joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018d4b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0xf0
call fcn.1401d9d90
sub rsp, rax
mov r14, r9
mov r15, r9
shr r14, 3
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp r8, r9
jb 0x14018d5af
mov qword [rsp + 0x110], rbx
xor edx, edx
test r14, r14
je 0x14018d560
nop word [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi]
shl rcx, 8
add rsi, 8
or rcx, rax
xor qword [rdi + rdx*8], rcx
inc rdx
cmp rdx, r14
jb 0x14018d500
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14018d0e0
lea r8, [rbx + 1]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.14018d0e0
add rbx, 2
cmp rbx, 0x18
jb 0x14018d570
sub rbp, r15
cmp rbp, r15
jae 0x14018d4f0
mov rbx, qword [rsp + 0x110]
lea r11, [rsp + 0xf0]
mov rax, rbp
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401cc8a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0xd8
call fcn.1401d9d90
sub rsp, rax
mov rax, qword [0x140301ed0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r12, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
mov rax, r12
sub rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rdi, r8
mov r13, rdx
mov ebp, esi
cmp r15, r8
jb 0x1401cca8e
cmp r8, 0x40
ja 0x1401cca8e
lea rax, [rsp + 0x40]
mov qword [rsp + 0x118], rbx
neg rax
mov qword [rsp + 0xd0], r14
and eax, 0x3f
lea r14, [rsp + 0x40]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1401cc93a
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rbx, rsi
call fcn.1401dacf0
mov r9, rsi
cmp rbp, r15
jae 0x1401cc9f7
mov r13, qword [r13 + 0x20]
mov r11, qword [rsp + 0x28]
lea r10, [r12 + r13]
neg r10
nop dword [rax + rax]
mov rax, rbp
mov rdx, rbp
xor rax, r11
add rdx, r13
lea r8, [rax - 1]
not rax
shr rax, 0x3f
lea rcx, [r10 + rdx]
xor rcx, r12
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r12
neg r8
or rcx, rax
mov rax, r8
xor rcx, rbp
or rax, rsi
shr rcx, 0x3f
and r8, r9
neg rcx
or rbx, r8
mov rsi, rcx
inc rbp
and rsi, rax
movzx eax, byte [rdx]
and al, sil
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, rdi
sub rcx, rdi
xor rax, r9
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
cmp rbp, r15
jb 0x1401cc970
xor esi, esi
test rdi, rdi
je 0x1401cca77
mov r9, qword [rsp + 0x30]
mov rax, rbx
and rax, 0xffffffffffffffdf
movzx r8d, byte [rax + r14]
mov rax, rbx
or rax, 0x20
movzx edx, byte [rax + r14]
mov eax, ebx
and eax, 0x20
inc rbx
lea ecx, [rax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and cl, al
neg cl
movzx eax, cl
mov dword [rsp + 0x28], eax
not eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
and cl, dl
and al, r8b
or al, cl
mov rcx, rbx
sub rcx, rdi
mov byte [r9 + rsi], al
xor rcx, rdi
mov rax, rdi
xor rax, rbx
inc rsi
or rcx, rax
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1401cca01
mov r14, qword [rsp + 0xd0]
mov eax, 1
mov rbx, qword [rsp + 0x118]
jmp 0x1401cca90
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401d9820
add rsp, 0xd8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401dbf18
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401dbcec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401dbcec
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401dbcec
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401dbcec
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401dbcec
cmp dword [rcx + 0x84], 0xe
jbe 0x1401dbcec
cmp dword [rcx + 0xf8], esi
je 0x1401dbcec
mov ecx, r14d
call fcn.1401dbe34
mov ecx, 2
call fcn.1401f1134
nop
cmp byte [0x140309560], 0
jne 0x1401dbdb6
mov r15d, 1
mov eax, r15d
xchg dword [0x140309550], eax
test ebx, ebx
jne 0x1401dbd5f
mov rdi, qword [0x140301ed0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140309558]
cmp rcx, rax
je 0x1401dbd56
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140004770]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140309910]
jmp 0x1401dbd6b
cmp ebx, r15d
jne 0x1401dbd71
lea rcx, [0x140309928]
call fcn.1401f0d88
nop
test ebx, ebx
jne 0x1401dbd88
lea rdx, [0x140208c30]
lea rcx, [0x140208c10]
call fcn.1401f07c8
lea rdx, [0x140208c40]
lea rcx, [0x140208c38]
call fcn.1401f07c8
movzx eax, byte [0x140309560]
test esi, esi
cmove eax, r15d
mov byte [0x140309560], al
jmp 0x1401dbdb6
mov ecx, 2
call fcn.1401f1188
test esi, esi
jne 0x1401dbdcd
mov ecx, r14d
call fcn.1401dbde8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401dbc7c

