joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019e1d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
pxor xmm2, xmm2
xor r9d, r9d
xor r10d, r10d
movdqa xmm3, xmm2
movdqa xmm4, xmm2
xor r11d, r11d
xor ebx, ebx
xor esi, esi
xor edi, edi
xor ebp, ebp
xor r12d, r12d
xor r13d, r13d
xor r14d, r14d
mov rax, rcx
mov qword [rsp + 0x100], r8
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 8], 0
mov qword [rsp + 0xf0], rax
nop word [rax + rax]
mov r15, qword [rsp + 0x100]
add rcx, 1
movdqa xmm0, xmmword [rdx]
xor r15, rcx
pxor xmm0, xmm4
mov rax, r15
sub r15, 1
not rax
and rax, r15
mov r15, qword [rsp + 8]
xor r15, qword [rdx + 0x30]
sar rax, 0x3f
and r15, rax
xor qword [rsp + 8], r15
mov r15, qword [rdx + 0x60]
movq xmm1, rax
punpcklqdq xmm1, xmm1
xor r15, r14
pand xmm0, xmm1
and r15, rax
pxor xmm4, xmm0
movdqa xmm0, xmmword [rdx + 0x10]
xor r14, r15
mov r15, qword [rdx + 0x38]
pxor xmm0, xmm3
xor r15, r13
pand xmm0, xmm1
and r15, rax
pxor xmm3, xmm0
movdqa xmm0, xmmword [rdx + 0x20]
xor r13, r15
mov r15, qword [rdx + 0x68]
pxor xmm0, xmm2
xor r15, r12
pand xmm0, xmm1
and r15, rax
pxor xmm2, xmm0
xor r12, r15
mov r15, qword [rdx + 0x40]
xor r15, rbp
and r15, rax
xor rbp, r15
mov r15, qword [rdx + 0x70]
xor r15, rdi
and r15, rax
xor rdi, r15
mov r15, qword [rdx + 0x48]
xor r15, rsi
and r15, rax
xor rsi, r15
mov r15, qword [rdx + 0x78]
xor r15, rbx
and r15, rax
xor rbx, r15
mov r15, qword [rdx + 0x50]
xor r15, r11
and r15, rax
xor r11, r15
mov r15, qword [rdx + 0x80]
add rdx, 0x90
xor r15, r10
and r15, rax
xor r10, r15
mov r15, qword [rdx - 0x38]
xor r15, r9
and r15, rax
xor r9, r15
mov r15, qword [rdx - 8]
xor r15, r8
and r15, rax
xor r8, r15
cmp rcx, 0x10
jne 0x14019e230
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], rcx
movdqa xmm5, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rsi
movaps xmmword [rax + 0x20], xmm2
movdqa xmm2, xmmword [rsp + 0x50]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x98], r8
movaps xmmword [rax], xmm4
movdqa xmm4, xmmword [rsp + 0x70]
movaps xmmword [rax + 0x10], xmm3
movdqa xmm3, xmmword [rsp + 0x60]
movaps xmmword [rax + 0x30], xmm5
movdqa xmm5, xmmword [rsp + 0x80]
movaps xmmword [rax + 0x40], xmm2
movdqa xmm2, xmmword [rsp + 0x90]
movaps xmmword [rax + 0x50], xmm3
movaps xmmword [rax + 0x60], xmm4
movaps xmmword [rax + 0x70], xmm5
movaps xmmword [rax + 0x80], xmm2
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14019e880
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rcx
mov r10, rdx
test r8, r8
je 0x14019ea28
lea rax, [r8 - 1]
cmp rax, 0xe
jbe 0x14019ea2c
mov rcx, r8
xor eax, eax
pxor xmm1, xmm1
and rcx, 0xfffffffffffffff0
nop dword [rax + rax]
movdqu xmm0, xmmword [r9 + rax]
movdqu xmm3, xmmword [r10 + rax]
add rax, 0x10
pxor xmm0, xmm3
por xmm1, xmm0
cmp rcx, rax
jne 0x14019e8b0
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm0, xmm1
movdqa xmm2, xmm0
psrldq xmm2, 4
por xmm0, xmm2
movdqa xmm2, xmm0
psrldq xmm2, 2
por xmm0, xmm2
movdqa xmm2, xmm0
psrldq xmm2, 1
por xmm0, xmm2
movd eax, xmm0
movdqa xmm0, xmm1
psrldq xmm1, 8
por xmm1, xmm0
cmp r8, rcx
je 0x14019ea1f
mov r11, r8
sub r11, rcx
lea rdx, [r11 - 1]
cmp rdx, 6
jbe 0x14019e990
movq xmm0, qword [r9 + rcx]
movq xmm2, qword [r10 + rcx]
pxor xmm0, xmm2
por xmm0, xmm1
movq rdx, xmm0
mov rax, rdx
mov rbx, rdx
or al, dh
shr rbx, 0x10
or eax, ebx
mov rbx, rdx
shr rbx, 0x18
or eax, ebx
mov rbx, rdx
shr rbx, 0x20
