joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011488
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019f10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019f30
xor al, al
jmp 0x140019fb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019f43
xor al, al
jmp 0x140019fb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140019f6d
xor al, al
jmp 0x140019fb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019f81
xor al, al
jmp 0x140019fb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140019f93
xor al, al
jmp 0x140019fb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140019faf
xor al, al
jmp 0x140019fb1
mov al, 1
add rsp, 0x38
ret
Function at 0x140060b00
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401340c0]
xor rax, rsp
mov qword [rbp], rax
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
lea rax, str.Under_development
mov qword [rsp + 0x60], rax
lea rax, str.Best_Cheat
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0x59dd27de
lea rax, str.eternity
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea rax, str.eternity1
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x60]
call fcn.14006a730
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x30]
call fcn.14006a040
mov qword [rsp + 0x30], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, 0xc
lea rdx, str.project_smv
lea rcx, [rsp + 0x30]
call fcn.14004d680
nop
mov r8d, 0xb
lea rdx, str.Jul_11_2024
lea rcx, [rsp + 0x30]
call fcn.140064050
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140062410
nop
lea rcx, [rsp + 0x30]
call fcn.1400488e0
mov rbx, qword [rsp + 0x50]
cmp rbx, 0xf
jbe 0x140060c8f
mov rdi, qword [rsp + 0x38]
inc rbx
test rdi, rdi
jne 0x140060c84
test rbx, rbx
je 0x140060c84
lea rax, str.null_pointer_cannot_point_to_a_block_of_non_zero_size
mov qword [rsp + 0x28], rax
lea rax, [0x140118f60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3b4
lea rdx, [0x14011e6f0]
mov ecx, 2
call fcn.1400a5120
cmp eax, 1
jne 0x140060c5f
int3
mov qword [rsp + 0x20], rsi
mov r9d, 0x3b4
lea r8, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.40.33807includexmemory
lea rdx, [0x14011e824]
lea rcx, str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.1400a5920
mov rdx, rbx
mov rcx, rdi
call fcn.140065980
movdqa xmm0, xmmword [0x140121650]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov edx, 0x10
call fcn.140065980
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rbp - 0x30]
call fcn.14004d800
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x30], rsi
mov edx, 0x10
call fcn.140065980
call fcn.140060620
test al, al
je 0x140060d1d
call fcn.140060930
mov eax, 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140075810
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14004a600
int3
Function at 0x180022118
Capabilities:
Suspend thread

Disassembly:
jmp 0x18003e9c0
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800787dc], 0
je 0x18003e9dd
mov eax, dword [0x1800787dc]
jmp 0x18003eaa6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x18003e9f1
xor eax, eax
jmp 0x18003eaa6
mov ecx, 0x10
call fcn.18002209b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18003ea5f
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18003ea44
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180022c71
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800787dc], eax
mov qword [0x1800787e0], 0
mov eax, dword [rsp + 0x20]
jmp 0x18003eaa6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18003ea7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18003ea1a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800787e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800787e8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x180022744
Capabilities:
Create thread

Disassembly:
jmp 0x18003b580
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x18008312d]
call fcn.180022f0a
nop
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x18003b5c0
jmp 0x18003b5e6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180022c21]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x180022875
Capabilities:
Terminate process

Disassembly:
jmp 0x180064de0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180022b5e
Capabilities:
Resume thread

Disassembly:
jmp 0x18003e1a0
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800787d8], eax
je 0x18003e1bc
mov eax, 0x10dd
jmp 0x18003e2e3
mov rax, qword [0x1800787f0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003e267
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18003e232
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18003e232
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18003c510
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.180022c71
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18003e1c8
mov qword [0x1800787f0], 0
call fcn.18003d200
mov rax, qword [0x1800787e8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18003e2cc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.180022c71
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18003e283
mov qword [0x1800787e8], 0
mov dword [0x1800787d8], 0
xor eax, eax
add rsp, 0x68
ret