Function at 0x1401e9944
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401e9964
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401e2040
or eax, 0xffffffff
jmp 0x1401e9966
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401e996c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401e998c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401e2040
or eax, 0xffffffff
jmp 0x1401e998e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401f49f0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401f4890
call fcn.1401e20b0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401e1350
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401f4878
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401f4878
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401f48c2
lock or dword [rax + 0x14], 0x10
jmp 0x1401f4878
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401f48df
mov rcx, qword [rbp + 0x10]
call fcn.1401fc5dc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401ed3e0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401e9ec4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401f4936
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401f4878
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401f49a2
mov rcx, qword [rbp + 0x10]
call fcn.1401ed3e0
cmp eax, 0xffffffff
je 0x1401f4989
mov rcx, qword [rbp + 0x10]
call fcn.1401ed3e0
cmp eax, 0xfffffffe
je 0x1401f4989
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401ed3e0
movsxd rdi, eax
lea rsi, [0x140309d00]
mov rcx, rbx
sar rdi, 6
call fcn.1401ed3e0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401f4990
lea rax, [0x1403021e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401f49a2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401f49d8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401f49d4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401f49d4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401f487b
jmp 0x1401f4848

Function at 0x1401f4a3c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401f4a19
call fcn.1401e20b0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401e1350
or eax, 0xffffffff
jmp 0x1401f4a36
sub dword [rcx + 0x10], 1
jns 0x1401f4a28
add rsp, 0x28
jmp fcn.1401f49f0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401f49f8
Function at 0x7ff6e9a71050
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, cl
xor eax, eax
shl rcx, 4
add r8, rcx
lea r9, [rdx + rax]
lea r10, [rax + r8]
xor ecx, ecx
mov r11b, byte [r10 + rcx]
inc rcx
xor byte [r9], r11b
inc r9
cmp rcx, 4
jne 0x7ff6e9a71066
add rax, 4
cmp rax, 0x10
jne 0x7ff6e9a7105c
ret

