joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180077d54
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18006b170
xor ebx, ebx
mov rdi, rax
cmp qword [0x1800be680], rbx
jne 0x180077e5a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180077f2f
lea rdx, [0x18009b1a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180077f2f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x18009b198]
mov rcx, rsi
mov qword [0x1800be680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800be688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1800be690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800be6a0], rax
test rax, rax
je 0x180077e51
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800be698], rax
jmp 0x180077e61
mov rax, qword [0x1800be698]
jmp 0x180077e68
mov rax, qword [0x1800be698]
mov r11, qword [0x1800be6a0]
cmp rax, rdi
je 0x180077ed0
cmp r11, rdi
je 0x180077ed0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800be6a0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180077ed0
test rax, rax
je 0x180077ed0
call rsi
test rax, rax
je 0x180077eca
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180077eca
test byte [rsp + 0x38], 1
jne 0x180077ed0
bts ebp, 0x15
jmp 0x180077f0e
mov rcx, qword [0x1800be688]
cmp rcx, rdi
je 0x180077f0e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180077f0e
call rax
mov rbx, rax
test rax, rax
je 0x180077f0e
mov rcx, qword [0x1800be690]
cmp rcx, rdi
je 0x180077f0e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180077f0e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800be680]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180077f2f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180077f31
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002d10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140002d57
mov r15d, 8
sub r15, r11
cmp r15, r8
mov rax, r8
cmovb rax, r15
cmp rax, 3
jbe 0x140002d5f
mov r14d, dword [rdx]
mov r10d, 4
mov rcx, r10
or rcx, 1
cmp rcx, rax
jb 0x140002d71
jmp 0x140002d88
xor r15d, r15d
jmp 0x140002e15
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140002d88
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x140002d9f
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x140002dbf
add r11, r8
jmp 0x140002efa
mov rdi, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x30], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rcx
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140002e93
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
nop dword [rax + rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140002e40
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 3
jbe 0x140002eb1
mov esi, dword [rdx + r15]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r11
jb 0x140002ec2
jmp 0x140002edc
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x140002edc
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x140002ef6
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140007f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r12, rdx
mov r14, rcx
mov rcx, qword [rdx + 0x40]
mov r9, qword [rdx + 0x48]
cmp rcx, r9
jne 0x140007fc2
mov r15, qword [r12 + 0x30]
mov r13, qword [r12 + 0x38]
cmp qword [r12], 0
je 0x140007fed
mov rdi, qword [r12 + 0x18]
mov sil, 1
test rdi, rdi
je 0x140008030
cmp rdi, r13
mov r9, r13
cmovb r9, rdi
mov rdx, qword [r12 + 8]
mov rax, qword [r12 + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r15
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
je 0x140008046
mov r9, qword [rsp + 0x28]
xor esi, esi
test r13, r13
jne 0x140008058
jmp 0x140008038
ja 0x14000814e
mov r13, qword [r12 + 0x38]
cmp r9, r13
ja 0x14000813a
sub r9, rcx
add rcx, qword [r12 + 0x30]
