joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c550
Capabilities:
Read file on windows

Disassembly:
movsxd rax, dword [rcx - 4]
sub rcx, rax
jmp 0x14001c550
push rbx
push rsi
push r12
sub rsp, 0x40
lea rsi, [rcx - 0xe4]
xor r12d, r12d
mov rbx, rcx
mov dword [rsi + 4], 0xffffffff
mov dword [rsi], r12d
lea r9, [rsp + 0x68]
mov rcx, qword [rcx - 0x38]
mov rdx, rsi
lea r8d, [r12 + 8]
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001c6b6
cmp dword [rsp + 0x68], r12d
je 0x14001c6b6
mov qword [rsp + 0x70], rbp
lea rcx, [rbx - 0xf8]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r14
mov r14d, dword [rsi]
mov edx, r14d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x60], r12d
call fcn.14001a390
movzx ebp, al
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbx - 0xf0]
lea r9, [rsp + 0x60]
mov rcx, qword [rbx - 0x38]
mov r8d, r14d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test eax, eax
je 0x14001c60b
cmp dword [rsp + 0x60], r12d
jne 0x14001c616
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x14001c68e
test edi, edi
jne 0x14001c634
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14001c634
mov eax, dword [rsp + 0x60]
add qword [rbx - 0xf0], rax
jmp 0x14001c5e0
test bpl, bpl
je 0x14001c688
lea rdx, [0x14001b8d0]
lea rcx, [rsp + 0x60]
call fcn.14001b4f0
mov rax, qword [rsp + 0x60]
lea rcx, [rbx - 0xf8]
mov r8, qword [rbx - 0xf0]
mov r9, rsi
mov edx, dword [rsi]
mov qword [rbx - 0x40], rax
call fcn.140019db0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rsi
pop rbx
ret
movzx eax, bpl
jmp 0x14001c66b
lea rcx, str.Pipe_Broke._n
call fcn.14001a720
test edi, edi
jne 0x14001c6b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Read_header_failed._GLE_d_n
call fcn.14001a720
xor al, al
jmp 0x14001c66b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14001c6d8
lea rcx, str.Pipe_Broke._n
call fcn.14001a720
xor al, al
add rsp, 0x40
pop r12
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ReadFile_failed__GLE_d._n
call fcn.14001a720
xor al, al
add rsp, 0x40
pop r12
pop rsi
pop rbx
ret

Function at 0x14002e4a0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14002e4ff
mov rax, qword [rcx + 8]
add rcx, 8
movsxd r8, dword [rax + 4]
add rcx, r8
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x14002e4ff
lea rcx, [rbx + 0x48]
call fcn.140045380
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdx, qword [rbx + 0x40]
mov rax, qword [rdx + 8]
add rdx, 8
movsxd rcx, dword [rax + 4]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.Qt5Widgets.dll_protected_virtual:_void___cdecl_QWidget::closeEvent_class_QCloseEvent____ptr64____ptr64]
Function at 0x1400342f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rsi
mov rax, qword [0x140178a90]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, rcx
add rcx, 0x180
cmp qword [rcx + 0x18], 0x10
jb 0x140034330
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea r8, str.IOM_VERSION
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x140034475
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140034475
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r9, rax
lea ecx, [rbx + 1]
mov edx, ecx
lea rax, [rcx + 0xf]
cmp rax, rdx
ja 0x1400343a4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140061550
sub rsp, rax
lea rdi, [rsp + 0x20]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
mov qword [rbp + 0x20], 0xf
xor r8d, r8d
mov qword [rbp + 0x18], r8
mov byte [rbp + 8], r8b
cmp byte [rdi], r8b
je 0x1400343ed
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x1400343e3
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.140008170
nop
lea rcx, [r14 + 0x160]
lea rax, [rbp + 8]
cmp rcx, rax
je 0x14003441b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
call fcn.140008040
nop
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x140034475
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x140034470
test cl, 0x1f
je 0x140034440
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140034450
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140034460
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14003446d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140060dd4
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140061450
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
lea rsp, [rbp + 0x30]
pop r14
pop rdi
pop rbp
ret
Function at 0x14003f600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
movzx ebx, r8b
mov rdi, rdx
mov rsi, rcx
mov r11, qword [rcx]
mov r10, qword [r11 + 8]
mov r8b, 1
nop dword [rax]
cmp byte [r10 + 0x19], 0
jne 0x14003f6a0
mov r11, r10
test bl, bl
je 0x14003f66a
mov rax, qword [r10 + 0x20]
mov rcx, qword [r9]
cmp rax, rcx
jae 0x14003f64f
mov r8b, 1
jmp 0x14003f664
jbe 0x14003f656
xor r8b, r8b
jmp 0x14003f664
movzx eax, word [r9 + 8]
cmp word [r10 + 0x28], ax
setl r8b
xor r8b, 1
jmp 0x14003f690
mov rax, qword [r9]
mov rcx, qword [r10 + 0x20]
cmp rax, rcx
jae 0x14003f67b
mov r8b, 1
jmp 0x14003f690
jbe 0x14003f682
xor r8b, r8b
jmp 0x14003f690
movzx eax, word [r10 + 0x28]
cmp word [r9 + 8], ax
setl r8b
test r8b, r8b
je 0x14003f69a
mov r10, qword [r10]
jmp 0x14003f69e
mov r10, qword [r10 + 0x10]
jmp 0x14003f630
mov rax, r11
mov qword [rsp + 0x30], rax
test r8b, r8b
je 0x14003f746
mov rcx, qword [rsi]
cmp r11, qword [rcx]
jne 0x14003f6ef
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
mov r8b, 1
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14003f060
mov rcx, qword [rax]
mov qword [rdi], rcx
mov byte [rdi + 8], 1
mov rax, rdi
jmp 0x14003f79e
cmp byte [r11 + 0x19], 0
