joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400491c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14005ee50
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x140049346
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x140049280
jmp 0x14004926f
jae 0x140049358
cmp r8, 0x201
jae 0x140049280
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x1400492d8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400492af
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.140071500
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140049307
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004942b
mov r8d, esi
cmp r12, r8
jne 0x140049260
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140049455
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14004926f
jmp 0x140049280
lea rcx, [rbp - 0x58]
call fcn.140043040
mov byte [rsi + 0x18], 2
jmp 0x1400493ea
cmp r15, r8
jb 0x14004946f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.14004c520
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x1400493a9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140017b20
cmp byte [rbp + 0x3d8], 2
jne 0x140049401
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.140043040
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x1400493ea
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140017b20
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x1400493d5
jmp 0x1400493ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x140049391
jmp 0x1400493a9
lea rcx, str.internal_error:_entered_unreachable_code_bi
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140072050
jmp 0x140049484
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.140072540
ud2
Function at 0x140049820
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140049830
mov rcx, rdx
mov rdx, r8
jmp fcn.140049840
mov rcx, rdx
mov rdx, r8
jmp fcn.140053cd0

Function at 0x14004f030
Capabilities:
Terminate process

Disassembly:
jmp 0x14004f030
push rsi
push rdi
sub rsp, 0x38
mov rdi, qword [rcx + 0x30]
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14004f050
xor esi, esi
jmp 0x14004f0bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x14004f0b4
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14004f075
cmp eax, 0x102
je 0x14004f04c
jmp 0x14004f08f
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14004f04c
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.140043040
shl rsi, 0x20
or rsi, 2
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400501a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14006e270
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140057a60]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.140057520
cmp qword [rbp + 0xfe8], 0
jne 0x140050377
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x140050343
cmp r12, 0x1000
ja 0x140050399
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140050317
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x1400502c0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14005031d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140050300
jbe 0x140050270
jmp 0x140050385
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140050225
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.140043040
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.140043040
jmp 0x140050343
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.1400725c0
jmp 0x1400503ad
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.140072540
ud2
Function at 0x140053cd0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14005ee50
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x140053d87
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140056370
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x140053d87
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140053d5b
test rsi, rsi
je 0x140053d57
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.140017b20
xor esi, esi
jmp 0x140053d87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x140053d84
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.140017b20
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140054880
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x18]
call fcn.14005ee50
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
test rax, rax
je case.0x14004d897.119
fld dword [rax]
add byte [rax], al
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140056370
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
test rax, rax
Function at 0x140054e00
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140998d40]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140054e44
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140054ea3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140054eb2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140054eea
cmp eax, 0x103
je 0x140054ef4
test eax, eax
js 0x140054ecf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140054eea
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140998da8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14004c150
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140043650
mov ecx, 7
int 0x29
ud2

Function at 0x140054f60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140998d40]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140054fa4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14005500a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140055041
test eax, eax
js 0x14005501b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140055034
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140998da8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14004c150
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140043650
mov ecx, 7
int 0x29
ud2
Function at 0x140056b20
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x24], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 0x10], rax
nop

Function at 0x140057520
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
sub esp, 0x78

Function at 0x140057f20
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140058075
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140057f58
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140058038
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140058057
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140057fb9
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x140057feb
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x140057fef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x140057ff3
cmp eax, 0x6d
jne 0x14005801e
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x140057ff8
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x140058024
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140043040
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14005802e
cmp rax, 1
je 0x140057fa2
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x140057fac
mov r8d, 0x10
mov rcx, rbx
call fcn.1400715c0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140057f65
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400715c0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140057f65
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400714b0
ud2
Function at 0x14005cdd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14005ee50
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x40]

Function at 0x14005dd40
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14005dd78
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14005dd90
nop
add rsp, 0x38
ret

Function at 0x14005dd90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14005ddd3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, case.0x1400498ab.114
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140071fa0
ud2

Function at 0x14005e430
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1409b51c1]
mov ecx, 0x10
mov edx, 8
or byte [rax], al
add byte [rax], al
Function at 0x14006cf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14006cf7a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14006cf70
cmp r11, r10
ja 0x14006d013
cmp r10, rdx
ja 0x14006d027
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14006cf72
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14006cf50
jmp 0x14006cfe7
ja 0x14006cf7a
mov r11, r10
cmp rax, r8
jne 0x14006cf22
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14006cfeb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14006cfc0
mov r8, r10
sub ecx, r9d
jns 0x14006cfde
jmp 0x14006cfed
cmp r10, rdx
je 0x14006cff9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14006cfed
xor al, 1
cmp r8, rdx
jne 0x14006cfa0
jmp 0x14006cfed
xor eax, eax
jmp 0x14006cfed
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14099c129]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140072050
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400725c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140072540
ud2

Function at 0x14006e774
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006e7be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006e7be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006e7be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006e7be
cmp dword [rcx + 0x84], 0xe
jbe 0x14006e7be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006e7c0
xor al, al
add rsp, 0x28
ret
Function at 0x140070de0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140070e41
mov rdi, rax
lea rdx, [0x14099611e]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070e41
mov rsi, rax
lea rdx, [0x14099612c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070e41
mov rdi, rax
xor ebx, ebx
jmp 0x140070ec7
lea rcx, [0x1409960b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140070f3b
mov rsi, rax
lea rdx, [0x1409960c2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070f3b
mov rdi, rax
lea rdx, [0x1409960d5]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070f3b
mov rbx, rax
lea rdx, [0x1409960e9]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070f3b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x140070f3b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x1409b51c1]
mov ecx, 0x18
mov edx, 8
call fcn.140017b10
test rax, rax
je 0x140070f42
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x1409b51d8], rcx
je 0x140070f2f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x140070f18
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.140017b20
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.140070da0
ud2
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.140071e50
ud2
Function at 0x414be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414d59
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fca0
xorps xmm15, xmm15
mov r14, qword [0x006ba420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c50
mov rbx, qword [rsp + 0x60]
jmp 0x414c60
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x414c85
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x414c95
cmp rbx, 0x1000
jae 0x414c56
nop dword [rax]
jmp 0x414d09
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x414ca2
xor edx, edx
jmp 0x414d00
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fca0
xorps xmm15, xmm15
mov r14, qword [0x006ba420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x414c8b
jmp 0x414c74
call fcn.0045b480
xorps xmm15, xmm15
mov r14, qword [0x006ba420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x414d40
lea rax, [0x005755ef]
mov ebx, 0xd
call fcn.00431dc0
nop dword [rax]
cmp eax, 0x5af
je 0x414d28
lea rax, [0x005786e0]
mov ebx, 0x1f
call fcn.00431dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457d60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414be0
Function at 0x41d720
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d93a
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41d928
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x48]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x006ba232], 0
jne 0x41d861
cmp dword [0x006ba7f4], 0
nop
jle 0x41d7a9
movzx r13d, word [rdi + 0x34]
cmp r8, r13
jb 0x41d7a9
mov r8, qword [rdi + 0x40]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax]
test r12b, r8b
je 0x41d8d8
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41d85b
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41d8cb
lea r9, [0x0064c338]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x1040]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x1040]
test r10b, r8b
jne 0x41d840
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x41d882
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.00414800
test al, al
jne 0x41d8b8
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41d8a7
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41d8a7
jae 0x41d8be
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41d8b2
mov rbx, rax
mov rax, rsi
call fcn.00422f80
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.0045a040
mov rax, rdx
mov ecx, 0x40
call fcn.0045a060
lea rax, [0x00574afc]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041d9a0
lea rax, [0x00574a3f]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041d9a0
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf1], 2
lea rax, [0x005762a2]
mov ebx, 0x13
call fcn.00431dc0
lea rax, [0x0057911d]
mov ebx, 0x23
call fcn.00431dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00457d60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041d720