joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b2060
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0062aa20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0062aa00]
test rbx, rbx
je 0x5b20b4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5b20ab
test r12, r12
je 0x5b20ab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5b2090
lea rcx, [0x0062aa20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x5b23f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00615120]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x5b2469
mov rcx, r10
call fcn.005b22c0
test eax, eax
je 0x5b2469
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x5b2466
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x5b245d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x5b2469
add r8, 0x28
cmp r8, r9
jne 0x5b2448
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14015f000
add rsp, 0x28
jmp 0x14003b60c
Function at 0x1400021b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400021d8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400021fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002200
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002259
test ecx, ecx
jle 0x140002239
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002259
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002259
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002280
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400022a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400022b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400022d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400022d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002312
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400023ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000234d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000238e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400023ae
cmp rbx, rax
ja 0x140002360
test rbx, rbx
je 0x1400023ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400027d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400027fd
xor eax, eax
jmp 0x14000295a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002828
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002828
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000295a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000294d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000286b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002896
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002952
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002905
sub eax, 1
je 0x140002905
cmp eax, 2
jne 0x14000294d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002952
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002933
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000294d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002952
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003470
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002e40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002f13
cmp byte [rcx + 0x71], 0
je 0x140002f13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002f0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002ed4
sub eax, 1
je 0x140002ed8
cmp eax, 2
jne 0x140002f0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003470
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002f06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002f0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002ebc
xor al, al
jmp 0x140002ebc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003470
add rsp, 0x60
pop rbx
ret

Function at 0x140003e04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003e4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003e4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003e4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003e4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140003e4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003e50
xor al, al
add rsp, 0x28
ret
Function at 0x140001350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0xa
lea rcx, [rsp + 0x20]
call fcn.140001540
nop
lea rcx, [rsp + 0x20]
call fcn.140001230
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400013e6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400016bc
movdqa xmm0, xmmword [0x1400033c0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
mov ebp, dword [rcx + rsi + 0x1c]
lea r14, [rsi + rbp]
mov r11d, dword [rcx + rsi + 0x20]
add r11, rsi
mov r15d, dword [rcx + rsi + 0x24]
add r15, rsi
xor edi, edi
mov ebx, edi
test ebp, ebp
je 0x14000149f
mov r10d, dword [r11]
add r10, rsi
mov edx, 0x35
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r10 + rax], dil
jne 0x140001436
mov r9d, edi
test rax, rax
je 0x140001470
mov r8, r10
nop word [rax + rax]
lea edx, [rdx + rdx*2]
movsx ecx, byte [r8]
add edx, ecx
inc r9d
lea r8, [r8 + 1]
movsxd rcx, r9d
cmp rcx, rax
jb 0x140001450
cmp edx, 0x103f598
je 0x14000147c
inc ebx
add r11, 4
cmp ebx, ebp
jae 0x14000149f
jmp 0x140001424
mov r8d, 0x103f598
mov rdx, r10
lea rcx, str.successfully_found___s____d_n
call fcn.140001010
mov eax, ebx
movzx ecx, word [r15 + rax*2]
mov edi, dword [r14 + rcx*4]
add rdi, rsi
mov rdx, rdi
lea rcx, str.0x_p_n
call fcn.140001010
xor r9d, r9d
lea r8, str...
lea rdx, str.Meow_meow_
xor ecx, ecx
call rdi
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140001ff4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000203e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000203e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000203e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000203e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000203e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002040
xor al, al
add rsp, 0x28
ret
Function at 0x140005800
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140005890
jmp 0x14000587f
jae 0x140005950
cmp r8, 0x201
jae 0x140005890
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400058e8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400058bf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400203f0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140005911
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400059b8
mov r8d, r14d
cmp r15, r8
jne 0x140005870
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400059db
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000587f
jmp 0x140005890
cmp rsi, r8
jb 0x1400059f5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140009140
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400059a1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140002990
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140005989
jmp 0x1400059a1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_d5c2e9c342b358556da91d61ed4133f6f50fc0c3library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140020f80
jmp 0x140005a0a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400213d0
ud2
Function at 0x140009b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140009b70
test ecx, ecx
jne 0x140009bc0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140009b7c
test ecx, ecx
jne 0x140009bc0
mov rcx, rdi
call fcn.140009a20
movzx eax, al
test bpl, bpl
jne 0x140009bc7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140009bb3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140009d38]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140009bb3.2
xor eax, eax
test bpl, bpl
je 0x140009b8c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140009d19
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140009bfa
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140009c79
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140009c40
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140009c5b
inc rax
dec rdi
cmp rax, 1
jne 0x140009c20
jmp 0x140009c79
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140009c5b
cmp ebx, 0x5c
je 0x140009c5b
inc rax
dec rdi
cmp rax, 1
jne 0x140009c40
jmp 0x140009c79
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140009d27
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140009ca3
mov al, 9
cmp rdx, 2
je 0x140009ca7
cmp rdx, 1
jne 0x140009cb7
cmp byte [r8], 0x2e
jne 0x140009cb7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140009cb7
mov al, 0xa
jmp 0x140009cb7
cmp byte [r8], 0x2e
jne 0x140009cb7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140009bb3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140009bb3.2
mov ecx, 2
jmp case.0x140009bb3.2
lea r8, str.library_std_srcpath.rs
call fcn.140021350
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140021350
ud2
Function at 0x14000eb60
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x20]
call fcn.140011200
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
test rax, rax
je 0x14000ec72
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.14000f9f0
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
test rax, rax
je 0x14000ec72
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], rdx
mov r8, qword [rbp + 0x50]
lea rcx, [rbp - 0x20]
mov rdx, rdi
call fcn.140011200
mov rax, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
test rax, rax
je 0x14000ec7f
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.14000f9f0
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
test rbx, rbx
je 0x14000ec7f
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x14000ed20]
lea r9, [rbp - 0x20]
mov r14, qword [rbp - 0x28]
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x14000ec90
mov rax, qword [rbp - 0x20]
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rdi, rdi
jne 0x14000ecae
jmp 0x14000ecc2
mov qword [rsi + 8], rdx
mov qword [rsi], 1
jmp 0x14000ecdc
mov r14, qword [rbp - 0x28]
mov qword [rsi + 8], rdi
mov qword [rsi], 1
jmp 0x14000ecc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdi, rdi
je 0x14000ecc2
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call fcn.140002990
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14000ecdc
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140002990
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret