joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c44b20a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1c44b4220]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1c44b2118
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1c44b2118
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1c44b2118
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1c44b2118
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x1c44b210c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1c44b2120
add rdx, 0x28
cmp rdx, r10
jne 0x1c44b20f8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x1c44b2130
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1c44b213e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1c44b2115
test r8d, r8d
jg 0x1c44b2128
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1400015b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14000c938
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14000fd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000fe20
cmp r10, r11
jb 0x14000fe96
cmp r10, rdx
ja 0x14000feaa
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000fe22
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000fe00
jmp 0x14000fe84
ja 0x14000fe2a
mov r11, r10
cmp rax, r8
jne 0x14000fdc4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000fe60
mov rdi, r8
sub ecx, edx
jns 0x14000fe7b
jmp 0x14000fe86
cmp r8, rsi
je 0x14000febb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000fe86
xor al, 1
cmp rdi, rsi
jne 0x14000fe40
jmp 0x14000fe86
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140034880
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400345f0
ud2
lea rcx, [0x14003e0b8]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140034670
ud2
Function at 0x14001493c
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x1400460f0]
test r14, r14
jne 0x140014a73
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400149a6
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400149a6
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400149a6
mov r15, rax
xor ebx, ebx
jmp 0x140014a2b
lea rcx, [0x14003a478]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140014a87
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140014a87
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140014a87
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140014a87
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140014a87
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.140012b87
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1400460f0], r14
je 0x140014a73
mov rdi, rax
cmp qword [r14], 0
je 0x140014a63
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.14000ae20
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_ancil.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x14003a580]
mov edx, 0x5b
call fcn.140034ffc
ud2
Function at 0x140019940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14001999b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001999b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x1400199b6
cmp eax, 0x42
jne 0x14001999b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140019a66
cmp byte [r9 + r11], 0x5f
jne 0x140019a66
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x140019ace
mov rcx, rsi
xor edx, edx
call fcn.140015040
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140015040
test al, al
jne 0x140019b61
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400199f2
lea rdx, [0x14003a983]
mov r8d, 1
call fcn.14000da60
test al, al
jne 0x140019b61
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400199aa
xor r14d, r14d
lea rbx, [0x14003ad38]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140019a24
cmp byte [rax + rcx], 0x45
je 0x140019b83
sub r14, 1
jb 0x140019a49
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140019a49
mov r8d, 2
mov rdx, rbx
call fcn.14000da60
test al, al
jne 0x140019b61
mov rcx, rsi
call fcn.140016910
test al, al
jne 0x140019b61
mov rax, qword [rsi]
test rax, rax
jne 0x140019a10
jmp 0x1400199aa
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140019b28
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140019ac2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x140019aac
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x140019a9b
add dl, 0xa9
jmp 0x140019aaa
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140019b28
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140019b28
movzx edx, bl
add rax, rdx
jae 0x140019a70
jmp 0x140019b28
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140019b28
cmp rax, rcx
jae 0x140019b25
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x140019b7b
cmp qword [rsi + 0x20], 0
je 0x140019b74
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140019940
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400199ac
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140019b69
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x14003acf8]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14000da60
test al, al
je 0x140019b69
mov dil, 2
jmp 0x1400199aa
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1400199aa
mov dil, 1
xor r8d, r8d
jmp 0x140019b2a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400199aa
Function at 0x14001e1e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14003ce78]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001e253
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14001e28a
test eax, eax
js 0x14001e264
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14001e27d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x14003cee0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14001c270
mov rcx, rax
call fcn.14001c3b0
mov ecx, 7
int 0x29
ud2
Function at 0x140021560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140021590
test ecx, ecx
jne 0x1400215e0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14002159c
test ecx, ecx
jne 0x1400215e0
mov rcx, rdi
call fcn.140021440
movzx eax, al
test bpl, bpl
jne 0x1400215e7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x1400215d3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140021758]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x1400215d3.2
xor eax, eax
test bpl, bpl
je 0x1400215ac
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140021739
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14002161a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140021699
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140021660
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14002167b
inc rax
dec rdi
cmp rax, 1
jne 0x140021640
jmp 0x140021699
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14002167b
cmp ebx, 0x5c
je 0x14002167b
inc rax
dec rdi
cmp rax, 1
jne 0x140021660
jmp 0x140021699
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140021747
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x1400216c3
mov al, 9
cmp rdx, 2
je 0x1400216c7
cmp rdx, 1
jne 0x1400216d7
cmp byte [r8], 0x2e
jne 0x1400216d7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x1400216d7
mov al, 0xa
jmp 0x1400216d7
cmp byte [r8], 0x2e
jne 0x1400216d7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x1400215d3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x1400215d3.2
mov ecx, 2
jmp case.0x1400215d3.2
lea r8, str.library_std_srcpath.rs
call fcn.140034570
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140034570
ud2
Function at 0x1400249d0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14003ce78]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140024a3c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140024a4b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140024a83
cmp eax, 0x103
je 0x140024a8d
test eax, eax
js 0x140024a68
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140024a83
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x14003cee0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14001c270
mov rcx, rax
call fcn.14001c3b0
mov ecx, 7
int 0x29
ud2
Function at 0x140025200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x14002525c
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x140025350
test r15w, r15w
je 0x14002525c
cmp r15w, 0x2e
jne 0x140025350
test r12w, r12w
jne 0x140025350
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
je 0x140025335
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
mov r15, qword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x1400252b1
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x140025335
cmp word [rsp + 0xac], 0x2e
jne 0x1400252da
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x1400252a0
cmp ax, 0x2e
jne 0x1400252da
cmp word [rsp + 0xb0], 0
je 0x1400252a0
lock inc qword [r14]
jle 0x140025439
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x14002537b
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400253c7
mov qword [rsi], 0
jmp 0x140025427
lock inc qword [r14]
jle 0x140025439
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.1400342d0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.1400342d0
jmp 0x1400253da
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call fcn.1400342d0
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x1400285d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x140028613
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x1400229d0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400344b0
ud2

Function at 0x14002dbb3
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14002dbe6
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14002dbeb
call fcn.1400285d0
mov ecx, dword [0x14004626c]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret

Function at 0x140033fd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14003401a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003401a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003401a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003401a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003401a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003401c
xor al, al
add rsp, 0x28
ret
Function at 0x1400028b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400028f9
nop dword [rax + rax]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14003f82c
test rax, rax
jne 0x14000290b
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400028e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009c00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140009c22
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140009c9c
mov rdi, r14
mov rcx, rbx
call fcn.14000f780
test rax, rax
jle 0x140009c74
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400401d0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140009c8c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140009c94
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140009c36
sub r14, rdi
jmp 0x140009d7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140009cb3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009cb5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009ce7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400401d0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140009d7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140009d22
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140009d5d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400492d0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140009d7c
cmp rbp, rax
ja 0x140009d30
test rbp, rbp
je 0x140009d7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400492d0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x140013ff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140014024
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140014010
ret
Function at 0x1400179c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017a0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017a0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017a0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017a0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140017a0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017a10
xor al, al
add rsp, 0x28
ret

Function at 0x140017cc0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140017d44
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14006b4f0]
cmp byte [rcx + rax], 0
je 0x140017d44
dec r8
sub rdx, 1
jne 0x140017d2a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140034728
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14001f02e
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14001f011
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14001effc

Function at 0x14004adcc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004abbc