joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003881c
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034b54]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14003500c]
mov qword [rsp + 0x78], rax
lea rax, [0x140041888]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x1400388d4
lea rdx, str._n_n_notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028d50
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x1400418a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004a8f0], rax
mov edx, 5
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140041878]
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14004a8f0]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140039628
Capabilities:
Create thread
Execute command
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140049ac0]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, str.updated_by_discord.gg_enigmasolutions
call fcn.14003980c
lea rcx, str.color_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400417d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x40], rax
call fcn.14003383c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034444]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140036f14
lea rdx, [0x140038664]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x1400417dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400417e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400417e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1400417e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14004a350], 0
jne 0x14003976e
lea rdx, str.Fortnite
lea rcx, [rsp + 0x68]
call fcn.14002b19c
lea rcx, [rsp + 0x68]
call fcn.140036908
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14004a350], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003972a
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rdx, [0x140041800]
mov rcx, qword [rsp + 0x30]
call fcn.14002b860
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140035778
mov dword [0x14004a358], eax
xor edx, edx
mov rcx, qword [0x14004a830]
call fcn.1400335bc
movzx eax, al
test eax, eax
je 0x1400397df
mov edx, dword [0x14004a358]
mov rcx, qword [0x14004a830]
call fcn.14002cf60
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x14004a830]
call fcn.14003301c
mov qword [0x14004a348], rax
call fcn.14003881c
call fcn.1400389a8
call fcn.1400391a8
call fcn.140039510
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140039e10
add rsp, 0x88
ret
Function at 0x14003a510
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003a55a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003a55a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003a55a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003a55a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003a55a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003a55c
xor al, al
add rsp, 0x28
ret
Function at 0x1400154e0
Capabilities:
Inspect section memory permissions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov ebx, dword [rcx + 0x19c]
mov edi, ebx
and edi, 0xfffffeff
mov dword [rcx + 0x19c], edi
xor edx, edx
mov al, 1
lock cmpxchg byte [rcx], dl
jne 0x14001551c
mov ecx, ebx
mov rdx, rsi
mov r8d, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400236d0
xor edx, edx
call fcn.14004b670
jmp 0x140015508
Function at 0x140022750
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov bpl, 1
call fcn.1400228c0
test al, al
je 0x140022775
mov ecx, 0xa5
call sub.USER32.dll_GetKeyState
test ax, ax
setns bpl
mov ecx, 0x10
call sub.USER32.dll_GetKeyState
movzx esi, ax
shr esi, 0xf
lea edi, [rsi*4]
mov ecx, 0x11
call sub.USER32.dll_GetKeyState
lea ebx, [rsi*4 + 0x20]
test bpl, bpl
cmove ebx, edi
test ax, ax
cmovns ebx, edi
lea esi, [rbx + 0x100]
test bpl, bpl
cmove esi, ebx
mov ecx, 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
cmovns esi, ebx
mov ecx, 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x1400227eb
mov ecx, 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x1400227eb
and esi, 0xf7ff
jmp 0x1400227f1
or esi, 0x800
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140022800
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov ecx, 0x100
mov edx, 1
call fcn.140015560
test rax, rax
je 0x140022874
mov rdi, rax
