joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002180
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12, r8
mov r14, rdx
mov r13, rcx
mov edi, r15d
test rdx, rdx
je 0x140002277
test r8, r8
je 0x140002277
mov qword [rsp + 0x50], rbx
mov ebx, r15d
cmp dword [rdx], ebx
jle 0x140002247
mov qword [rsp + 0x58], rbp
mov ebp, r15d
mov qword [rsp + 0x60], rsi
nop dword [rax]
mov rcx, qword [r12 + rbp*8]
lea rsi, [r12 + rbp*8]
lea rdx, [0x1400528f0]
call fcn.14002a1d4
test eax, eax
je 0x1400021fe
mov rcx, qword [rsi]
lea rdx, str._accepteula
call fcn.14002a1d4
mov edi, r15d
test eax, eax
jne 0x140002203
mov edi, 1
mov ecx, dword [r14]
test edi, edi
jne 0x140002215
inc ebx
inc rbp
cmp ebx, ecx
jl 0x1400021d0
jmp 0x14000223d
lea eax, [rcx - 1]
cmp ebx, eax
jge 0x140002237
nop dword [rax]
mov rax, qword [rsi + 8]
inc ebx
mov qword [rsi], rax
lea rsi, [rsi + 8]
mov ecx, dword [r14]
lea eax, [rcx - 1]
cmp ebx, eax
jl 0x140002220
lea eax, [rcx - 1]
mov dword [r14], eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov edx, edi
mov rcx, r13
call fcn.140002350
mov rbx, qword [rsp + 0x50]
test eax, eax
mov eax, 1
cmovne edi, eax
test edi, edi
setne r15b
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x140002700
mov qword [rsp + 0x18], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12, r8
mov r14, rdx
mov r13, rcx
mov edi, r15d
lea eax, [r15 + 1]
test rdx, rdx
je 0x14000272f
test r8, r8
jne 0x140002771
mov edx, eax
lea rcx, str.Shell32.dll
call fcn.140002ac0
mov rcx, rax
lea rdx, str.CommandLineToArgvW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002807
lea r14, [0x140064d68]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov rdx, r14
call rbx
mov r12, rax
mov ebx, r15d
cmp dword [r14], ebx
jle 0x140002807
mov qword [rsp + 0x50], rbp
mov rbp, r15
mov qword [rsp + 0x58], rsi
nop word [rax + rax]
mov rcx, qword [r12 + rbp*8]
lea rsi, [r12 + rbp*8]
lea rdx, [0x1400528c0]
call fcn.14002a3d4
test eax, eax
je 0x1400027be
mov rcx, qword [rsi]
lea rdx, [0x1400528d8]
call fcn.14002a3d4
mov edi, r15d
test eax, eax
jne 0x1400027c3
mov edi, 1
mov ecx, dword [r14]
test edi, edi
jne 0x1400027d5
inc ebx
inc rbp
cmp ebx, ecx
jl 0x140002790
jmp 0x1400027fd
lea eax, [rcx - 1]
cmp ebx, eax
jge 0x1400027f7
nop dword [rax]
mov rax, qword [rsi + 8]
inc ebx
mov qword [rsi], rax
lea rsi, [rsi + 8]
mov ecx, dword [r14]
lea eax, [rcx - 1]
cmp ebx, eax
jl 0x1400027e0
lea eax, [rcx - 1]
mov dword [r14], eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov edx, edi
mov rcx, r13
call fcn.140002350
mov rbx, qword [rsp + 0x60]
test eax, eax
mov eax, 1
cmovne edi, eax
test edi, edi
setne r15b
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002700
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12, r8
mov r14, rdx
mov r13, rcx
mov edi, r15d
test rdx, rdx
je 0x140002277
test r8, r8
je 0x140002277
mov qword [rsp + 0x50], rbx
mov ebx, r15d
cmp dword [rdx], ebx
jle 0x140002247
mov qword [rsp + 0x58], rbp
mov ebp, r15d
mov qword [rsp + 0x60], rsi
nop dword [rax]
mov rcx, qword [r12 + rbp*8]
lea rsi, [r12 + rbp*8]
lea rdx, [0x1400528f0]
call fcn.14002a1d4
test eax, eax
je 0x1400021fe
mov rcx, qword [rsi]
lea rdx, str._accepteula
call fcn.14002a1d4
mov edi, r15d
test eax, eax
jne 0x140002203
mov edi, 1