je 0x14003f6fc
mov rax, qword [r11 + 0x10]
jmp 0x14003f741
mov rcx, qword [r11]
cmp byte [rcx + 0x19], 0
jne 0x14003f720
mov rax, rcx
nop dword [rax + rax]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
jne 0x14003f741
mov rax, rcx
jmp 0x14003f710
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x14003f739
cmp rax, qword [rcx]
jne 0x14003f739
mov rax, rcx
mov qword [rsp + 0x30], rcx
jmp 0x14003f720
cmp byte [rax + 0x19], 0
cmove rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x20]
mov rdx, qword [r9]
cmp rcx, rdx
jb 0x14003f770
ja 0x14003f764
movzx ecx, word [r9 + 8]
cmp word [rax + 0x28], cx
setl cl
test cl, cl
jne 0x14003f770
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
jmp 0x14003f79e
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14003f060
mov rcx, qword [rax]
mov qword [rdi], rcx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140040b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
mov r11, qword [rcx]
mov r10, qword [r11 + 8]
mov r8b, 1
nop dword [rax]
cmp byte [r10 + 0x19], 0
jne 0x140040bdf
mov r11, r10
test bl, bl
je 0x140040b8f
mov r8, qword [r9]
mov rax, qword [r10 + 0x20]
cmp rax, r8
jne 0x140040b53
xor r8b, r8b
jmp 0x140040b89
mov rax, qword [rax + 0x10]
mov r8, qword [r8 + 0x10]
cmp rax, r8
jne 0x140040b65
xor r8b, r8b
jmp 0x140040b89
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140040b83
inc rax
test ecx, ecx
jne 0x140040b70
test edx, edx
sets r8b
xor r8b, 1
jmp 0x140040bc9
mov r8, qword [r10 + 0x20]
mov rcx, qword [r9]
cmp rcx, r8
je 0x140040bd3
mov rcx, qword [rcx + 0x10]
mov r8, qword [r8 + 0x10]
cmp rcx, r8
je 0x140040bd3
sub r8, rcx
nop dword [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140040bc3
inc rcx
test eax, eax
jne 0x140040bb0
test edx, edx
sets r8b
test r8b, r8b
je 0x140040bd6
mov r10, qword [r10]
jmp 0x140040bda
xor r8b, r8b
mov r10, qword [r10 + 0x10]
jmp 0x140040b30
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140040830
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140045520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x140178760]
cmp ecx, 0xffffffff
jne 0x140045548
xor esi, esi
jmp 0x140045551
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x140045643
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x140045576
test rbx, rbx
je 0x14004561c
jmp 0x140045580
test rbx, rbx
je 0x1400455d4
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400455b7
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x140045580
cmp qword [rsi + 0x30], 0
je 0x140045560
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400455ff
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400455ff
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.14002eea0
cmp qword [rsi + 0x30], 0
jne 0x1400455e0
jmp 0x140045560
lea rdx, [0x140044eb0]
lea rcx, [0x140188090]
call fcn.140044c90
mov ecx, dword [0x140178760]
cmp ecx, 0xffffffff
je 0x140045643
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x140045673
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x140045673
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140045690
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x140045720]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rsi, rax
test rax, rax
jne 0x1400456d5
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rdi]
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400456f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400620f0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r15
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140062125
or rax, 0xffffffffffffffff
add rsp, 0x78
pop r15
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x90], rbx
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14006152c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
xor ebx, ebx
test eax, eax
jle 0x140062229
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x70], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14006152c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jl 0x1400621a0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14000a0a0
mov esi, eax
cmp dword [rsp + 0x40], ebx
jle 0x140062269
mov rdi, r14
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140062269
call fcn.140061534
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jl 0x140062250
mov rcx, r14
call fcn.140061534
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x78
pop r15
pop rdi
ret
Function at 0x14000f9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000fa50
cmp r10, r11
jb 0x14000fac6
cmp r10, rdx
ja 0x14000fada
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000fa52
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000fa30
jmp 0x14000fab4
ja 0x14000fa5a
mov r11, r10
cmp rax, r8
jne 0x14000f9f4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000fa90
mov rdi, r8
sub ecx, edx
jns 0x14000faab
jmp 0x14000fab6
cmp r8, rsi
je 0x14000faeb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000fab6
xor al, 1
cmp rdi, rsi
jne 0x14000fa70
jmp 0x14000fab6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140024420
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400241b0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140024230
ud2

Function at 0x1400114ce
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rdi, qword [rdi]
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
call fcn.1400115be
cmp eax, 0x1edab0ed
jne 0x1400114f6
mov r14, qword [rdi + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov eax, dword [rax + r14 + 0x88]
test rax, rax
je 0x14001158f
