joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a4f20
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14024d070]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1401a4f6b
test r8, r8
je 0x1401a4fef
mov dword [r8], 6
xor al, al
jmp 0x1401a5107
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], eax
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 0x24]
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1401a4fb9
test rsi, rsi
je 0x1401a4fef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
xor al, al
jmp 0x1401a5107
mov eax, dword [rsp + 0x54]
cmp eax, 1
je 0x1401a4ff6
cmp eax, 3
je 0x1401a4fce
mov al, 1
jmp 0x1401a5107
lea r8, [rsp + 0x50]
mov edx, 3
mov rcx, r14
call fcn.1401a4dd0
test al, al
jne 0x1401a4ff6
test rsi, rsi
je 0x1401a4fef
mov dword [rsi], 0x5b4
xor al, al
jmp 0x1401a5107
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov rdi, r15
mov qword [rsp + 0x48], r15
mov rbx, qword [rbp]
mov rbp, qword [rbp + 8]
mov rax, qword [rsp + 0x40]
cmp rbx, rbp
je 0x1401a5064
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401a5026
mov rcx, qword [rbx]
mov qword [rsp + 0x30], rcx
cmp rax, rdi
je 0x1401a5042
mov qword [rax], rcx
add rax, 8
mov qword [rsp + 0x40], rax
add rbx, 0x20
jmp 0x1401a5014
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400926b0
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rbx, 0x20
jmp 0x1401a5014
mov rbx, qword [rsp + 0x38]
mov r8, rbx
cmp rbx, rax
cmove r8, r15
sub rax, rbx
sar rax, 3
mov edx, eax
mov rcx, qword [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1401a509c
test rsi, rsi
je 0x1401a50bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
xor sil, sil
jmp 0x1401a50cb
lea r8, [rsp + 0x50]
mov edx, 2
mov rcx, r14
call fcn.1401a4dd0
test al, al
jne 0x1401a50c2
test rsi, rsi
je 0x1401a50bd
mov dword [rsi], 0x5b4
xor sil, sil
jmp 0x1401a50cb
cmp dword [rsp + 0x54], 4
sete sil
test rbx, rbx
je 0x1401a5103
sub rdi, rbx
and rdi, 0xfffffffffffffff8
mov rax, rbx
cmp rdi, 0x1000
jb 0x1401a50f8
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a512b
mov rdx, rdi
mov rcx, rbx
call fcn.14009bb94
movzx eax, sil
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009b650
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a8cc8
int3
Function at 0x1401a7b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.Esg::Encoders::AESImpl.0
mov qword [rcx], rax
mov dword [rcx + 8], 0x1a
add rcx, 0x10
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov eax, dword [r14 + 8]
test al, 8
je 0x1401a7bd9
lea edx, [rdi + 0x20]
jmp 0x1401a7be2
test al, 4
je 0x1401a7be8
mov edx, reloc.WS2_32.dll_recv
call fcn.1400932f0
nop
lea rax, vtable.Esg::Encoders::AESLegacy.0
mov qword [r14], rax
cmp byte [0x14025564c], 0
jne 0x1401a7d21
mov bl, 1
call fcn.1401b35a0
test al, al
cmove ebx, edi
call fcn.1401b3360
movzx ebx, bl
test al, al
cmove ebx, edi
call fcn.1401b35a0
test al, al
jne 0x1401a7c26
xor bpl, bpl
jmp 0x1401a7c7e
call fcn.1401b3360
test al, al
jne 0x1401a7c34
xor bpl, bpl
jmp 0x1401a7c7e
mov edx, edi
movzx r9d, byte [0x14025a920]
lea r8, [0x14025aa20]
lea r10, [0x14025a920]
nop dword [rax]
mov eax, edi
cmp r9d, edx
je 0x1401a7c6b
nop word [rax + rax]
inc eax
movzx ecx, byte [rax + r10]
cmp ecx, edx
jne 0x1401a7c60
mov byte [r8], al
inc edx
inc r8
cmp edx, 0xff
jbe 0x1401a7c50
mov bpl, 1
and bpl, bl
mov r9b, 1
mov dword [0x14025ab20], edi
mov edi, 1
lea rsi, [0x14025ab24]
nop word [rax + rax]
movzx eax, r9b
mov dword [rsi], eax
mov r10b, 2
movzx r8d, r9b
xor bl, bl