or eax, ebx
mov rbx, rdx
shr rbx, 0x28
or eax, ebx
mov rbx, rdx
shr rdx, 0x38
shr rbx, 0x30
or eax, ebx
or eax, edx
mov rdx, r11
and rdx, 0xfffffffffffffff8
add rcx, rdx
and r11d, 7
je 0x14019ea1f
movzx edx, byte [r9 + rcx]
xor dl, byte [r10 + rcx]
or eax, edx
lea rdx, [rcx + 1]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r10 + rcx + 1]
xor dl, byte [r9 + rcx + 1]
or eax, edx
lea rdx, [rcx + 2]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r9 + rcx + 2]
xor dl, byte [r10 + rcx + 2]
or eax, edx
lea rdx, [rcx + 3]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r9 + rcx + 3]
xor dl, byte [r10 + rcx + 3]
or eax, edx
lea rdx, [rcx + 4]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r9 + rcx + 4]
xor dl, byte [r10 + rcx + 4]
or eax, edx
lea rdx, [rcx + 5]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r9 + rcx + 5]
xor dl, byte [r10 + rcx + 5]
or eax, edx
lea rdx, [rcx + 6]
cmp rdx, r8
jae 0x14019ea1f
movzx edx, byte [r9 + rcx + 6]
xor dl, byte [r10 + rcx + 6]
or eax, edx
movzx eax, al
pop rbx
ret
xor eax, eax
pop rbx
ret
pxor xmm1, xmm1
xor ecx, ecx
xor eax, eax
jmp 0x14019e91b

Function at 0x1401a0e10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rdx, rdx
je 0x1401a0e50
lea r10, [rcx + rdx*8]
mov r8, 0xffffffffffffffff
mov rdx, qword [rcx]
mov r9, r8
add rcx, 8
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
xor rax, r8
and rax, r9
xor r8, rax
cmp r10, rcx
jne 0x1401a0e20
mov rax, r8
ret
mov r8, 0xffffffffffffffff
mov rax, r8
ret

Function at 0x1401a0e60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
mov r11, rcx
mov rbx, rdx
test r8, r8
je 0x1401a0eb0
xor ecx, ecx
mov r9, 0xffffffffffffffff
nop dword [rax]
mov rdx, qword [rbx + rcx*8]
xor rdx, qword [r11 + rcx*8]
mov r10, r9
add rcx, 1
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
xor rax, r9
and rax, r10
xor r9, rax
cmp r8, rcx
jne 0x1401a0e78
mov rax, r9
pop rbx
ret
mov r9, 0xffffffffffffffff
mov rax, r9
pop rbx
ret
Function at 0x1401a0ec0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401a0f20
xor rdx, qword [rcx]
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
cmp r8, 1
je 0x1401a0f30
lea r11, [rcx + r8*8]
lea r9, [rcx + 8]
mov r8, 0xffffffffffffffff
nop
mov rcx, qword [r9]
mov r10, r8
add r9, 8
mov rdx, rcx
sub rcx, 1
not rdx
and rdx, rcx
sar rdx, 0x3f
xor rdx, r8
and rdx, r10
xor r8, rdx
cmp r11, r9
jne 0x1401a0ef0
and rax, r8
ret
lea rax, [rdx - 1]
not rdx
and rax, rdx
sar rax, 0x3f
ret
mov r8, 0xffffffffffffffff
jmp 0x1401a0f19

Function at 0x1401a0f90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov r9, rdx
xor edx, edx
cmp rax, r9
sbb rdx, 0
mov r10, rdx
and r10d, 1
sub r10, 1
mov rax, r10
not r10
sar rax, 0x3f
cmp r8, 1
je 0x1401a0ffc
lea r9, [rcx + 8]
lea r11, [rcx + r8*8]
mov rax, 0xffffffffffffffff
nop dword [rax]
mov rcx, qword [r9]
mov r8, rax
add r9, 8
mov rdx, rcx
sub rcx, 1
not rdx
and rdx, rcx
sar rdx, 0x3f
xor rdx, rax
and rdx, r8
xor rax, rdx
cmp r11, r9
jne 0x1401a0fd0
xor rax, r10
mov rdx, r10
and rax, rdx
xor rax, r10
ret
Function at 0x1401a3290
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r13, rcx
mov rbp, r8
test rbx, rbx
je 0x1401a33e0
cmp rbx, rdx
jne 0x1401a33e0
lea rdx, [rbx + rbx]
xor eax, eax
cmp rdx, r9
jne 0x1401a33cd
mov rax, qword [rsp + 0xa0]
mov r15, r8
xor r14d, r14d
xor esi, esi
mov r12, qword [rax]
nop word [rax + rax]
mov r8, qword [r15]
mov rcx, r15
mov rdx, rdi
mov r9, rbx
imul r8, r12
call fcn.1401a3440
mov rcx, qword [r15 + rbx*8]
xor edx, edx
add rax, rsi
add rax, rcx
cmp rcx, rax
mov qword [r15 + rbx*8], rax
setne dl
or rdx, rsi
xor esi, esi
cmp rcx, rax
setae sil
add r14, 1
add r15, 8
and rsi, rdx
cmp r14, rbx
jb 0x1401a32f0
lea rcx, [rbp + rbx*8]
mov r8, qword [rdi]
mov rax, qword [rcx]
mov rdx, rax
sub rdx, r8
mov qword [r13], rdx
xor edx, edx
cmp rax, r8
sbb rdx, 0
and edx, 1
cmp rbx, 1
je 0x1401a3392
mov eax, 1
nop dword [rax + rax]
mov r8, qword [rcx + rax*8]
xor r9d, r9d
sub r8, qword [rdi + rax*8]
sbb r9, 0
sub r8, rdx
sbb r9, 0
mov qword [r13 + rax*8], r8
add rax, 1
mov rdx, r9
and edx, 1
cmp rbx, rax
jne 0x1401a3368
xor eax, eax
sub rsi, rdx
nop word [rax + rax]
mov r8, qword [r13 + rax*8]
mov rdx, qword [rcx + rax*8]
xor rdx, r8
and rdx, rsi
xor rdx, r8
mov qword [r13 + rax*8], rdx
mov qword [rcx + rax*8], 0
add rax, 1
cmp rax, rbx
jb 0x1401a33a0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1401a33cd

Function at 0x1401a33f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10d, 0x40
xor eax, eax
mov r8d, 1
movabs rbx, 0x8000000000000000
nop dword [rax]
mov rdx, r8
mov r11, rcx
shr rax, 1
and edx, 1
neg rdx
and r11, rdx
and rdx, rbx
mov r9, r11
add rax, rdx
xor r9, r8
and r8, r11
shr r9, 1
add r8, r9
sub r10, 1
jne 0x1401a3410
pop rbx
ret
Function at 0x1401ad3b0
Capabilities:
Encrypt data using curve25519

Disassembly:
movzx eax, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
ret
Function at 0x140025fa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm10, xmmword [rdx]
pxor xmm10, xmm0
movdqa xmm3, xmmword [rdx + 0x10]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x20]
pxor xmm4, xmm0
movdqa xmm5, xmmword [rdx + 0x30]
pxor xmm5, xmm0
movdqa xmm2, xmmword [rdx + 0x40]
pxor xmm2, xmm0
movdqa xmm6, xmmword [rdx + 0x50]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x60]
pxor xmm7, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
aesenc xmm10, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm5, xmm9
aesenc xmm2, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm0, xmm9
aesenc xmm10, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm1, xmmword [rcx + 0x40]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x50]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x60]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x80]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x90]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0xa0]
aesenclast xmm10, xmm1
aesenclast xmm3, xmm1
movdqa xmmword [rdx], xmm10
movdqa xmmword [rdx + 0x10], xmm3
aesenclast xmm4, xmm1
movdqa xmmword [rdx + 0x20], xmm4
aesenclast xmm5, xmm1
movdqa xmmword [rdx + 0x30], xmm5
aesenclast xmm2, xmm1
aesenclast xmm6, xmm1
movdqa xmmword [rdx + 0x40], xmm2
movdqa xmmword [rdx + 0x50], xmm6
aesenclast xmm7, xmm1
movdqa xmmword [rdx + 0x60], xmm7
aesenclast xmm0, xmm1
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140026e00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14002c7d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x14002c860
jmp 0x14002c84f
jae 0x14002c91e
cmp r8, 0x201
jae 0x14002c860
mov r14d, 0x200
lea rbx, [rbp - 0x58]
mov rsi, r8
jmp 0x14002c8b7
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x14002c88f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.140045860
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r12, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov r14, rdi
