joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4566a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45674f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004567a0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045f040
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004566a0
Function at 0x460f60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403943
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004093c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403920
cmp byte [0x005da8ec], 0
je 0x460f75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45e1c0
jmp 0x403920

Function at 0x460f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005dabc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005da8ec], 0
je 0x460fb5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005daea0]
aesenc xmm0, xmmword [0x005daeb0]
aesenc xmm0, xmmword [0x005daec0]
movq rax, xmm0
ret
jmp 0x4095e0

Function at 0x460fc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005dabc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005da8ec], 0
je 0x460ff6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005daea0]
aesenc xmm0, xmmword [0x005daeb0]
aesenc xmm0, xmmword [0x005daec0]
movq rax, xmm0
ret
jmp 0x409640

Function at 0x462cc0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x462cf4
mov rcx, 0x28
jmp 0x462cff
shl rcx, 3
add rcx, 0x1480
mov qword [0x005dab18], rcx
pop rbp
ret
Function at 0x46afc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b08a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403880
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46b06f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bb580]
xor ebx, ebx
mov rcx, rdx
call fcn.004481c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0046bc20
inc rbx
cmp rcx, rbx
jae 0x46b05e
mov edi, 1
lea rsi, [0x004bb580]
call fcn.004482a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004fa348]
lea rsi, [0x004f9b30]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046afc0
Function at 0x49df80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x49df97
inc rax
cmp rax, 4
jge 0x49dfaf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x49df94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x49dfc0
inc rax
cmp rax, 4
jge 0x49dfce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x49dff7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x49dfdb
jmp 0x49dfbd

