4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400fcc00
ud2
Function at 0x1400e0610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400e0640
test ecx, ecx
jne 0x1400e0690
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1400e064c
test ecx, ecx
jne 0x1400e0690
mov rcx, rdi
call fcn.1400e04f0
movzx eax, al
test bpl, bpl
jne 0x1400e0697
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x1400e0683.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1400e0808]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x1400e0683.2
xor eax, eax
test bpl, bpl
je 0x1400e065c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1400e07e9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x1400e06ca
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400e0749
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400e0710
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1400e072b
inc rax
dec rdi
cmp rax, 1
jne 0x1400e06f0
jmp 0x1400e0749
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400e072b
cmp ebx, 0x5c
je 0x1400e072b
inc rax
dec rdi
cmp rax, 1
jne 0x1400e0710
jmp 0x1400e0749
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x1400e07f7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x1400e0773
mov al, 9
cmp rdx, 2
je 0x1400e0777
cmp rdx, 1
jne 0x1400e0787
cmp byte [r8], 0x2e
jne 0x1400e0787
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x1400e0787
mov al, 0xa
jmp 0x1400e0787
cmp byte [r8], 0x2e
jne 0x1400e0787
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x1400e0683.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x1400e0683.2
mov ecx, 2
jmp case.0x1400e0683.2
lea r8, str.library_std_srcpath.rs
call fcn.1400fcb80
ud2
lea r8, str.library_std_srcpath.rs
call fcn.1400fcb80
ud2