mov r11d, 8
nop word [rax + rax]
movzx ecx, r10b
movzx eax, bl
xor al, r8b
movzx r9d, al
movzx eax, bl
and cl, 1
cmove r9d, eax
movzx eax, r8b
add al, al
movzx edx, al
shr r10b, 1
movzx ebx, r9b
movzx ecx, r8b
movzx eax, dl
xor al, 0x1b
movzx r8d, al
test cl, cl
cmovns r8d, edx
sub r11d, 1
jne 0x1401a7cc0
inc edi
add rsi, 4
cmp edi, 0x3b
jb 0x1401a7ca0
call fcn.1401b3660
test al, al
je 0x1401a7d37
mov byte [0x14025564c], bpl
test bpl, bpl
je 0x1401a7d3d
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov byte [0x14025564c], al
lea rax, str.Tables_failed_to_initialize
mov qword [rsp + 0x20], rax
lea rdx, [0x14024a9e8]
lea rcx, [rsp + 0x20]
call fcn.14009db04
int3
Function at 0x1401b3360
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
call fcn.1401b35a0
test al, al
jne 0x1401b3372
add rsp, 0x38
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov ebp, 0x100
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
xor r14d, r14d
mov qword [rsp + 0x20], r15
lea r15, [0x140000000]
nop
movzx r9d, byte [r14 + r15 + 0x25a820]
movzx eax, r9b
and al, 0xf1
movzx edi, al
shr al, 4
and dil, 0xf
xor dil, al
movzx eax, r9b
and al, 0xe3
movzx ebx, al
shr al, 4
and bl, 0xf
xor bl, al
movzx eax, r9b
and al, 0xc7
movzx r11d, al
shr al, 4
and r11b, 0xf
xor r11b, al
movzx eax, r9b
and al, 0x8f
movzx r10d, al
shr al, 4
and r10b, 0xf
xor r10b, al
movzx eax, r9b
and al, 0x1f
movzx r8d, al
shr al, 4
and r8b, 0xf
xor r8b, al
movzx eax, r9b
and al, 0x3e
movzx edx, al
shr al, 4
and dl, 0xf
xor dl, al
movzx eax, r9b
and al, 0x7c
and r9b, 0xf8
movzx ecx, al
shr al, 4
and cl, 0xf
xor cl, al
movzx eax, r9b
and al, 0xf
shr r9b, 4
xor al, r9b
movzx eax, al
mov r9d, eax
and eax, 3
shr r9d, 2
xor r9d, eax
movzx eax, cl
mov ecx, eax
and eax, 3
shr ecx, 2
xor ecx, eax
movzx eax, dl
mov edx, eax
and eax, 3
shr edx, 2
xor edx, eax
movzx eax, r8b
mov r8d, eax
and eax, 3
shr r8d, 2
xor r8d, eax
movzx eax, r10b
mov r10d, eax
and eax, 3
shr r10d, 2
xor r10d, eax
movzx eax, r11b
mov r11d, eax
and eax, 3
shr r11d, 2
xor r11d, eax
movzx eax, bl
mov ebx, eax
shr ebx, 2
and eax, 3
lea r14, [r14 + 1]
xor ebx, eax
mov esi, r9d
shr esi, 1
and r9d, 1
xor esi, r9d
movzx eax, dil
mov edi, eax
add esi, esi
and eax, 3
shr edi, 2
xor edi, eax
mov eax, ecx
shr eax, 1
and ecx, 1
xor eax, ecx
or esi, eax
mov eax, edx
shr eax, 1
add esi, esi
and edx, 1
xor eax, edx
or esi, eax
mov eax, r8d
shr eax, 1
add esi, esi
and r8d, 1
xor eax, r8d
or esi, eax
mov eax, r10d
shr eax, 1
add esi, esi
and r10d, 1
xor eax, r10d
or esi, eax
mov eax, r11d
shr eax, 1
add esi, esi
and r11d, 1
xor eax, r11d
or esi, eax
mov eax, ebx
shr eax, 1
add esi, esi
and ebx, 1
xor eax, ebx
or esi, eax
mov eax, edi
add esi, esi
shr eax, 1
and edi, 1
xor eax, edi
or esi, eax
xor esi, 0x63
mov byte [r14 + r15 + 0x25a91f], sil
sub rbp, 1
jne 0x1401b33a0
mov r15, qword [rsp + 0x20]
mov al, 1
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1401b35a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov byte [0x14025a820], 0
lea rsi, [0x14025a821]
mov edi, 1
nop dword [rax]
nop word [rax + rax]
mov ebx, 1
movzx r10d, bl
movzx eax, dil
xor r9b, r9b
mov r11d, 8
nop word [rax + rax]
movzx ecx, r9b
movzx r8d, r10b
xor cl, al
movzx edx, cl
and r8b, 1
movzx ecx, r9b
cmove edx, ecx
movzx ecx, al
add cl, cl
shr r10b, 1
movzx r9d, dl
movzx edx, cl
movzx ecx, al
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx eax, al
cmovns eax, edx
sub r11d, 1
jne 0x1401b35f0
cmp r9b, 1
je 0x1401b3637
inc ebx
jmp 0x1401b35d5
mov byte [rsi], bl