Function at 0x4a2f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3109
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x4a3079
test r9, r9
je 0x4a3079
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x4a2f96
jae 0x4a2ff7
jmp 0x4a30fd
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x004bb080]
nop
call fcn.004481c0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop word [rax + rax]
cmp rsi, rcx
ja 0x4a30f2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.004ae960
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
nop
cmp rax, rcx
jae 0x4a30ed
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + rax*8], rsi
jmp 0x4a30c0
test r10, r10
jne 0x4a3082
xor edx, edx
jmp 0x4a30b1
nop
test rcx, rcx
jne 0x4a30a9
lea rax, [0x004bb080]
mov ebx, 1
mov rcx, rbx
call fcn.004481c0
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
add rsp, 0x68
pop rbp
ret
dec rcx
nop dword [rax]
test rcx, rcx
jle 0x4a30cf
mov rsi, qword [rdi + rcx*8 - 8]
test rsi, rsi
je 0x4a30ba
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
ja 0x4a30e8
mov rax, rdi
mov rbx, rcx
mov rcx, rdx
add rsp, 0x68
pop rbp
ret
call fcn.00461480
call fcn.00461400
mov rdx, rcx
mov rcx, rsi
call fcn.00461480
mov rdx, rcx
mov rcx, rbx
call fcn.00461480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop
jmp fcn.004a2f40
Function at 0x4a3980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3ac6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4a3ab6
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004ae600
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4a3a9b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4a3ab1
cmp rsi, rcx
ja 0x4a3aa9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4a3aa1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004ae740
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.004614c0
mov rax, rsi
call fcn.004614c0
call fcn.00461480
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.00461480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004a3980
Function at 0x4a3b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3c66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4a3c56
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004ae6a0
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4a3c3b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4a3c51
cmp rsi, rcx
ja 0x4a3c49
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4a3c41
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004ae7e0
xorps xmm15, xmm15
mov r14, qword [0x005dab18]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.004614c0
mov rax, rsi
call fcn.004614c0
call fcn.00461480
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.00461480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004a3b20
Function at 0x4a9540
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a96f2
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x4a9585
jae 0x4a95fe
nop
jmp 0x4a96e6
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x4a95c9
lea rax, [0x004bb080]
mov ebx, 1
mov rcx, rbx
call fcn.004481c0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x4a95fe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x004bb080]
nop
call fcn.004481c0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x4a9613
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x4a9645
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x4a9606
nop dword [rax + rax]
jmp 0x4a96db
test rsi, rsi
jle 0x4a9652
xor r8d, r8d
xor r9d, r9d
jmp 0x4a96a5
jmp 0x4a9657
dec rbx
test rbx, rbx
jle 0x4a9666
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x4a9654
cmp rbx, rcx
ja 0x4a9671
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.00461480
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x4a96b5
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x4a967c
jmp 0x4a96d0
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x4a96c5
mov qword [rax + rbx*8 - 8], r9
jmp 0x4a9652
mov rax, rsi
mov rcx, rbx
call fcn.00461400
mov rax, r10
mov rcx, rdx
call fcn.00461400
mov rax, r9
mov rcx, rbx
call fcn.00461400
mov rdx, rcx
mov rcx, rbx
call fcn.00461480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004a9540
Function at 0x100075150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100080558], rdi
je 0x1000751b0
cmp rax, rdi
jne 0x1000751a3
mov r12d, 1
jmp 0x1000751b0
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x100075189
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x1000751c5
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10007522c
mov eax, dword [0x100080550]
cmp eax, ebx
jne 0x100075222
mov dword [0x100080550], 1
lea r13, [0x100001b48]
lea rdi, [0x100001b30]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100075214
cmp eax, ebx
jne 0x100075214
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100075209
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000751f2
cmp eax, ebx
je 0x10007522c
mov eax, 0xff
jmp 0x100075374
mov dword [0x10007f924], 1
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x100075254
lea rdx, [0x100001b28]
lea rcx, [0x100001ab8]
call sub.msvcrt.dll__initterm
mov dword [0x100080550], 2
cmp r12d, ebx
jne 0x100075263
mov rax, rbx
xchg qword [0x100080558], rax
cmp qword [0x100080570], rbx
je 0x10007528b
lea rcx, [0x100080570]
call fcn.1000756ac
cmp eax, ebx
je 0x10007528b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100080570]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000752a1
mov eax, 0xff
jmp 0x100075374
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x100075326
cmp word [rcx], bx
je 0x1000752bc
cmp edx, ebx
jne 0x100075326
cmp word [rcx], bx
je 0x1000752d2
cmp word [rcx], 0x20
ja 0x1000752d2
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000337b8
mov dword [0x10007f920], eax
cmp dword [0x10007f904], ebx
jne 0x100075310
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007f924], ebx
jne 0x100075324
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10007f920]
jmp 0x100075374
cmp word [rcx], 0x22
jne 0x100075339
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1001f3000
add rsp, 0x28
jmp 0x100075150
Function at 0x140004b60
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140004c00
jmp 0x140004bef
jae 0x140004cbe
cmp r8, 0x201
jae 0x140004c00
lea rbx, [rbp - 0x58]
mov r14d, 0x200
mov rsi, r8
jmp 0x140004c57
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x140004c2f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.14001b860
mov r12, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov rbx, qword [rbp + 0x3e8]
mov r14, rdi
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x140004c7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004d26
mov r8d, r15d
cmp rsi, r8
jne 0x140004be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004d49
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x140004bef
jmp 0x140004c00
cmp r14, r8
jb 0x140004d63
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.140006430
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x140004d0f
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.1400020f0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140004cf7
jmp 0x140004d0f
lea rcx, [0x14001d88b]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001c310
jmp 0x140004d78
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001c6a0
ud2
Function at 0x140006d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x38]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140006d63
test ecx, ecx
jne 0x140006db2
movzx r15d, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140006d70
test ecx, ecx
jne 0x140006db2
mov rcx, rdi
call fcn.140006c10
movzx r10d, al
test bl, bl
jne 0x140006db9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x140006da6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x140006f2c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x140006da6.2
xor r10d, r10d
test bl, bl
je 0x140006d80
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140006f0e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x140006deb
xor edi, edi
jmp 0x140006e68
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x140006e30
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x140006e4b
inc rsi
dec rax
cmp rsi, 1
jne 0x140006e10
jmp 0x140006e68
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x140006e4b
cmp ebx, 0x5c
je 0x140006e4b
inc rsi
dec rax
cmp rsi, 1
jne 0x140006e30
jmp 0x140006e68
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x140006f1c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x140006e92
mov al, 9
cmp rdx, 2
je 0x140006e96
cmp rdx, 1
jne 0x140006ea6
cmp byte [r9], 0x2e
jne 0x140006ea6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140006ea6
mov al, 0xa
jmp 0x140006ea6
cmp byte [r9], 0x2e
jne 0x140006ea6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x140006da6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x140006da6.2
mov esi, 2
jmp case.0x140006da6.2
lea r8, str.library_std_srcpath.rs
call fcn.14001c690
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001c690
ud2
Function at 0x140019620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001969a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140019690
cmp r10, rax
jb 0x14001972d
cmp r10, rdx
ja 0x140019741
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140019692
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140019670
jmp 0x140019702
ja 0x14001969a
mov rax, r10
cmp r11, r8
jne 0x140019640
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140019706
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x1400196e0
mov rsi, rbx
sub ecx, edi
jns 0x1400196f9
jmp 0x140019708
cmp rbx, rdx
je 0x140019713
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x140019708
xor al, 1
cmp rsi, rdx
jne 0x1400196c0
jmp 0x140019708
xor eax, eax
jmp 0x140019708
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001c310
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14001c6b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001c6a0
ud2

Function at 0x14001b29c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b2e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b2e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b2e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b2e6
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b2e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b2e8
xor al, al
add rsp, 0x28
ret