Function at 0x7ff6e9a711e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov eax, 0x10
mov rbp, rsp
push r15
push r14
push r13
mov r13, rdx
push r12
push rdi
push rsi
lea rsi, [rdx + r8]
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
cmp rsi, r13
je 0x7ff6e9a713ec
cmp eax, 0x10
jne 0x7ff6e9a713d7
lea r12, [rsp + 0x30]
mov r8, rbx
xor ecx, ecx
mov r15d, 1
movups xmm0, xmmword [rbx + 0xf0]
mov rdx, r12
lea rdi, [rsp + 0x34]
lea r14, str.cw
movups xmmword [rsp + 0x30], xmm0
call fcn.7ff6e9a71050
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, r12
mov rcx, r12
mov rdx, rcx
xor r8d, r8d
movzx r9d, byte [rdx]
inc r8d
add rdx, 4
mov r9b, byte [r14 + r9]
mov byte [rdx - 4], r9b
cmp r8b, 4
jne 0x7ff6e9a7125e
inc rcx
cmp rdi, rcx
jne 0x7ff6e9a71258
mov cl, byte [rsp + 0x35]
mov dl, byte [rsp + 0x31]
mov byte [rsp + 0x31], cl
mov cl, byte [rsp + 0x39]
mov byte [rsp + 0x35], cl
mov cl, byte [rsp + 0x3d]
mov byte [rsp + 0x3d], dl
mov dl, byte [rsp + 0x32]
mov byte [rsp + 0x39], cl
mov cl, byte [rsp + 0x3a]
mov byte [rsp + 0x3a], dl
mov dl, byte [rsp + 0x36]
mov byte [rsp + 0x32], cl
mov cl, byte [rsp + 0x3e]
mov byte [rsp + 0x3e], dl
mov dl, byte [rsp + 0x33]
mov byte [rsp + 0x36], cl
mov cl, byte [rsp + 0x3f]
mov byte [rsp + 0x33], cl
mov cl, byte [rsp + 0x3b]
mov byte [rsp + 0x3f], cl
mov cl, byte [rsp + 0x37]
mov byte [rsp + 0x37], dl
mov byte [rsp + 0x3b], cl
cmp r15d, 0xe
je 0x7ff6e9a71399
mov r8b, byte [rax]
mov cl, byte [rax + 1]
add rax, 4
mov r9b, byte [rax - 1]
mov dl, byte [rax - 2]
xor ecx, r8d
mov r11d, ecx
xor edx, r9d
mov r10d, ecx
add ecx, ecx
sar r11b, 7
xor r10d, edx
and r11d, 0x1b
xor ecx, r11d
mov r11d, r8d
xor r8d, r9d
xor r9d, r10d
xor r11d, r10d
xor ecx, r11d
mov byte [rax - 4], cl
mov cl, byte [rax - 3]
xor cl, byte [rax - 2]
mov r11d, ecx
add ecx, ecx
sar r11b, 7
and r11d, 0x1b
xor ecx, r11d
mov r11b, byte [rax - 3]
xor r11d, r10d
xor ecx, r11d
mov byte [rax - 3], cl
mov ecx, edx
add edx, edx
sar cl, 7
and ecx, 0x1b
xor edx, ecx
mov cl, byte [rax - 2]
xor ecx, r10d
xor edx, ecx
mov byte [rax - 2], dl
mov edx, r8d
add r8d, r8d
sar dl, 7
and edx, 0x1b
xor edx, r8d
xor r9d, edx
mov byte [rax - 1], r9b
cmp qword [rsp + 0x28], rax
jne 0x7ff6e9a712e9
mov ecx, r15d
mov r8, rbx
mov rdx, r12
inc r15d
call fcn.7ff6e9a71050
jmp 0x7ff6e9a71252
mov r8, rbx
mov rdx, r12
mov ecx, 0xe
call fcn.7ff6e9a71050
mov eax, 0xf
mov dl, byte [rbx + rax + 0xf0]
cmp dl, 0xff
jne 0x7ff6e9a713ca
mov byte [rbx + rax + 0xf0], 0
sub rax, 1
jae 0x7ff6e9a713ae
jmp 0x7ff6e9a713d5
cdqe
inc edx
mov byte [rbx + rax + 0xf0], dl
xor eax, eax
movsxd rdx, eax
inc eax
mov dl, byte [rsp + rdx + 0x30]
xor byte [r13], dl
inc r13
jmp 0x7ff6e9a71206
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x7ff6e9a7bb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x7ff6e9a89150]
push r12
xor edx, edx
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x84a]
test rax, rax
je 0x7ff6e9a7bc11
mov edx, dword [rbx + 0x800]
test edx, edx
jne 0x7ff6e9a7bc11
movsxd rcx, dword [rax + 0x3c]
xor r8d, r8d
mov ecx, dword [rax + rcx + 0x88]
add rcx, rax
mov edi, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x18]
xor ecx, ecx
add r10, rax
add rdi, rax
add rsi, rax
cmp r8d, ebp
jae 0x7ff6e9a7bc0b
mov r9d, dword [rdi + r8*4]
cmp word [rax + r9], 0x775a
jne 0x7ff6e9a7bc06
test rcx, rcx
movzx r9d, word [rsi + r8*2]
jne 0x7ff6e9a7bbde
mov ecx, dword [r10 + r9*4]
add rcx, rax
jmp 0x7ff6e9a7bc06
mov r9d, dword [r10 + r9*4]
mov r11, rcx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rcx
cmp r9, rcx
mov r9d, r12d
cmovb r9d, r11d
lea r11d, [rdx - 1]
cmp r11d, r9d
cmovae edx, r9d
inc r8
jmp 0x7ff6e9a7bbb9
mov dword [rbx + 0x800], edx
pop rbx
mov eax, edx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x7ff6e9a7bf80
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x7ff6e9a7bfcd
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x7ff6e9a7bf9c
test r9b, r9b
jne 0x7ff6e9a7bfaf
ret
mov r11, r10
sub r11, rcx
cmp r11d, edx
jae 0x7ff6e9a7bfcd
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x7ff6e9a7bfbe
test r8d, r8d
je 0x7ff6e9a7bfbe
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x7ff6e9a7bf8f
ret