inc edi
inc rsi
cmp edi, 0xff
jbe 0x1401b35d0
mov rbx, qword [rsp + 8]
mov al, 1
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401b3660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
xor r13d, r13d
mov qword [rsp + 0x38], 0x100
lea r8, [0x140000000]
nop dword [rax + rax]
movzx r15d, byte [r8 + r13 + 0x25a920]
mov r10d, 8
movzx r14d, byte [r8 + r13 + 0x25aa20]
movzx ebp, r15b
sar bpl, 7
movzx eax, r15b
add al, al
and bpl, 0x1b
xor bpl, al
movzx r9d, r14b
movzx r12d, bpl
mov al, 0xe
xor r12b, r15b
xor sil, sil
nop dword [rax]
movzx ecx, sil
movzx r8d, r9b
xor cl, al
movzx edx, cl
and r8b, 1
movzx ecx, sil
cmove edx, ecx
movzx ecx, al
add cl, cl
shr r9b, 1
movzx esi, dl
movzx edx, cl
movzx ecx, al
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx eax, al
cmovns eax, edx
sub r10d, 1
jne 0x1401b36d0
movzx r9d, r14b
mov r8b, 9
xor dil, dil
mov r10d, 8
nop dword [rax]
movzx eax, dil
movzx edx, r9b
xor al, r8b
movzx ecx, al
and dl, 1
movzx eax, dil
cmove ecx, eax
movzx eax, r8b
add al, al
shr r9b, 1
movzx edx, al
movzx eax, dl
movzx edi, cl
xor al, 0x1b
movzx ecx, r8b
test cl, cl
movzx r8d, al
cmovns r8d, edx
sub r10d, 1
jne 0x1401b3720
movzx r9d, r14b
mov r8b, 0xd
xor bl, bl
mov r10d, 8
nop
movzx eax, bl
movzx edx, r9b
xor al, r8b
movzx ecx, al
and dl, 1
movzx eax, bl
cmove ecx, eax
movzx eax, r8b
add al, al
shr r9b, 1
movzx edx, al
movzx eax, dl
movzx ebx, cl
xor al, 0x1b
movzx ecx, r8b
test cl, cl
movzx r8d, al
cmovns r8d, edx
sub r10d, 1
jne 0x1401b3770
movzx r9d, r14b
mov r8b, 0xb
xor r11b, r11b
mov r10d, 8
nop
movzx eax, r11b
movzx edx, r9b
xor al, r8b
movzx ecx, al
and dl, 1
movzx eax, r11b
cmove ecx, eax
movzx eax, r8b
add al, al
shr r9b, 1
movzx edx, al
movzx eax, dl
movzx r11d, cl
xor al, 0x1b
movzx ecx, r8b
test cl, cl
movzx r8d, al
cmovns r8d, edx
sub r10d, 1
jne 0x1401b37c0
lea r8, [0x140000000]
movzx eax, bpl
movzx ecx, r12b
mov edx, r15d
shl ecx, 8
or ecx, r15d
mov dword [r8 + r13*4 + 0x25cc10], edx
shl ecx, 8
or ecx, r15d
rol edx, 8
shl ecx, 8
or ecx, eax
mov dword [r8 + r13*4 + 0x25d010], edx
mov dword [r8 + r13*4 + 0x25ac10], ecx
mov eax, r14d
rol ecx, 8
mov dword [r8 + r13*4 + 0x25b010], ecx
rol ecx, 8
mov dword [r8 + r13*4 + 0x25b410], ecx
rol ecx, 8
mov dword [r8 + r13*4 + 0x25b810], ecx
mov ecx, r11d
shl ecx, 8
or ecx, ebx
mov dword [r8 + r13*4 + 0x25dc10], eax
shl ecx, 8
or ecx, edi
rol eax, 8
shl ecx, 8
or ecx, esi
mov dword [r8 + r13*4 + 0x25e010], eax
mov dword [r8 + r13*4 + 0x25bc10], ecx
rol ecx, 8
mov dword [r8 + r13*4 + 0x25c010], ecx
rol ecx, 8
rol edx, 8
rol eax, 8
mov dword [r8 + r13*4 + 0x25c410], ecx
mov dword [r8 + r13*4 + 0x25d410], edx
mov dword [r8 + r13*4 + 0x25e410], eax
rol ecx, 8
rol edx, 8
rol eax, 8
mov dword [r8 + r13*4 + 0x25c810], ecx
mov dword [r8 + r13*4 + 0x25d810], edx
mov dword [r8 + r13*4 + 0x25e810], eax
inc r13
sub qword [rsp + 0x38], 1
jne 0x1401b3690
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400041e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, str.ARUBA_TIME_STARTUP
call qword [sym.imp.MSVCR100.dll_getenv]
lea rcx, [rsp + 0x30]
test rax, rax
setne sil
call qword [sym.imp.libBase.dll_public:_void___cdecl_awOS::StopWatch::constructor_void____ptr64]
call qword [sym.imp.libBase.dll_public:_static_class_awPlugin::ServiceManager____ptr64___cdecl_awPlugin::ServiceManager::getInstance_void_]
lea rcx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::clear_void____ptr64]
lea rcx, [rsp + 0x30]
