joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030030
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov r12, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov edi, 4
test rsi, rsi
mov qword [rbp - 0x10], rcx
je 0x1400300a2
mov rax, rsi
shr rax, 0x3d
jne 0x1400301e1
lea r15, [rsi*4]
test r15, r15
je 0x1400300a2
movzx eax, byte [0x1401b9201]
mov edx, 4
mov rcx, r15
call fcn.140003470
test rax, rax
je 0x1400301e8
mov rdi, rax
jmp 0x1400300a5
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [rbx + 0x30]
movzx ecx, byte [rbx + 0x158]
shr r8, cl
test r8, r8
je 0x140030141
xor eax, eax
jmp 0x1400300e8
inc rax
cmp rax, r8
je 0x140030141
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x1400301bc
mov edx, dword [rdi + rax*4]
cmp edx, r9d
je 0x1400300e0
nop word [rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x1400301a8
mov edx, dword [rdi + rdx*4]
cmp edx, r9d
jne 0x140030110
mov rdx, qword [r12 + 0x10]
cmp rax, rdx
jae 0x1400301d0
mov rcx, qword [r12]
mov dword [rcx + rax*4], r10d
jmp 0x1400300e0
lea r8, [r12 + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.140021360
test rsi, rsi
je 0x14003016b
shl rsi, 2
mov r8d, 4
mov rcx, rdi
mov rdx, rsi
call fcn.140003480
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140030198
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140003480
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rdx
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400301f5
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rsi
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400301f5
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rax
call fcn.14011ec00
jmp 0x1400301f5
call fcn.14010fa10
jmp 0x1400301f5
mov ecx, 4
mov rdx, r15
call fcn.14011e970
ud2
Function at 0x140077a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
cmp edx, 0x1ff
jg 0x140077aaa
dec edx
cmp edx, 0x3f
ja case.0x140077a38.64
lea rax, [0x14012cf3c]
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
movzx eax, byte [rcx]
test rax, rax
je 0x140077a7a
lea ecx, [rax - 1]
mov edx, 1
xor r9d, r9d
shld r9, rdx, cl
mov r10d, ecx
shr r10b, 7
movzx r10d, r10b
xor r11d, r11d
shl rdx, cl
test cl, 0x40
cmovne r9, rdx
cmovne rdx, r11
shl r10, 4
or qword [r8 + r10], rdx
or qword [r8 + r10 + 8], r9
mov r10d, eax
shr r10d, 7
mov edx, 1
xor r9d, r9d
mov ecx, eax
shld r9, rdx, cl
shl rdx, cl
xor ecx, ecx
test al, 0x40
cmovne r9, rdx
cmovne rdx, rcx
shl r10, 4
add r8, r10
jmp 0x140077bf1
cmp edx, 0x1fff
jle 0x140077aca
cmp edx, 0x7fff
jle case.0x140077a38.64
cmp edx, 0x8000
je case.0x140077a38.64
cmp edx, 0x20000
jmp case.0x140077a38.64
cmp edx, 0x7ff
xor edx, edx
lea r9, [0x14012cae8]
mov r10d, 1
xor ecx, ecx
movzx r11d, cx
cmp r11d, 0x100
mov esi, 0xff
cmovae esi, r11d
lea eax, [r11 - 1]
neg esi
nop dword [rax + rax]
lea edi, [rsi + rax]
cmp di, 0xffff
je 0x140077ba7
lea edi, [rax + 2]
cmp byte [r11 + r9], 0
movzx edi, dil
sete bl
cmp byte [rdi + r9], 0
setne dil
xor dil, bl
inc eax
test dil, dil
jne 0x140077b00
test cl, cl
je 0x140077b64
dec cl
xor r11d, r11d
shld r11, r10, cl
mov ebx, ecx
shr bl, 7
movzx esi, bl
mov edi, 1
shl rdi, cl
test cl, 0x40
cmovne r11, rdi
cmovne rdi, rdx
shl rsi, 4
or qword [r8 + rsi], rdi
or qword [r8 + rsi + 8], r11
xor r11d, r11d
mov ecx, eax
shld r11, r10, cl
shr cl, 7
movzx esi, cl
mov edi, 1
mov ecx, eax
shl rdi, cl
test al, 0x40
cmovne r11, rdi
cmovne rdi, rdx
shl rsi, 4
or qword [r8 + rsi], rdi
or qword [r8 + rsi + 8], r11
lea ecx, [rax + 1]
movzx eax, ax
cmp eax, 0xff
jb 0x140077ae1
jmp case.0x140077a38.1
test cl, cl
je 0x140077be1
dec cl
mov eax, 1
xor edx, edx
shld rdx, rax, cl
mov r9d, ecx
shr r9b, 7
movzx r9d, r9b
xor r10d, r10d
shl rax, cl
test cl, 0x40
cmovne rdx, rax
cmovne rax, r10
shl r9, 4
or qword [r8 + r9], rax
or qword [r8 + r9 + 8], rdx
add r8, 0x10
movabs r9, 0x8000000000000000
xor edx, edx