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], r9
xor eax, eax
jmp 0x1400080f8
mov rdi, qword [r12 + 0x18]
test rdi, rdi
je 0x14000810f
cmp rdi, r13
mov r9, r13
cmovb r9, rdi
mov rdx, qword [r12 + 8]
mov rax, qword [r12 + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r15
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
je 0x140008114
mov r9, qword [rsp + 0x28]
jmp 0x1400080ef
xor r9d, r9d
test r13, r13
jne 0x140008058
test sil, sil
je 0x1400080ef
jmp 0x140008121
mov r9, qword [rsp + 0x28]
sub rdi, r9
mov qword [r12 + 0x18], rdi
test r13, r13
je 0x140008038
mov dword [rsp + 0x34], esi
mov ebx, dword [r12 + 0x28]
mov ecx, dword [r12 + 0x20]
mov esi, dword [r12 + 0x24]
xor ebp, ebp
lea r8, [0x14005478c]
nop word cs:[rax + rax]
nop
mov r11d, ebx
movzx edx, bl
or ebx, 3
mov edi, ebx
and edi, 0xfffffffe
imul edi, ebx
shr edi, 8
xor dil, byte [r15 + rbp]
mov ebx, ecx
shr ebx, 8
xor cl, dil
movzx r10d, cl
mov ecx, ebx
xor ecx, dword [r8 + r10*4]
movzx ebx, cl
add ebx, esi
imul esi, ebx, 0x8088405
add esi, 1
mov eax, esi
shr eax, 0x18
shr r11d, 8
xor edx, eax
mov ebx, r11d
xor ebx, dword [r8 + rdx*4]
mov byte [r15 + rbp], dil
add rbp, 1
cmp r13, rbp
jne 0x140008080
mov dword [r12 + 0x28], ebx
mov dword [r12 + 0x20], ecx
mov dword [r12 + 0x24], esi
mov esi, dword [rsp + 0x34]
test sil, sil
jne 0x140008121
mov qword [r14 + 8], r9
mov eax, 1
mov qword [r14], rax
mov rax, r14
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
jmp 0x140008121
mov r9, qword [rsp + 0x28]
sub rdi, r9
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x48], r9
mov qword [r12 + 0x40], 0
xor ecx, ecx
cmp r9, r13
jbe 0x140007fd6
lea r8, str.C:Usersdddddd.cargo_registry_srcgithub.com_1ecc6299db9ec823_flate2_1.0.24_src_bufreader.rs
mov rcx, r9
mov rdx, r13
call fcn.140052ae0
ud2
lea r8, str.C:Usersdddddd.cargo_registry_srcgithub.com_1ecc6299db9ec823_flate2_1.0.24_src_bufreader.rs
mov rdx, r9
call fcn.140052af0
ud2
Function at 0x140009360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, rcx
cmp dx, 3
jne 0x14000939f
mov qword [r15 + 8], 2
lea rax, str.Compression_method_not_supported
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0x20
mov qword [r15], 1
jmp 0x140009553
mov r14, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
test r14, r14
je 0x140009402
mov r11, qword [rsp + 0x140]
cmp byte [rsp + 0x128], 0
je 0x140009415
mov r10, qword [rsp + 0x120]
mov rax, r10
shr rax, 0x31
and eax, 0x7f
mov rdx, r10
shr rdx, 0x23
and edx, 0x1fe0
or rdx, rax
shr r10, 0x15
and r10d, 0xf800
or r10, rdx
shl r10, 0x10
mov r8d, 1
jmp 0x14000941b
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x50], xmm0
xor ecx, ecx
jmp 0x140009530
xor r8d, r8d
xor r10d, r10d
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x2345678912345678
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x34567890
test r11, r11
je 0x1400094a5
mov edx, 0x12345678
mov ecx, 0x23456789
mov edi, 0x34567890
xor ebx, ebx
lea rax, [0x14005478c]
mov ebp, edx
xor dl, byte [r14 + rbx]
shr ebp, 8
movzx esi, dl
mov edx, ebp
xor edx, dword [rax + rsi*4]
movzx esi, dl
add esi, ecx
imul ecx, esi, 0x8088405
add ecx, 1
mov esi, ecx
shr esi, 0x18
movzx ebp, dil
shr edi, 8
xor ebp, esi
xor edi, dword [rax + rbp*4]
add rbx, 1
cmp r11, rbx
jne 0x140009460
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ecx
mov dword [rsp + 0x40], edi
shl r9, 0x20
or r8, r9
or r8, r10
lea rcx, [rsp + 0x98]
lea rdx, [rsp + 0x20]
call fcn.14000a500
cmp qword [rsp + 0x98], 0
je 0x1400094ea
mov rax, qword [rsp + 0xa0]
mov qword [r15 + 8], 0
mov qword [r15 + 0x10], rax
mov eax, 1
mov qword [r15], rax
jmp 0x140009553
mov rax, qword [rsp + 0xa0]
movups xmm0, xmmword [rsp + 0xa8]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0xb8]
movaps xmmword [rsp + 0x80], xmm0
test rax, rax
je 0x140009566
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov ecx, 1
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [r15 + 0x28], xmm1
movups xmmword [r15 + 0x18], xmm0
mov qword [r15 + 8], rcx
mov qword [r15 + 0x10], rax
mov qword [r15], 0
mov rax, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [r15 + 8], 2
xor eax, eax
mov qword [r15], rax
jmp 0x140009553
Function at 0x14000a920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov r15, rdx
mov r14, rcx
mov rdi, qword [rdx + 0x10]
test rdi, rdi
je 0x14000a982
cmp rdi, r12
mov r9, r12
cmovb r9, rdi
mov rdx, qword [r15]
mov rax, qword [r15 + 8]
lea rcx, [rsp + 0x20]
mov r8, r13
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
je 0x14000a993
mov rax, qword [rsp + 0x28]
mov qword [r14 + 8], rax
mov qword [r14], 1
test r12, r12
jne 0x14000a9b3
jmp 0x14000aa35
xorps xmm0, xmm0
movups xmmword [r14], xmm0
test r12, r12
jne 0x14000a9b3
jmp 0x14000aa35
mov rax, qword [rsp + 0x28]
sub rdi, rax
mov qword [r15 + 0x10], rdi
mov qword [r14 + 8], rax
mov qword [r14], 0
test r12, r12
je 0x14000aa35
mov edi, dword [r15 + 0x20]
mov ecx, dword [r15 + 0x18]
mov edx, dword [r15 + 0x1c]
xor r11d, r11d
lea r8, [0x14005478c]
nop dword [rax]
mov r9d, edi
movzx esi, dil
or edi, 3
mov ebx, edi
and ebx, 0xfffffffe
imul ebx, edi
shr ebx, 8
xor bl, byte [r13 + r11]
mov edi, ecx
shr edi, 8
xor cl, bl
movzx r10d, cl
mov ecx, edi
xor ecx, dword [r8 + r10*4]
movzx edi, cl
add edi, edx
imul edx, edi, 0x8088405
add edx, 1
mov eax, edx
shr eax, 0x18
shr r9d, 8
xor esi, eax
mov edi, r9d
xor edi, dword [r8 + rsi*4]
mov byte [r13 + r11], bl
add r11, 1
cmp r12, r11
jne 0x14000a9d0
mov dword [r15 + 0x20], edi
mov dword [r15 + 0x18], ecx
mov dword [r15 + 0x1c], edx
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r12, r9
mov r14, r8
mov r13, rdx
mov rdi, rcx
cmp qword [rdx], 0
je 0x14000b5b0
mov rsi, qword [r13 + 0x18]
mov bl, 1
test rsi, rsi
je 0x14000b5f0
cmp rsi, r12
mov r9, r12
cmovb r9, rsi
mov rdx, qword [r13 + 8]
mov rax, qword [r13 + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r14
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
je 0x14000b605
mov r15, qword [rsp + 0x28]
xor ebx, ebx
test r12, r12
jne 0x14000b616
jmp 0x14000b5f8
mov rsi, qword [r13 + 0x18]
test rsi, rsi
je 0x14000b6b0
cmp rsi, r12
mov r9, r12
cmovb r9, rsi
mov rdx, qword [r13 + 8]
mov rax, qword [r13 + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r14
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
je 0x14000b744
mov r15, qword [rsp + 0x28]
jmp 0x14000b724
xor r15d, r15d
test r12, r12
jne 0x14000b616
test bl, bl
jne 0x14000b6b3
jmp 0x14000b724
mov r15, qword [rsp + 0x28]
sub rsi, r15
mov qword [r13 + 0x18], rsi
test r12, r12
je 0x14000b5f8
mov dword [rsp + 0x34], ebx
mov r11, rdi
mov ebx, dword [r13 + 0x28]
mov ecx, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x24]
xor edx, edx
lea r8, [0x14005478c]
nop word cs:[rax + rax]
nop dword [rax]
mov r10d, ebx
movzx edi, bl
or ebx, 3
mov esi, ebx
and esi, 0xfffffffe
imul esi, ebx
shr esi, 8
xor sil, byte [r14 + rdx]
mov ebx, ecx
shr ebx, 8
xor cl, sil
movzx r9d, cl
mov ecx, ebx
xor ecx, dword [r8 + r9*4]
movzx ebx, cl
add ebx, ebp
imul ebp, ebx, 0x8088405
add ebp, 1
mov eax, ebp
shr eax, 0x18
shr r10d, 8
xor edi, eax
mov ebx, r10d
xor ebx, dword [r8 + rdi*4]
mov byte [r14 + rdx], sil
add rdx, 1
cmp r12, rdx
jne 0x14000b640
mov dword [r13 + 0x28], ebx
mov dword [r13 + 0x20], ecx
mov dword [r13 + 0x24], ebp
mov rdi, r11
mov ebx, dword [rsp + 0x34]
test bl, bl
jne 0x14000b6b3
jmp 0x14000b724
xor r15d, r15d
test r15, r15
jne 0x14000b6ee
test r12, r12
je 0x14000b6ee