mov rbx, qword [rbp + 0x3e8]
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x14002c8df
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002c986
mov r8d, r15d
cmp rsi, r8
jne 0x14002c840
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002c9a9
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x14002c84f
jmp 0x14002c860
cmp r14, r8
jb 0x14002c9c3
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.14002f340
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x14002c96f
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.140027af0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x14002c957
jmp 0x14002c96f
lea rcx, [0x140047a63]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140046400
jmp 0x14002c9d8
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140046660
ud2
Function at 0x14002fc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14002fc73
test ecx, ecx
jne 0x14002fcc2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x14002fc80
test ecx, ecx
jne 0x14002fcc2
mov rcx, rdi
call fcn.14002fb20
movzx r10d, al
test bl, bl
jne 0x14002fcc9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14002fcb6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14002fe3c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14002fcb6.2
xor r10d, r10d
test bl, bl
je 0x14002fc90
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14002fe1e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14002fcfb
xor edi, edi
jmp 0x14002fd78
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14002fd40
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14002fd5b
inc rsi
dec rax
cmp rsi, 1
jne 0x14002fd20
jmp 0x14002fd78
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14002fd5b
cmp ebx, 0x5c
je 0x14002fd5b
inc rsi
dec rax
cmp rsi, 1
jne 0x14002fd40
jmp 0x14002fd78
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14002fe2c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14002fda2
mov al, 9
cmp rdx, 2
je 0x14002fda6
cmp rdx, 1
jne 0x14002fdb6
cmp byte [r9], 0x2e
jne 0x14002fdb6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14002fdb6
mov al, 0xa
jmp 0x14002fdb6
cmp byte [r9], 0x2e
jne 0x14002fdb6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14002fcb6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14002fcb6.2
mov esi, 2
jmp case.0x14002fcb6.2
lea r8, str.library_std_srcpath.rs
call fcn.140046650
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140046650
ud2
Function at 0x140043600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14004367a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140043670
cmp r10, rax
jb 0x14004370d
cmp r10, rdx
ja 0x140043721
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140043672
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140043650
jmp 0x1400436e2
ja 0x14004367a
mov rax, r10
cmp r11, r8
jne 0x140043620
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400436e6
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x1400436c0
mov rsi, rbx
sub ecx, edi
jns 0x1400436d9
jmp 0x1400436e8
cmp rbx, rdx
je 0x1400436f3
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x1400436e8
xor al, 1
cmp rsi, rdx
jne 0x1400436a0
jmp 0x1400436e8
xor eax, eax
jmp 0x1400436e8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140046400
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140046670
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140046660