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [0x140051800]
movups xmmword [rbp - 0x18], xmm0
mov rcx, rax
call sub.USER32.dll_GetKeyboardState
mov rax, rdi
add rax, 0x100
mov qword [rsi], rdi
mov qword [rsi + 8], 0x100
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], 0
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x100
mov edx, 1
call fcn.14004ca10
ud2
Function at 0x140023310
Capabilities:
Log keystrokes

Disassembly:
push rsi
sub rsp, 0x20
mov eax, edx
shr eax, 0x10
movzx eax, al
xor r8d, r8d
test edx, 0x1000000
mov esi, 0xe000
cmove esi, r8d
or esi, eax
cmp ecx, 0x10
je 0x140023357
cmp ecx, 0x11
je 0x140023367
cmp ecx, 0x12
jne 0x14002337b
and edx, 0x1000000
cmp rdx, 1
mov ecx, 0xa5
sbb ecx, 0
jmp 0x1400233d9
mov ecx, esi
mov edx, 3
call sub.USER32.dll_MapVirtualKeyA
mov ecx, eax
jmp 0x1400233d9
and edx, 0x1000000
cmp rdx, 1
mov ecx, 0xa3
sbb ecx, 0
jmp 0x1400233d9
cmp si, 0x44
jg 0x140023394
movzx eax, si
cmp eax, 0xe01d
je 0x1400233ac
cmp eax, 0xe046
je 0x1400233cf
jmp 0x1400233d9
cmp si, 0x45
je 0x1400233bd
cmp si, 0x46
jne 0x1400233d9
mov esi, 0x46
mov ecx, 0x91
jmp 0x1400233d9
mov esi, 0xe01d
cmp ecx, 0x13
jne 0x1400233d9
mov edx, 0xa4
jmp 0x1400233e0
cmp ecx, 0x13
je 0x1400233cf
mov esi, 0x45
cmp ecx, 0xff
jne 0x1400233d9
mov esi, 0xe059
mov ecx, 0x13
call fcn.140022c30
mov edx, eax
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x1400233f0
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0xa3
add ecx, 0xfffffff8
cmp ecx, 0xda
ja case.0x140022c52.10
lea rdx, [0x140022fa4]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, 0x4a
ret
mov eax, 0x92
ret
mov eax, 0x4b
ret
mov eax, 0x3f
ret
mov eax, 0x6b
ret
mov eax, 0x71
ret
mov eax, 0x72
ret
mov eax, 0x24
ret
mov eax, 0x6e
ret
mov eax, 0x81
ret
mov eax, 0x4c
ret
mov eax, 0x45
ret
mov eax, 0x44
ret
mov eax, 0x43
ret
mov eax, 0x41
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x3d
ret
mov eax, 0x40
ret
mov eax, 0x42
ret
mov eax, 9
ret
xor eax, eax
ret
mov eax, 1
ret
mov eax, 2
ret
mov eax, 3
ret
mov eax, 4
ret
mov eax, 5
ret
mov eax, 6
ret
mov eax, 7
ret
mov eax, 8
ret
mov eax, 0xa
ret
mov eax, 0xb
ret
mov eax, 0xc
ret
mov eax, 0xd
ret
mov eax, 0xe
ret
mov eax, 0xf
ret
mov eax, 0x10
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x18
ret
mov eax, 0x19
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, 0x1c
ret
mov eax, 0x1d
ret
mov eax, 0x1e
ret
mov eax, 0x1f
ret
mov eax, 0x20
ret
mov eax, 0x21
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x77
ret
mov eax, 0x8c
ret
mov eax, 0x65
ret
mov eax, 0x8f
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x60
ret
mov eax, 0x5a
ret
mov eax, 0x61
ret
mov eax, 0x5c
ret
mov eax, 0x5b
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, 0x27
ret
mov eax, 0x28
ret
mov eax, 0x29
ret
mov eax, 0x2a
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x4f
ret
mov eax, 0x3e
ret
mov eax, 0x76
ret
mov eax, 0x8b
ret
mov eax, 0x75
ret
mov eax, 0x8a
ret
mov eax, 0x73
ret
mov eax, 0x88
ret
mov eax, 0x7f
ret
mov eax, 0x7e
ret
mov eax, 0x9c
ret
mov eax, 0x9e
ret
mov eax, 0x9d
ret
mov eax, 0x99
ret
mov eax, 0x9b
ret
mov eax, 0x7c
ret
mov eax, 0x95
ret
mov eax, 0x96
ret
mov eax, 0x80
ret
mov eax, 0x87
ret
mov eax, 0x7a
ret
mov eax, 0x84
ret
mov eax, 0x78
ret
mov eax, 0x79
ret
mov ecx, 0xba
jmp 0x1400233f0
mov eax, 0x6f
ret
mov eax, 0x6d
ret
mov eax, 0x7b
ret
mov eax, 0x83
ret
mov ecx, 0xbf
jmp 0x1400233f0
mov ecx, 0xc0
jmp 0x1400233f0
mov ecx, 0xdb
jmp 0x1400233f0
mov ecx, 0xdc
jmp 0x1400233f0
mov ecx, 0xdd
jmp 0x1400233f0
mov ecx, 0xde
jmp 0x1400233f0
mov eax, 0x82
ret
sub rsp, 0x28
mov edx, 2
call sub.USER32.dll_MapVirtualKeyA
mov ecx, eax
and ecx, 0x7fff
mov eax, 0xa3
add ecx, 0xffffffd9
cmp ecx, 0x39
ja case.0x140023421.40
lea rdx, [0x14002346c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, 0x64
add rsp, 0x28
ret
mov eax, 0x8e
add rsp, 0x28
ret
mov eax, 0x8d
add rsp, 0x28
ret
mov eax, 0x74
add rsp, 0x28
ret
mov eax, 0x89
add rsp, 0x28
ret
mov eax, 0x70
add rsp, 0x28
ret
mov eax, 0x69
add rsp, 0x28
ret
Function at 0x140023620
Capabilities:
Inspect section memory permissions

Disassembly:
push rsi
push rdi
mov edx, ecx
and edx, 1
neg edx
and edx, 0x50000
mov eax, ecx
and eax, 2
lea r9d, [rdx + 0xc20000]
test eax, eax
cmove r9d, edx
shl eax, 7