mov esi, dword [r13 + 0x40]
mov rax, qword [r13 + 0x30]
mov ecx, dword [r13 + 0x3c]
xor edx, edx
cmp dword [r13 + 0x38], 0
setne dl
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x2c], ecx
lea rcx, [rsp + 0x20]
call fcn.14000fcf0
cmp esi, eax
jne 0x14000b70d
cmp r15, r12
ja 0x14000b75b
add r13, 0x30
mov rcx, r13
mov rdx, r14
mov r8, r15
call fcn.14000fd00
mov qword [rdi + 8], r15
xor eax, eax
jmp 0x14000b72d
lea rdx, str.Invalid_checksumC:Usersdddddd.cargo_registry_srcgithub.com_1ecc6299db9ec823zip_0.5.13_srccrc32.rs
mov r8d, 0x10
mov cl, 0x27
call fcn.140009140
mov r15, rax
mov qword [rdi + 8], r15
mov eax, 1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsp + 0x28]
sub rsi, r15
mov qword [r13 + 0x18], rsi
test r15, r15
je 0x14000b6b8
jmp 0x14000b6ee
lea r8, [0x140054ee8]
mov rcx, r15
mov rdx, r12
call fcn.140052ae0
ud2
Function at 0x140017840
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140017871
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140017898
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x1400178cd
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x140071ea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm0
lea rax, [rax + 0x10]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14001a080]
mov qword [rbp - 0x28], rax
lea rax, [0x14005cbf8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400529f0
ud2
mov eax, dword [0x140071ea0]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 8], 0
je 0x140023f28
mov eax, dword [0x140071ea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x10]
ret
jmp 0x140017840
Function at 0x140017c00
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call fcn.140044ad0
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140017c82
jmp 0x140017cd0
mov rsi, r8
jae 0x140017d2d
cmp rsi, 0x201
jb 0x140017cd0
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x140017cad
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.1400518b0
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x140017cdd
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x140017d00
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140017d75
mov r8d, edi
cmp rsi, r8
jne 0x140017c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140017dcc
add rsi, rsi
cmp rsi, 0x201
jae 0x140017c82
jmp 0x140017cd0
cmp r14, r8
jb 0x140017de6
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14001cb90
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x140017da2
jmp 0x140017db5
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x140017db5
add rdx, rdx
je 0x140017db5
mov r8d, 2
mov rcx, r13
call fcn.140007f00
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_code8
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140052880
jmp 0x140017dfb
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140052ae0
ud2
Function at 0x140017e40
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x60]
mov rcx, rdi
call fcn.14002f470
cmp qword [rbp - 0x60], 0
je 0x140017eb1
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3f0], rax
lea rcx, [rbp + 0x3f0]
call fcn.1400117c0
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rbx, qword [rbp - 0x58]
movups xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x3d0], xmm0
test rbx, rbx
je 0x140017e93
mov qword [rbp + 0x3e8], rsi
movaps xmm0, xmmword [rbp + 0x3d0]
movups xmmword [rbp + 0x3c0], xmm0
mov qword [rbp + 0x3b8], rbx
mov rcx, rdi
xor edi, edi
mov r8d, 0x400
xor edx, edx
call fcn.140044ad0
mov qword [rbp + 0x3f0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f8], xmm0
mov esi, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
cmp rsi, 0x201
jae 0x140017f45
jmp 0x140017f90
mov rsi, r8
mov rbx, r13
jae 0x140017ff7
cmp rsi, 0x201