ud2
Function at 0x12b4f80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x12b4f8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x12b4f9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x12b4f85
lea eax, [rcx + 1]
jmp 0x12b4fab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x12b4fbe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x12b4fa4
sub eax, 3
jb 0x12b4fde
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x12b502d
sar eax, 1
movsxd rbp, eax
jb 0x12b5014
jmp 0x12b4fec
add ebx, ebx
jne 0x12b4fea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x12b5014
inc ecx
add ebx, ebx
jne 0x12b4ffa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x12b5014
call r11
adc ecx, ecx
add ebx, ebx
jne 0x12b500d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x12b4ffc
add ecx, 2
jmp 0x12b5019
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.012b4f42
jmp 0x12b4f8d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xeaa000]
mov eax, dword [rdi]
or eax, eax
je 0x12b5089
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xeb5000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x12b5039
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x12b5083
mov qword [rbx], rax
add rbx, 8
jmp 0x12b5059
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x12b50cd
cmp al, 0xef
ja 0x12b50b5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x12b5095
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x12b50a4
mov eax, dword [rdi]
add rdi, 4
jmp 0x12b50a4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x12b5121
sub rsp, 0xffffffffffffff80
jmp 0x46e000
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sbb byte [rcx - 0x5a216ce4], cl
pop rcx
pop rsp
mov ebp, 0xb2f47857
invalid
js 0x14003f5a6
mov dl, 0xce
xchg ebp, eax
mov dl, 0x9b
push rsi
invalid
adc eax, 0x35ff866d
xchg ecx, eax
pop rdx
js 0x14003f5b0
fldenv [rbp - 0x5a]
invalid
cdq
adc cl, bl
mov dword [rdx - 0x72db740d], edx
push rdx
movsd dword [rdi], dword [rsi]
sbb eax, 0x638d7583
cmp al, 0x77
div dword [0x13761cf42]
enter 0xffffffffffffd17f, 0xffffffffffffffce
jp 0x14003f69a
mov esp, dword [rcx*4 - 0x7ce25aae]
jne 0x14003f5c8
invalid
clc
insb byte [rdi], dx
add dword [rcx], 0x52
ror esi, cl
retf
cmp al, 0xaa
jnp 0x14003f689
ja 0x14003f695
invalid
movabs eax, dword fs:[0x129ee40fb57bcecf]
push 0xffffffffffffffcb
jnp 0x14003f631
pmulhuw mm3, qword [rsi + 0x6bcb6a12]
outsd dx, dword [rsi]
test al, 0x68
invalid
sahf
adc ch, byte [rdx - 0x35]
imul ebp, dword [rdi - 0x58], 0x68
invalid
xor al, 0x74
or al, 0x2a
cmpsb byte [rsi], byte [rdi]
invalid
sub ah, byte [rsi + 0x346409d4]
loop 0x14003f6d3
cwde
loope 0x14003f6dd
and al, 0xa9
xchg edi, eax
rol eax, 1
jle 0x14003f703
test eax, 0x7ec0d197
push 0x457f60d6
push 0xffffffff81f0a154
lodsd eax, dword [rsi]
sub ch, byte [rcx]
pop rsp
invalid
je 0x14003f62c
mov eax, 0x79a61ec8
jns 0x14003f68d
cwde
sub eax, 0x848c1e53
invalid
xchg ebp, eax
add esi, esi
xor dword [rbx], edx
in eax, 0x25
je 0x14003f67e
jmp 0x14003f709
jno 0x14003f6de
cdq
invalid
pushfq
jae 0x14003f67a
sal cl, cl
push qword [rdi - 0xa9a437c]
cmc
xor eax, 0xa77cecb
mov eax, 0x6e3cdea0
cmp al, 0x6e
pop rdi
or eax, 0x777825a3
and eax, 0xa657778
invalid
invalid
invalid
shr dword [rdx + rsi*4 + 0x27], cl
jmp 0x14003f70b
int1
sbb dword [rax + 0x47bebe60], ebp
pop rdx
mov cl, 8
mov ebp, 0xfee26dc2
test al, 0x60
mov esi, 0xb15a47be
or byte [rbp - 0x11d923e], bh
invalid