mov r10d, ecx
and r10d, 4
shl r10d, 0x1a
mov edx, ecx
and edx, 8
shl edx, 0xf
or edx, eax
mov r11d, ecx
shr r11d, 1
and r11d, 8
or r11d, edx
mov edi, ecx
shl edi, 0x10
mov r8d, edi
and r8d, 0x200000
mov edx, ecx
shl edx, 0x17
and edx, 0x40000000
or edx, r10d
mov eax, ecx
shl eax, 0x11
mov esi, eax
and esi, 0x80000000
or esi, edx
and eax, 0x20000000
or eax, esi
and edi, 0x1000000
or edi, eax
lea edx, [r9 + rdi]
add edx, 0x6080000
mov eax, edx
and eax, 0xff30ffff
test ecx, 0x2200
cmove eax, edx
lea edx, [r8 + r11]
add edx, 0x10
pop rdi
pop rsi
ret
Function at 0x14002b480
Capabilities:
Log keystrokes

Disassembly:
push rsi
sub rsp, 0x70
mov rsi, rcx
mov ecx, 0x12
xor edx, edx
call sub.USER32.dll_MapVirtualKeyW
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 1
mov word [rsp + 0x28], 0xa4
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov dword [rsp + 0x48], 1
mov word [rsp + 0x50], 0xa4
mov word [rsp + 0x52], ax
mov dword [rsp + 0x54], 3
lea rdx, [rsp + 0x20]
mov ecx, 2
mov r8d, 0x28
call sub.USER32.dll_SendInput
mov rcx, rsi
call sub.USER32.dll_SetForegroundWindow
nop
add rsp, 0x70
pop rsi
ret

Function at 0x140030430
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140030461
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140030488
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x1400304bd
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x1400668e0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x78], 1
movups xmmword [rax + 0x80], xmm0
lea rax, [rax + 0x80]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140031ef0]
mov qword [rbp - 0x28], rax
lea rax, str.couldnt_generate_random_bytes:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14004cba0
ud2
mov eax, dword [0x1400668e0]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x78], 0
je 0x1400388e8
mov eax, dword [0x1400668e0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x80]
ret
jmp 0x140030430
Function at 0x140030c30
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140030cb2
jmp 0x140030d00
mov rsi, r8
jae 0x140030d5d
cmp rsi, 0x201
jb 0x140030d00
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x140030cdd
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.14004c020
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x140030d0d
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x140030d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140030da5
mov r8d, edi
cmp rsi, r8
jne 0x140030ca0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140030e01
add rsi, rsi
cmp rsi, 0x201
jae 0x140030cb2
jmp 0x140030d00
cmp r14, r8
jb 0x140030e1b
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140033260
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x140030dd2
jmp 0x140030dea
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x140030dea
test r13, r13
je 0x140030dea
add rdx, rdx
je 0x140030dea
mov r8d, 2
mov rcx, r13
call fcn.140015540
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_code_rustc_fe5b13d681f25ee6474be29d748c65adcd91f69elibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14004ca30
jmp 0x140030e30
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14004cc90
ud2
Function at 0x1400388b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140030461
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140030488
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x1400304bd
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x1400668e0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x78], 1
movups xmmword [rax + 0x80], xmm0
lea rax, [rax + 0x80]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140031ef0]
mov qword [rbp - 0x28], rax
lea rax, str.couldnt_generate_random_bytes:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14004cba0
ud2
mov eax, dword [0x1400668e0]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x78], 0
je 0x1400388e8
mov eax, dword [0x1400668e0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x80]
ret
jmp 0x140030430

Function at 0x1400396b0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], r8
mov ecx, 0x10
mov edx, 8
call fcn.140015530
mov rsi, rax
test rax, rax
je 0x140039790
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140039820]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140039782