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::start_void____ptr64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.libBase.dll_public:_void___cdecl_awString::IString::constructor_void____ptr64]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.libBase.dll_public:_void___cdecl_awPlugin::ServiceManager::registerServices_class_awString::IString____ptr64]
test sil, sil
je 0x14000426d
lea rcx, [rsp + 0x30]
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::check_void_const___ptr64]
lea rcx, str.____time:_register_services:__f_n
movapd xmm1, xmm0
movq rdx, xmm1
call qword [sym.imp.MSVCR100.dll_printf]
mov rcx, rdi
call fcn.140003b30
lea rcx, [rsp + 0x30]
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::clear_void____ptr64]
lea rcx, [rsp + 0x30]
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::start_void____ptr64]
lea rcx, [rdi + 0x20]
call fcn.140006dd0
test sil, sil
je 0x1400042ba
lea rcx, [rsp + 0x30]
call qword [sym.imp.libBase.dll_public:_double___cdecl_awOS::StopWatch::check_void_const___ptr64]
lea rcx, str.____time:_initialize_service_options:__f_n
movapd xmm1, xmm0
movq rdx, xmm1
call qword [sym.imp.MSVCR100.dll_printf]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140026827
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140060f28]
jne 0x14002629a
rol rcx, 0x10
test cx, 0xffff
jne 0x140026296
repz ret
ror rcx, 0x10
jmp 0x140026780
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140061860]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140061958]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140026805
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140061860]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140026827
mov rax, qword [rsp + 0x88]
mov qword [0x140061958], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400618f8], rax
mov rax, qword [0x140061958]
mov qword [0x1400617d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400618e0], rax
mov dword [0x1400617c0], 0xc0000409
mov dword [0x1400617c4], 1
mov rax, qword [0x140060f28]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140060f30]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140061858], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003f9b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140061858], 0
jne 0x1400268ae
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18087a108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x18087a28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18087a139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18087a11f
add dl, dl
jne 0x18087a146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18087a1a6
xor eax, eax
add dl, dl
jne 0x18087a155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18087a25d
add dl, dl
jne 0x18087a166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18087a173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18087a180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18087a18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18087a19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18087a12e
mov eax, 1
add dl, dl
jne 0x18087a1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18087a1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18087a1ab
sub eax, ebx
mov ebx, 1
jne 0x18087a1fc
mov ecx, 1
add dl, dl
jne 0x18087a1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18087a1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18087a1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18087a12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18087a218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18087a225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18087a20d