mov edi, dword [rax + r14 + 0x18]
mov ecx, dword [rax + r14 + 0x1c]
add rcx, r14
mov qword [rsp + 0x20], rcx
mov r12d, dword [rax + r14 + 0x20]
add r12, r14
mov r13d, dword [rax + r14 + 0x24]
add r13, r14
xor ebx, ebx
xor r15d, r15d
cmp r15, rdi
je 0x140011591
mov rbp, r15
mov ecx, dword [r12 + r15*4]
add rcx, r14
mov rdx, 0xffffffffffffffff
cmp byte [rcx + rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x14001155f
lea r15, [rbp + 1]
call fcn.1400115be
cmp eax, esi
jne 0x140011549
movzx ecx, word [r13 + rbp*2]
cmp rdi, rcx
jbe 0x1400115ad
mov rax, qword [rsp + 0x20]
mov ebx, dword [rax + rcx*4]
add rbx, r14
jmp 0x140011591
xor ebx, ebx
movzx eax, word [rbx + 4]
add rbx, 0x12
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Users4.cargogitcheckouts_rust_syscalls_37fffce23c87cda7162451a_src_syscall_resolve.rs
mov rdx, rdi
call fcn.1400240b0
ud2
Function at 0x1400115be
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x1400115fa
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x1400115d9
inc r8
jmp 0x1400115c6
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x1400115d4
ret
Function at 0x140015fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14001603b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001603b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140016056
cmp eax, 0x42
jne 0x14001603b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140016106
cmp byte [r9 + r11], 0x5f
jne 0x140016106
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001616e
mov rcx, rsi
xor edx, edx
call fcn.140011810
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140011810
test al, al
jne 0x140016201
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140016092
lea rdx, [0x1400a6373]
mov r8d, 1
call fcn.14000d720
test al, al
jne 0x140016201
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001604a
xor r14d, r14d
lea rbx, [0x1400a6756]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400160c4
cmp byte [rax + rcx], 0x45
je 0x140016223
sub r14, 1
jb 0x1400160e9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400160e9
mov r8d, 2
mov rdx, rbx
call fcn.14000d720
test al, al
jne 0x140016201
mov rcx, rsi
call fcn.140016240
test al, al
jne 0x140016201
mov rax, qword [rsi]
test rax, rax
jne 0x1400160b0
jmp 0x14001604a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1400161c8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140016162
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001614c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001613b
add dl, 0xa9
jmp 0x14001614a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400161c8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400161c8
movzx edx, bl
add rax, rdx
jae 0x140016110
jmp 0x1400161c8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400161c8
cmp rax, rcx
jae 0x1400161c5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001621b
cmp qword [rsi + 0x20], 0
je 0x14001622f
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140015fe0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001604c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140016209
lea rax, [0x1400a6721]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14000d720
test al, al
je 0x140016209
mov dil, 2
jmp 0x14001604a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14001604a
mov dil, 1
xor r8d, r8d
jmp 0x1400161ca
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001604a
xor edi, edi
jmp 0x14001604a
Function at 0x14001d4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14001d520
test ecx, ecx
jne 0x14001d570
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14001d52c
test ecx, ecx
jne 0x14001d570
mov rcx, rdi
call fcn.14001d3d0
movzx eax, al
test bpl, bpl
jne 0x14001d577
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x14001d563.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x14001d6e8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x14001d563.2
xor eax, eax
test bpl, bpl
je 0x14001d53c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14001d6c9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14001d5aa
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x14001d629
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x14001d5f0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14001d60b
inc rax
dec rdi
cmp rax, 1
jne 0x14001d5d0
jmp 0x14001d629
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14001d60b
cmp ebx, 0x5c
je 0x14001d60b
inc rax
dec rdi
cmp rax, 1
jne 0x14001d5f0
jmp 0x14001d629
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x14001d6d7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x14001d653
mov al, 9
cmp rdx, 2
je 0x14001d657
cmp rdx, 1
jne 0x14001d667
cmp byte [r8], 0x2e
jne 0x14001d667
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14001d667
mov al, 0xa
jmp 0x14001d667
cmp byte [r8], 0x2e
jne 0x14001d667
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x14001d563.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x14001d563.2
mov ecx, 2
jmp case.0x14001d563.2
lea r8, str.library_std_srcpath.rs
call fcn.140024130
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140024130
ud2

Function at 0x140023b90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140023bda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140023bda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140023bda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140023bda
cmp dword [rcx + 0x84], 0xe
jbe 0x140023bda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140023bdc
xor al, al
add rsp, 0x28
ret