Function at 0x18003b920
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18003bbd0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18003ba27
mov rax, qword [0x180078008]
cmp qword [rsp + 0x20], rax
jb 0x18003b984
mov rax, qword [0x180078010]
cmp qword [rsp + 0x20], rax
ja 0x18003b984
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003b946
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180022b90
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003b9b3
jmp 0x18003ba27
cmp dword [rsp + 0x50], 0x10000
jne 0x18003ba0a
cmp qword [rsp + 0x48], 0x10000
jb 0x18003ba0a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003b9f8
mov rax, qword [rsp + 0x28]
jmp 0x18003ba29
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003ba22
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18003bbd0
mov qword [rsp + 0x20], rax
jmp 0x18003b946
xor eax, eax
add rsp, 0x68
ret
Function at 0x18003ba80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18003bc20
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18003bb83
mov rax, qword [0x180078008]
cmp qword [rsp + 0x20], rax
jb 0x18003badb
mov rax, qword [0x180078010]
cmp qword [rsp + 0x20], rax
ja 0x18003badb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003ba9d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180022b90
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003bb0a
jmp 0x18003bb83
cmp dword [rsp + 0x50], 0x10000
jne 0x18003bb61
cmp qword [rsp + 0x48], 0x10000
jb 0x18003bb61
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003bb4f
mov rax, qword [rsp + 0x28]
jmp 0x18003bb85
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003bb7e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18003bc20
mov qword [rsp + 0x20], rax
jmp 0x18003ba9d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18003bc80
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180022ef6
mov qword [rsp + 0x28], 0
cmp qword [0x1800787c8], 0
jne 0x18003bcc8
cmp qword [0x1800787c0], 0
je 0x18003bcc8
mov rax, qword [0x1800787c0]
mov qword [0x1800787c8], rax
cmp qword [0x1800787c8], 0
je 0x18003bd6e
mov rax, qword [0x1800787c8]
cmp qword [rax + 0x10], 0
je 0x18003bd6e
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18003bd6e
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18003bd6e
mov rax, qword [0x1800787c8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18003bd34
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18003bd3b
xor eax, eax
jmp 0x18003bee9
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180022b90
mov rax, qword [rsp + 0x28]
jmp 0x18003bee9
mov rax, qword [0x1800787c0]
mov qword [0x1800787c8], rax
jmp 0x18003bd90
mov rax, qword [0x1800787c8]
mov rax, qword [rax + 8]
mov qword [0x1800787c8], rax
cmp qword [0x1800787c8], 0
je 0x18003bddd
cmp qword [0x1800787c8], 0
je 0x18003bddb
mov rax, qword [0x1800787c8]
cmp qword [rax + 0x10], 0
je 0x18003bddb
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18003bddb
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18003bddb
jmp 0x18003bd0c
jmp 0x18003bd7e
mov rcx, qword [rsp + 0x60]
call fcn.1800223fc
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18003bf90
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18003bee7
mov rax, qword [rsp + 0x48]
mov qword [0x1800787c8], rax
mov rax, qword [0x1800787c8]
mov dword [rax], 0x52727464
mov rax, qword [0x1800787c8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800787c8]
mov rcx, qword [0x1800787c0]
mov qword [rax + 8], rcx
mov rax, qword [0x1800787c8]
mov qword [0x1800787c0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800787c8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18003be98
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18003bed2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18003be8e
mov rax, qword [0x1800787c8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18003bd0c
xor eax, eax
add rsp, 0x58
ret
Function at 0x140002d8d
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140002dc3
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140002dcb
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140002dd0
xor r10d, r10d
jmp 0x140002e7e
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140002df3
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140002e0a
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140002e2a
add r11, r8
jmp 0x140002f4f
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140002ef2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140002ea0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140002f04
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140002f0a
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140002f31
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140002f4b
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x140004099
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rbx, rdx
mov rsi, rcx
lea rdi, [rsp + 0x52]
mov r8d, 0x1fe
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov rdx, rdi
mov r8d, 0xff
call qword [sym.imp.USER32.dll_GetWindowTextW]
movsxd rcx, eax
cmp ecx, 0x100
jae 0x14000412c
lea rax, [rsp + rcx*2]
add rax, 0x52
lea rdx, [rsp + 0x20]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
xor eax, eax
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
mov rcx, rdi
call fcn.140041ce1
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
lea r8, str.srchelper.rs
mov edx, 0xff
call fcn.1400ebff0
int3
Function at 0x14000b85c
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rbx, rdx
mov rsi, rcx
lea rdi, [rsp + 0x52]
mov r8d, 0x1fe
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov rdx, rdi
mov r8d, 0xff
call qword [sym.imp.USER32.dll_GetWindowTextW]
movsxd rcx, eax
cmp ecx, 0x100
jae 0x14000b8ef
lea rax, [rsp + rcx*2]
add rax, 0x52
lea rdx, [rsp + 0x20]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
xor eax, eax
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
mov rcx, rdi
call fcn.140041ce1
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x1400f0dd8]
mov edx, 0xff
call fcn.1400ebff0
int3
Function at 0x14000c18c
Capabilities:
Enumerate gui resources