or qword [r8], rdx
or qword [r8 + 8], r9
pop rbx
pop rdi
pop rsi
ret
mov edx, 0x3600
xor r9d, r9d
jmp 0x140077bf1
ud2
Function at 0x140082150
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r14, rdx
mov r12, rcx
mov rdi, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov ebx, 4
test rsi, rsi
je 0x1400821be
mov rax, rsi
shr rax, 0x3d
jne 0x1400823a4
lea r15, [rsi*4]
test r15, r15
je 0x1400821be
movzx eax, byte [0x1401b9201]
mov edx, 4
mov rcx, r15
call fcn.140003470
test rax, rax
je 0x1400823af
mov rbx, rax
jmp 0x1400821c1
xor r15d, r15d
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [r14 + 0x10]
test r8, r8
je 0x1400822f0
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
xor eax, eax
jmp 0x14008220c
mov dword [rdi + rax*4], r10d
inc rax
cmp rax, r8
je 0x140082269
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x140082374
mov edx, dword [rbx + rax*4]
cmp edx, r9d
je 0x140082204
nop word cs:[rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x140082344
mov edx, dword [rbx + rdx*4]
cmp edx, r9d
jne 0x140082230
cmp rax, rsi
jb 0x140082200
mov qword [rbp - 0x10], r12
lea r8, [0x14012e020]
mov rcx, rax
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400823c0
test r8, r8
je 0x1400822f0
mov rdx, qword [r14]
imul r8, r8, 0x38
add r8, rdx
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
jmp 0x140082299
add rdx, 0x38
cmp rdx, r8
je 0x1400822f5
mov eax, dword [rdx + 0x30]
shr rax, cl
cmp rax, rsi
jae 0x14008238c
mov eax, dword [rdi + rax*4]
mov dword [rdx + 0x30], eax
mov r9, qword [rdx + 0x10]
test r9, r9
je 0x140082290
mov r10, qword [rdx]
shl r9, 3
xor r11d, r11d
nop word cs:[rax + rax]
mov eax, dword [r10 + r11 + 4]
shr rax, cl
cmp rax, rsi
jae 0x14008235c
mov eax, dword [rdi + rax*4]
mov dword [r10 + r11 + 4], eax
add r11, 8
cmp r9, r11
jne 0x1400822d0
jmp 0x140082290
test rsi, rsi
je 0x14008230a
shl rsi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rsi
call fcn.140003480
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x140082334
shl rdx, 2
mov r8d, 4
mov rcx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140003480
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x10], r12
lea r8, [0x14012e008]
mov rcx, rdx
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400823c0
mov qword [rbp - 0x10], r12
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.0.1_srcutil_remapper.rs
mov rcx, rax
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400823c0
mov qword [rbp - 0x10], r12
lea r8, [0x14012dff0]
mov rcx, rsi
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400823c0
mov qword [rbp - 0x10], r12
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.0.1_srcutil_remapper.rs
mov rcx, rax
mov rdx, rsi
call fcn.14011ec00
jmp 0x1400823c0
mov qword [rbp - 0x10], r12
call fcn.14010fa10
jmp 0x1400823c0
mov qword [rbp - 0x10], r12
mov ecx, 4
mov rdx, r15
call fcn.14011e970
ud2
Function at 0x1400c9c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400b8a90
cmp eax, 0x5c
jne 0x1400c9c90
mov rcx, rsi
mov rdx, rdi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.1400c5cc0
mov r14, qword [rdi]
mov rbx, qword [r14 + 0xa0]
mov rcx, rdi
call fcn.1400b8a90
mov ecx, 1
cmp eax, 0x80
jb 0x1400c9cc8
mov ecx, 2
cmp eax, 0x800
jb 0x1400c9cc8
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rbx, rcx
jb 0x1400c9d92
mov r15, qword [r14 + 0xb0]
inc r15
je 0x1400c9dac
mov r12, qword [r14 + 0xa8]
add r14, 0xa0
mov rcx, rdi
call fcn.1400b8a90
xor ecx, ecx
cmp eax, 0xa
sete cl
mov eax, 1
cmove r15, rax
add rcx, r12
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], r15
mov rcx, rdi
call fcn.1400b8a90
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x2c], 0
mov byte [rbp + 8], 2
mov rcx, rdi
call fcn.1400b8bc0
movaps xmm0, xmmword [rbp]
movups xmmword [rsi + 0x68], xmm0