jb 0x140017f90
mov r8, rsi
sub r8, rdi
mov rax, qword [rbp + 0x3f8]
sub rax, rdi
cmp rax, r8
jae 0x140017f77
lea rcx, [rbp + 0x3f0]
mov rdx, rdi
call fcn.1400518b0
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x400], rsi
mov rdi, rsi
mov r15, qword [rbp + 0x408]
mov r12, r15
mov r14, rsi
jmp 0x140017f9d
lea r15, [rbp - 0x60]
mov r12, r15
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
jne 0x140017fc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140018035
mov r8d, ebx
cmp rsi, r8
jne 0x140017f30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400180d3
mov rbx, r13
add rsi, rsi
cmp rsi, 0x201
jae 0x140017f45
jmp 0x140017f90
cmp r14, r8
jb 0x1400180ed
lea rcx, [rbp + 0x3d0]
mov rdx, r12
call fcn.14001cb90
mov rsi, qword [rbp + 0x3d0]
movups xmm0, xmmword [rbp + 0x3d8]
movaps xmmword [rbp + 0x3a0], xmm0
mov dil, 1
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
jne 0x140018056
jmp 0x14001806d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
xor edi, edi
mov rbx, r13
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
je 0x14001806d
add rdx, rdx
je 0x14001806d
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140007f00
test dil, dil
je 0x14001808c
mov rax, qword [rbp + 0x3e8]
mov qword [rax], rsi
mov rsi, rax
movaps xmm0, xmmword [rbp + 0x3a0]
movups xmmword [rax + 8], xmm0
jmp 0x1400180a7
mov qword [rbp - 0x60], rsi
mov rsi, qword [rbp + 0x3e8]
mov qword [rsi], 0
lea rcx, [rbp - 0x60]
call fcn.1400117c0
mov rdx, qword [rbp + 0x3c0]
test rdx, rdx
je 0x140017e9a
add rdx, rdx
je 0x140017e9a
mov r8d, 2
mov rcx, rbx
call fcn.140007f00
jmp 0x140017e9a
lea rcx, str.internal_error:_entered_unreachable_code8
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140052880
jmp 0x140018102
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140052ae0
ud2
Function at 0x140018fe0
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140018fea
jmp fcn.140019000
mov rcx, rdx
mov rdx, r8
jmp fcn.140025170

Function at 0x140020b00
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.140043020
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xfd8], rcx
mov qword [rbp + 0xfe0], rdx
lea rdi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.140044ad0
lea rcx, [rbp + 0xff8]
xorps xmm6, xmm6
lea r15, [rbp + 0xfb0]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov r13, qword [sym.imp.KERNEL32.dll_SleepEx]
mov r9d, 0x1000
mov rdx, rbx
mov r8, rdi
call fcn.140029230
cmp qword [rbp + 0xff8], 0
jne 0x140020cd8
mov rdi, qword [rbp + 0x1000]
test rdi, rdi
je 0x140020cac
cmp rdi, 0x1000
ja 0x140020cfa
xor r14d, r14d
nop dword [rax]
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8, rdi
sub r8, r14
mov eax, 0xffffffff
cmp r8, rax
mov eax, 0xffffffff
cmovae r8d, eax
mov dword [rbp + 0x1008], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea rax, [rbp + 0x1008]
mov qword [rbp + 0xfc8], rax
lea rax, [0x140029540]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r9, r15
call r12
test eax, eax
je 0x140020c80
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0x1008], 1
jne 0x140020c30
mov eax, dword [rbp + 0x100c]
test rax, rax
jne 0x140020c86
mov eax, dword [rbp + 0x1010]
add r14, rax
cmp r14, rdi
je 0x140020c70
jbe 0x140020bc0
jmp 0x140020ce6
lea rdi, [rbp - 0x50]
lea rcx, [rbp + 0xff8]
jmp 0x140020b7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xff0], rax
mov qword [rbp + 0xfe8], 1
lea rcx, [rbp + 0xff0]
call fcn.1400117c0
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0x1000]
call fcn.1400117c0
jmp 0x140020cac
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r14
mov rdx, rdi
call fcn.140052af0
jmp 0x140020d0e
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, rdi
call fcn.140052ae0
ud2