mov rcx, qword [rsi]
mov qword [rbp - 0x10], rsi
mov rax, qword [rsi + 8]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rax
call qword [rax]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140039759
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x18]
call fcn.140015540
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x10]
call fcn.140015540
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rsi
mov ecx, 0x10
mov edx, 8
call fcn.14004ca10
ud2
Function at 0x140047b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140047bda
mov r11, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [rdx + r8*2]
xor eax, eax
mov rbx, rdx
movzx edi, byte [rdx + 1]
add rdx, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140047bd0
cmp r10, rax
jb 0x140047c6d
cmp r10, r11
ja 0x140047c7a
add rax, r9
xor ebx, ebx
nop dword [rax + rax]
cmp rdi, rbx
je 0x140047bd2
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140047bb0
jmp 0x140047c42
ja 0x140047bda
mov rax, r10
cmp rdx, r8
jne 0x140047b7d
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140047c46
mov rbx, qword [rsp + 0x78]
add rdx, rbx
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop
lea rsi, [rbx + 1]
movzx edi, byte [rbx]
test dil, dil
js 0x140047c20
mov rbx, rsi
sub ecx, edi
jns 0x140047c39
jmp 0x140047c48
cmp rsi, rdx
je 0x140047c53
and edi, 0x7f
shl edi, 8
movzx ebp, byte [rbx + 1]
add rbx, 2
or edi, ebp
sub ecx, edi
js 0x140047c48
xor al, 1
cmp rbx, rdx
jne 0x140047c00
jmp 0x140047c48
xor eax, eax
jmp 0x140047c48
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x14005772e]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14004ca30
ud2
mov rcx, rax
mov rdx, r10
call fcn.14004cca0
ud2
mov rcx, r10
mov rdx, r11
call fcn.14004cc90
ud2

Function at 0x140049da8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140049df2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140049df2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140049df2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140049df2
cmp dword [rcx + 0x84], 0xe
jbe 0x140049df2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140049df4
xor al, al
add rsp, 0x28
ret
Function at 0x14004bca0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14004bd01
mov rsi, rax
lea rdx, [0x140053d31]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14004bd01
mov rbx, rax
lea rdx, [0x140053d3f]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14004bd01
mov rsi, rax
mov eax, 1
jmp 0x14004bd8d
lea rcx, str.ntdll.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14004be0d
mov rdi, rax
lea rdx, [0x140053d5d]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14004be0d
mov rbx, rax
lea rdx, [0x140053d70]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14004be0d
mov rsi, rax
lea rdx, [0x140053d84]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14004be0d
mov rdi, rax
lea rcx, [rbp - 0x30]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14004be0d
mov rbx, qword [rbp - 0x30]
mov qword [rbp - 0x20], rsi
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rdi
mov ecx, 0x20
mov edx, 8
call fcn.140015530
test rax, rax
je 0x14004be2f
mov rcx, rax
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor eax, eax
lock cmpxchg qword [0x140066730], rcx
je 0x14004be01
mov rsi, rax
mov qword [rbp - 8], rcx
cmp qword [rcx], 0
jne 0x14004bdea
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_CloseHandle
mov edx, 0x20
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.140015540
mov rcx, rsi
mov rax, rcx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x20], 0
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Rust.cargo_registry_srcgithub.com_1ecc6299db9ec823parking_lot_core_0.8.5_src_thread_parkerwindowsmod.rs
lea r8, [0x140053cf8]
mov edx, 0x5b
call fcn.14004bed0
jmp 0x14004be3e
mov ecx, 0x20
mov edx, 8
call fcn.14004ca10
ud2
Function at 0x140001900
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000194a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000194a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000194a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000194a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000194a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000194c
xor al, al
add rsp, 0x28
ret