movaps xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x58], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x48], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
movaps xmm2, xmmword [rbp - 0x40]
movaps xmm3, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x38], xmm3
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov dword [rsi], 0x22
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1401358e8]
lea r8, [0x1401359e8]
mov edx, 0x2b
call fcn.14011eb60
ud2
lea rcx, [0x1401358e8]
lea r8, [0x140135a00]
mov edx, 0x2b
call fcn.14011eb60
ud2
Function at 0x1400dc8c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401b9201]
mov ecx, 0x1818
mov edx, 4
call fcn.140003470
test rax, rax
je 0x1400dc9de
xor ecx, ecx
lea rdx, [0x14014bf78]
movdqa xmm0, xmmword [0x140129ba0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400dc910
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x303
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400deb40
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e60b0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.14011e970
ud2

Function at 0x1400dcb10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401b9201]
mov ecx, 0x200
mov edx, 4
call fcn.140003470
test rax, rax
je 0x1400dcc1d
xor ecx, ecx
lea rdx, [0x14014d7e0]
movdqa xmm0, xmmword [0x140129ba0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400dcb60
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400deb40
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e60b0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.14011e970
ud2
Function at 0x1400e1bd0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x1400e1c31
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x1400e1d74
mov rdi, rdx
movzx eax, byte [0x1401b9201]
mov edx, 4
mov rcx, rbx
call fcn.140003470
test rax, rax
je 0x1400e1d7b
cmp rbx, 0x80
jae 0x1400e1c3d
xor ecx, ecx
jmp 0x1400e1cda
xor ecx, ecx
mov eax, 4
jmp 0x1400e1d5c
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400e1cda
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400e1cda
lea rdx, [r14 - 1]
shr rdx, 0x3d
jne 0x1400e1cda
mov rcx, r14
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x140129ba0]
nop
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400e1c80
cmp r14, rcx
je 0x1400e1d59
mov rdx, rcx
or rdx, 1
test bl, 8
je 0x1400e1d09
mov r8d, dword [rdi + rcx*8]
mov r9d, dword [rdi + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp r14, rdx
je 0x1400e1d59
nop
mov edx, dword [rdi + rcx*8]
mov r8d, dword [rdi + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [rdi + rcx*8 + 8]
mov r8d, dword [rdi + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp r14, rcx
jne 0x1400e1d10
mov rcx, r14
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14010fa10
ud2
mov ecx, 4
mov rdx, rbx
call fcn.14011e970
ud2
Function at 0x1400f07e0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400f0870
jmp 0x1400f085f
jae 0x1400f0930
cmp r8, 0x201
jae 0x1400f0870
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400f08c8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400f089f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14011d8f0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400f08f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400f0998
mov r8d, r14d
cmp r15, r8
jne 0x1400f0850
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400f09bb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400f085f
jmp 0x1400f0870
cmp rsi, r8
jb 0x1400f09d5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400f4e70
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400f0981
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140003480
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400f0969
jmp 0x1400f0981
lea rcx, [0x14018df08]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14011eb60
jmp 0x1400f09ea
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14011ef90