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movdqa xmmword [rsp + 0x40], xmm6
mov rax, qword [section..data]
cmp rax, 2
jne 0x14000c31f
mov rdi, qword [0x14012d010]
test rdi, rdi
je 0x14000c2f5
mov rsi, qword [0x14012d008]
shl rdi, 7
add rdi, rsi
xor ebx, ebx
mov r14, 0xfffffffffffffffc
pcmpeqd xmm6, xmm6
xor eax, eax
lock cmpxchg qword [rsi], r14
jne 0x14000c2de
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x14000c2c1
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 0x10]
movdqa xmm0, xmmword [rcx]
pmovmskb r10d, xmm0
not r10d
mov r8, qword [rsi + 0x10]
mov r9, rcx
test r10w, r10w
jne 0x14000c237
movdqa xmm0, xmmword [rdx]
pmovmskb r10d, xmm0
add r9, 0xffffffffffffff00
add rdx, 0x10
cmp r10d, 0xffff
je 0x14000c217
not r10d
bsf r11d, r10d
shl r11d, 4
sub r11, r9
add r11, rcx
sar r11, 4
lea r15, [r11 - 0x10]
and r15, r8
movdqu xmm0, xmmword [rcx + r15]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb ebp, xmm0
test ebp, ebp
je 0x14000c270
bsr bp, bp
xor ebp, 0xf
jmp 0x14000c274
mov bp, select
movdqu xmm0, xmmword [rcx + r11]
pcmpeqb xmm0, xmm6
pmovmskb r12d, xmm0
or r12d, 0x10000
bsf r12d, r12d
add ebp, r12d
mov r12b, 0x80
cmp bp, 0xf
ja 0x14000c2a1
inc qword [rsi + 0x18]
mov r12b, 0xff
lea ebp, [r10 - 1]
and ebp, r10d
mov byte [rcx + r11], r12b
mov byte [rcx + r15 + 0x10], r12b
mov r10d, ebp
dec rax
mov qword [rsi + 0x20], rax
jne 0x14000c211
mov rax, 0xfffffffffffffffc
lock cmpxchg qword [rsi], rbx
jne 0x14000c2eb
sub rsi, 0xffffffffffffff80
cmp rsi, rdi
jne 0x14000c1dc
jmp 0x14000c2f5
mov rcx, rsi
call fcn.1400ec7b0
jmp 0x14000c1e9
mov rcx, rsi
call fcn.1400eca3d
jmp 0x14000c2cf
lea rcx, [0x14000bf12]
mov edx, 0x22b8
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14000c329
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400ebdf9
jmp 0x14000c1b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x30]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f0e68]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f0498]
mov edx, 0x2b
call fcn.1400ec250
int3
Function at 0x140012e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140012f00
cmp r11, r10
ja 0x140012f77
cmp r10, rdx
ja 0x140012f89
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140012f02
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140012ee0
jmp 0x140012f64
ja 0x140012f0a
mov r11, r10
cmp rax, r8
jne 0x140012eae
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140012f40
mov rdi, r8
sub ecx, edx
jns 0x140012f5b
jmp 0x140012f66
cmp r8, rsi
je 0x140012f98
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140012f66
xor al, 1
cmp rdi, rsi
jne 0x140012f20
jmp 0x140012f66
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400ec1e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400ebff0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400ec2e0
int3
Function at 0x140013e01
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
not ecx
lea rax, [0x1400f2bc8]
cmp r8, 0x40
jb 0x140013f36
add rdx, 0x10
xor r10d, r10d
mov r9d, 0xff
cmp r8, 0xf
jbe 0x140013f63
movzx esi, byte [rdx - 1]
movzx r11d, byte [rdx - 2]
mov r11d, dword [rax + r11*4 + 0x400]
xor r11d, dword [rax + rsi*4]
movzx esi, byte [rdx - 3]
xor r11d, dword [rax + rsi*4 + 0x800]
movzx esi, byte [rdx - 4]
xor r11d, dword [rax + rsi*4 + 0xc00]
movzx esi, byte [rdx - 5]
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, byte [rdx - 6]
xor r11d, dword [rax + rsi*4 + 0x1400]
movzx esi, byte [rdx - 7]
xor r11d, dword [rax + rsi*4 + 0x1800]
movzx esi, byte [rdx - 8]
xor r11d, dword [rax + rsi*4 + 0x1c00]
movzx esi, byte [rdx - 9]
xor r11d, dword [rax + rsi*4 + 0x2000]
movzx esi, byte [rdx - 0xa]
xor r11d, dword [rax + rsi*4 + 0x2400]
movzx esi, byte [rdx - 0xb]
xor r11d, dword [rax + rsi*4 + 0x2800]
movzx esi, byte [rdx - 0xc]
xor r11d, dword [rax + rsi*4 + 0x2c00]
mov esi, ecx
shr esi, 0x18
movzx edi, byte [rdx - 0xd]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3000]
mov esi, ecx
shr esi, 0x10
and esi, r9d
movzx edi, byte [rdx - 0xe]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3400]
inc r10
mov esi, ecx
shr esi, 8
and esi, r9d
movzx edi, byte [rdx - 0xf]
xor edi, esi
xor r11d, dword [rax + rdi*4 + 0x3800]
and ecx, r9d
movzx esi, byte [rdx - 0x10]
xor esi, ecx
mov ecx, r11d
xor ecx, dword [rax + rsi*4 + 0x3c00]
lea r11, [r8 - 0x10]
cmp r10, 4
jne 0x140013f26
cmp r11, 0x3f
jbe 0x140013f32
xor r10d, r10d
add rdx, 0x10
mov r8, r11
jmp 0x140013e27
add r8, 0xfffffffffffffff0
test r8, r8
je 0x140013f58
xor r9d, r9d
mov r10b, byte [rdx + r9]
xor r10b, cl
movzx r10d, r10b
shr ecx, 8
xor ecx, dword [rax + r10*4]
inc r9
cmp r8, r9
jne 0x140013f3e
not ecx
mov eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rax, str.G:.cargo_registry_srcmirrors.tuna.tsinghua.edu.cn_df7c3c540f42cdbdcrc32fast_1.4.2_src_baseline.rs
mov ecx, select
mov rdx, r8
mov r8, rax
call fcn.1400ebf80
int3