cmp eax, 0x7d00
jae 0x18087a24b
cmp eax, 0x500
jb 0x18087a246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18087a12e
cmp eax, 0x7f
ja 0x18087a24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18087a12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18087a282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18087a12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002de80
Capabilities:
Enumerate process modules

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], r9
mov rax, qword [rdx]
mov rcx, qword [rax]
call fcn.14002dfd0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdx
lea r8, str.C:UsersA_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinproc_0.6.4_srcprocessmod.rs
call fcn.14002eda0
mov rcx, rax
call fcn.14002e720
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r8d, eax
mov dword [rsp + 0x20], 3
call sub.PSAPI.DLL_EnumProcessModulesEx
mov dword [rsp + 0xa4], eax
cmp eax, 0
jne 0x14002df5d
lea rcx, [rsp + 0x58]
call fcn.140030520
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x58]
mov r8d, 0x28
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14002df69
mov rax, qword [rsp + 0x28]
mov qword [rax], 4
mov rax, qword [rsp + 0x30]
add rsp, 0xb8
ret

Function at 0x140039800
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
call sub.ADVAPI32.dll_SystemFunction036
cmp eax, 0
sete al
and al, 1
movzx eax, al
add rsp, 0x48
ret
Function at 0x14003c140
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14003c1e0
jmp 0x14003c1cf
jae 0x14003c2a0
cmp r8, 0x201
jae 0x14003c1e0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14003c238
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14003c20f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140053230
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14003c261
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14003c308
mov r8d, r14d
cmp r15, r8
jne 0x14003c1c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003c335
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14003c1cf
jmp 0x14003c1e0
cmp rsi, r8
jb 0x14003c34f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14003dc80
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14003c2f1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140003300
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14003c2d9
jmp 0x14003c2f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140053b20
jmp 0x14003c364
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140054070
ud2
Function at 0x140042260
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14005b1a8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400422a4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14004230a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140042341
test eax, eax
js 0x14004231b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140042334
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14003da50
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14003a310
mov ecx, 7
int 0x29
ud2

Function at 0x140043090
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400430c8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400430e0
nop
add rsp, 0x38
ret

Function at 0x1400430e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x140043123
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14003cd10]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140053a50
ud2