Function at 0x7ff6e9a7d9c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x7ff6e9a7d9c4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x7ff6e9a891a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x7ff6e9a7da42
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x7ff6e9a7da57
cmp esi, 4
jne 0x7ff6e9a7da57
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x7ff6e9a7da08
pop rbx
pop rsi
ret

Function at 0x1410fa6df
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x44c88b44
push 0x55c82fb1
pushfq
or dword [rsp + 8], 0x3e9317c8
not qword [rsp + 8]
push rcx
or qword [rsp + 0x10], 0x8a43bed
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1417d367d
add dword [rdx], ecx
add al, 0
or dh, byte [rdi + rax]
add byte [rdx], cl
xor al, byte [rsi]
invalid
Function at 0x140004c10
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140004cb0
jmp 0x140004c9f
jae 0x140004d6f
cmp r8, 0x201
jae 0x140004cb0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140004d07
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140004cdf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001b8d0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140004d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004ddb
mov r8d, r13d
cmp r12, r8
jne 0x140004c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004e0f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140004c9f
jmp 0x140004cb0
cmp r14, r8
jb 0x140004e29
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140007750
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140004dc4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400027d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140004daf
jmp 0x140004dc4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14001c750
jmp 0x140004e3e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001cb00
ud2
Function at 0x14000c2a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14001f4a8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14000c2d8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14000c32f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14000c33c
xor edx, edx
xor eax, eax
jmp 0x14000c366
cmp eax, 0x103
je 0x14000c370
test eax, eax
js 0x14000c34f
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14000c366
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140007330
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400033b0
mov ecx, 7
int 0x29
ud2

Function at 0x14000c3c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14001f4a8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14000c3f8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000c456
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14000c483
test eax, eax
js 0x14000c462
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14000c479
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140007330
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400033b0
mov ecx, 7
int 0x29
ud2
Function at 0x140019920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1400199aa
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400199a0
cmp r11, r10
ja 0x140019a26
cmp r10, rdx
ja 0x140019a38
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1400199a2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140019980
jmp 0x140019a07
ja 0x1400199aa
mov r11, r10
cmp rax, r8
jne 0x140019947
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x140019a0b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400199e0
mov r8, r10
sub ecx, r9d
jns 0x1400199fe
jmp 0x140019a0d
cmp r10, rdx
je 0x140019a1a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140019a0d
xor al, 1
cmp r8, rdx
jne 0x1400199c0
jmp 0x140019a0d
xor eax, eax
jmp 0x140019a0d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001c610
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001cb70
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001cb00
int3

Function at 0x14001b2b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b302
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b302
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b302
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b302
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b302
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b304
xor al, al
add rsp, 0x28
ret