joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400ed7a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400ed7b0]
mov dword [rax], 1
mov rax, qword [0x1400ed7c0]
mov dword [rax], 1
mov rax, qword [0x1400ed720]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400ed790]
mov dword [0x14010100c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400ed870]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400ed850]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400ed700]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001570
Capabilities:
Copy file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r9, rdx
mov rcx, rdi
mov rdx, rbx
mov r8, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::fs::copy::h3d031dc0e79f6fe3

Function at 0x1400022e0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x38]
mov rdx, r9
call sym.__alloc::string::String_as_winreg::types::ToRegValue_::to_reg_value::h406305b157754c34
mov rdi, qword [rdi]
add rsi, rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x68], 0
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x58]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h2b73c85986
movzx r9d, byte [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call sub.ADVAPI32.dll_RegSetValueExW
mov edi, eax
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140002379
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002391
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400028d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x1400049f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x1400ad008]
movzx eax, byte [rax]
cmp al, 1
jne 0x140004a13
add rsp, 0xa0
pop rsi
jmp sym._ZN71__LT_aes..autodetect..Aes128_u20_as_u20_cipher..block..BlockDecrypt_GT_20decrypt_with_backend5inner17ha3e9c9fd9c9a452bE.l
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x20]
mov rdx, rcx
mov rcx, rax
mov rsi, r8
mov r8, r9
call sym.aes::soft::fixslice::aes128_decrypt::h1914fb409d13d336
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
add rsp, 0xa0
pop rsi
ret
Function at 0x140005d80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, rdx
movzx edx, word [rdx]
cmp edx, 0x5a4d
jne 0x140005df8
movsxd rdx, dword [rax + 0x3c]
test rdx, rdx
je 0x140005dfe
cmp edx, 0x40
jb 0x140005e69
cmp rdx, r8
ja 0x140005e7a
lea r8, [rax + rdx]
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x140005e04
cmp r9d, 0x20b
jne 0x140005e30
mov r9b, 2
cmp dword [r8], 0x4550
jne 0x140005e2b
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x8664
jne 0x140005e2b
mov r10d, 1
mov r9b, 4
test byte [r8 + 0x16], 2
je 0x140005e2b
jmp 0x140005e46
xor eax, eax
mov byte [rcx], al
jmp 0x140005e33
mov al, 1
mov byte [rcx], al
jmp 0x140005e33
mov r9b, 2
cmp dword [r8], 0x4550
jne 0x140005e2b
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x14c
jne 0x140005e2b
mov r9b, 4
test byte [r8 + 0x16], 2
jne 0x140005e43
mov byte [rcx], r9b
jmp 0x140005e33
mov byte [rcx], 5
mov qword [rcx + 0x18], 2
mov rax, rcx
add rsp, 0x28
ret
xor r10d, r10d
add rdx, 0xffffffffffffffc0
mov qword [rcx], rax
add rax, 0x40
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x20], r8
mov rax, rcx
add rsp, 0x28
ret
lea r8, str.fl_f_
mov ecx, 0x40
call sym.core::slice::index::slice_index_order_fail::h786748ba81f41b02
lea rax, str.fl_f_
mov rcx, rdx
mov rdx, r8
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
int3
Function at 0x140005e90
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140005f1b
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x140005f20
cmp eax, 0x40
jb 0x140006016
cmp rax, r8
ja 0x14000602a
lea rsi, [rdx + rax]
movzx r10d, word [rdx + rax + 0x18]
cmp r10d, 0x20b
je 0x140005f25
mov r9b, 5
cmp r10d, 0x10b
jne 0x140005f4a
mov r9b, 2
cmp dword [rsi], 0x4550
jne 0x140005f4a
movzx r10d, word [rsi + 4]
mov r9b, 3
cmp r10d, 0x14c
jne 0x140005f4a
mov r9b, 4
test byte [rsi + 0x16], 2
je 0x140005f4a
lea r9, [rax + 0xf8]
cmp r9, r8
ja 0x14000603f
xor edi, edi
jmp 0x140005f83
xor r9d, r9d
jmp 0x140005f4a
mov r9b, 1
jmp 0x140005f4a
mov r9b, 2
cmp dword [rsi], 0x4550
jne 0x140005f4a
movzx r10d, word [rsi + 4]
mov r9b, 3
cmp r10d, 0x8664
jne 0x140005f4a
mov r9b, 4
test byte [rsi + 0x16], 2
jne 0x140005f6e
mov byte [rcx], r9b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r9, [rax + 0x108]
mov edi, 1
cmp r9, r8
ja 0x14000603f
mov r11, r8
sub r11, r9
movzx ebx, word [rsi + 6]
lea r10d, [rbx*8]