ud2
Function at 0x1400f7790
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsp
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0x98], 0xfffffffffffffffe
mov rsi, rdx
invalid
mov r14, rcx
mov rcx, qword [rdx + 8]
cmp qword [rdx], 0
cmp dword [rdx], 0
mov qword [rdx], 0
je 0x1400f77da
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp], 1
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x70], 1
add byte [rax], al
movups xmmword [rbp + 0x78], xmm0
mov r8, qword [rsi + 0x18]
cmp qword [rsi + 0x10], 0
mov rax, qword [rsi + 0x20]
and byte [rax - 0x39], r9b
adc byte [rax], r8b
add byte [rax], al
add byte [rax - 0x75], cl
mov ecx, dword [rsi + 0x28]
mov qword [rbp + 0x90], rcx
mov qword [rsi + 0x20], 0
je 0x1400f7886
mov qword [rbp + 0x88], rsi
test rax, rax
je 0x1400f7c5e
mov rdx, rbp
lea r9, [rbp + 0x70]
mov rcx, r8
mov r8, qword [rbp + 0x90]
nop
add byte [rax], al
invalid
call fcn.1400fff60
test rax, rax
mov rsi, qword [rbp + 0x88]
add byte [rax], al
invalid
je 0x1400f7cbe
mov qword [rbp + 0x40], rax
lea rax, str.library_std_srcprocess.rs
add eax, 0x97a50
mov qword [rsp + 0x20], rax
lea rcx, [0x14018db98]
lea r9, fcn.1400ea4c0
lea r8, [rbp + 0x40]
mov edx, 0x2b
call fcn.14011ee90
jmp 0x1400f7e60
test rax, rax
je 0x1400f7cbe
invalid
add al, 0
invalid
mov qword [rbp - 0x28], r14
mov qword [rbp + 0x88], rsi
mov r15d, 1
xor r12d, r12d
xorps xmm6, xmm6
mov rsi, qword [sym.imp.KERNEL32.dll_SleepEx]
add byte [rcx], dh
invalid
xor edi, edi
invalid
jmp case.0x1400f6fce.37
mov qword [rbp + 0x90], r8
mov qword [rbp - 0x20], r8
lea rcx, [rbp + 0x40]
lea rdx, [rbp - 0x20]
mov r8, rbp
call fcn.1400ff890
cmp qword [rbp + 0x40], 0
jne 0x1400f7e1a
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp + 0x88]
jmp 0x1400f7cbe
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x50], rax
lea rax, str.library_std_srcprocess.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x14018db98]
lea r9, fcn.1400ea4c0
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.14011ee90
jmp 0x1400f7e60
Function at 0x1400f9080
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.140117e00
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov rbx, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xfec], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r14, [rbp + 0xfec]
mov qword [rbp + 0xfc8], r14
lea r15, [0x1400fff40]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xfb0]
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x1400f9271
mov r12, qword [sym.imp.KERNEL32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], rbx
mov ecx, 0xffffffff
mov edx, 1
call r12
cmp dword [rbp + 0xfec], 0
je 0x1400f9147
cmp dword [rbp + 0xff0], 0
jne 0x1400f9286
mov eax, dword [rbp + 0xff4]
test rax, rax
je 0x1400f9286
cmp eax, 0x1000
ja 0x1400f92d1
xor ebx, ebx
nop word cs:[rax + rax]
cmp rbx, rax
ja 0x1400f92b6
lea rdx, [rbx + rbp]
add rdx, 0xffffffffffffffb0
mov rdi, rax
mov r8d, eax
sub r8d, ebx
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r14
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call r13
test eax, eax
je 0x1400f9279
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r12
cmp dword [rbp + 0xfec], 0
je 0x1400f91f0
cmp dword [rbp + 0xff0], 0
jne 0x1400f927f
mov eax, dword [rbp + 0xff4]
add rbx, rax
mov rax, rdi
cmp rbx, rdi
jne 0x1400f9190
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r14
mov qword [rsp + 0x20], r15
mov rbx, qword [rbp + 0xfe0]
mov rcx, rbx
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x1400f9147
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400f9286
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rbx
mov qword [rbp + 0xfd0], rax
mov rdx, rax
call fcn.14011f000
jmp 0x1400f92ec
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov qword [rbp + 0xfd0], rax
mov rcx, rax
call fcn.14011ef90
ud2