lea r10, [r10 + r10*4]
mov r14, r11
sub r14, r10
jb 0x140006054
add rax, 0xffffffffffffffc0
lea r11, [rdx + 0x40]
add r9, rdx
mov r15, rdx
shr r15, 8
add r10, r9
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r11
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], r9
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], r10
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x140005f58
lea r8, str.fl_f_
mov ecx, 0x40
mov rdx, rax
call sym.core::slice::index::slice_index_order_fail::h786748ba81f41b02
lea r9, str.fl_f_
mov rcx, rax
mov rdx, r8
mov r8, r9
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
lea rax, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_memexec_0.2.0_src_peparser_pe.rs
mov rcx, r9
mov rdx, r8
mov r8, rax
call sym.core::slice::index::slice_start_index_len_fail::h8d3d56967d6340e8
lea r8, str.hm_f_
mov rcx, r10
mov rdx, r11
call sym.core::slice::index::slice_start_index_len_fail::h8d3d56967d6340e8
int3
Function at 0x140008550
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1060
call sym.___chkstk_ms
sub rsp, rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ebx, dword [rdx + 8]
mov r14, qword [rax]
mov dword [rsp + 0x44], 0x800
lea r15, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x44]
mov rcx, r14
mov edx, ebx
mov r8, r15
call sub.ADVAPI32.dll_RegEnumKeyExW
test eax, eax
je 0x1400085cd
cmp eax, 0x103
jne 0x140008605
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rsi], rax
jmp 0x140008638
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
jae 0x14000864a
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call sym.alloc::string::String::from_utf16::h92bc63552228ad98
mov rcx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140008619
mov rax, qword [rsp + 0x50]
jmp 0x140008623
movabs rcx, 0x8000000000000000
shl rax, 0x20
or rax, 2
jmp 0x140008628
movabs rax, 0x900000002
mov rdx, qword [rsp + 0x58]
inc ebx
mov dword [rdi + 8], ebx
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov rax, rsi
add rsp, 0x1060
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.9.0_src_lib.rs_o_f_
mov edx, 0x800
mov rcx, r8
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
int3
Function at 0x140011750
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140011a90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140011f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
movaps xmm11, xmmword [rdx]
movaps xmm12, xmmword [rdx + 0xc0]
movaps xmmword [rcx], xmm11
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movaps xmmword [rcx + 0xc0], xmm12
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140012010
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x140012d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140012df0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
movaps xmm11, xmmword [rdx]
movaps xmm12, xmmword [rdx + 0xc0]
movaps xmmword [rcx], xmm11
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movaps xmmword [rcx + 0xc0], xmm12
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140012f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1400366c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret

Function at 0x1400379d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140037a60
jmp 0x140037a4f
jae 0x140037b1b
cmp r8, 0x201
jae 0x140037a60
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x140037ab7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140037a8f
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h498cd2a0878ddf3d
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140037add
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140037b87
mov r8d, r13d
cmp r12, r8
jne 0x140037a40
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140037bba
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140037a4f
jmp 0x140037a60
cmp r14, r8
jb 0x140037bd4
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x140037b70
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x140037b5b
jmp 0x140037b70
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call sym.core::panicking::panic::h82631201f060ca88
jmp 0x140037be9
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
ud2
Function at 0x140037c20
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x140037c3f
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hab0355a4f2b8b8d2]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
ud2