mov ecx, dword [r14]
test edi, edi
jne 0x140002215
inc ebx
inc rbp
cmp ebx, ecx
jl 0x1400021d0
jmp 0x14000223d
lea eax, [rcx - 1]
cmp ebx, eax
jge 0x140002237
nop dword [rax]
mov rax, qword [rsi + 8]
inc ebx
mov qword [rsi], rax
lea rsi, [rsi + 8]
mov ecx, dword [r14]
lea eax, [rcx - 1]
cmp ebx, eax
jl 0x140002220
lea eax, [rcx - 1]
mov dword [r14], eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov edx, edi
mov rcx, r13
call fcn.140002350
mov rbx, qword [rsp + 0x50]
test eax, eax
mov eax, 1
cmovne edi, eax
test edi, edi
setne r15b
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x140002700
mov qword [rsp + 0x18], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12, r8
mov r14, rdx
mov r13, rcx
mov edi, r15d
lea eax, [r15 + 1]
test rdx, rdx
je 0x14000272f
test r8, r8
jne 0x140002771
mov edx, eax
lea rcx, str.Shell32.dll
call fcn.140002ac0
mov rcx, rax
lea rdx, str.CommandLineToArgvW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002807
lea r14, [0x140064d68]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov rdx, r14
call rbx
mov r12, rax
mov ebx, r15d
cmp dword [r14], ebx
jle 0x140002807
mov qword [rsp + 0x50], rbp
mov rbp, r15
mov qword [rsp + 0x58], rsi
nop word [rax + rax]
mov rcx, qword [r12 + rbp*8]
lea rsi, [r12 + rbp*8]
lea rdx, [0x1400528c0]
call fcn.14002a3d4
test eax, eax
je 0x1400027be
mov rcx, qword [rsi]
lea rdx, [0x1400528d8]
call fcn.14002a3d4
mov edi, r15d
test eax, eax
jne 0x1400027c3
mov edi, 1
mov ecx, dword [r14]
test edi, edi
jne 0x1400027d5
inc ebx
inc rbp
cmp ebx, ecx
jl 0x140002790
jmp 0x1400027fd
lea eax, [rcx - 1]
cmp ebx, eax
jge 0x1400027f7
nop dword [rax]
mov rax, qword [rsi + 8]
inc ebx
mov qword [rsi], rax
lea rsi, [rsi + 8]
mov ecx, dword [r14]
lea eax, [rcx - 1]
cmp ebx, eax
jl 0x1400027e0
lea eax, [rcx - 1]
mov dword [r14], eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov edx, edi
mov rcx, r13
call fcn.140002350
mov rbx, qword [rsp + 0x60]
test eax, eax
mov eax, 1
cmovne edi, eax
test edi, edi
setne r15b
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002a30
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x140064198]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call fcn.140004410
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140002a9c
cmp dword [rsp + 0x24], 6
ja 0x140002a82
jne 0x140002a9c
cmp dword [rsp + 0x28], 0
jbe 0x140002a9c
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140002da0
add rsp, 0xd8
ret
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140002da0
add rsp, 0xd8
ret

Function at 0x14002a958
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14002a690
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002a690
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002a690
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002a690
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002a690
cmp dword [rcx + 0x84], 0xe
jbe 0x14002a690
cmp dword [rcx + 0xf8], esi
je 0x14002a690
mov ecx, r14d
call fcn.14002a860
mov ecx, 2
call fcn.140037d44
nop
cmp byte [0x1400654f0], 0
jne 0x14002a75a
mov r15d, 1
mov eax, r15d
xchg dword [0x1400654e4], eax
test ebx, ebx
jne 0x14002a703
mov rdi, qword [0x140064198]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400654e8]
cmp rcx, rax
je 0x14002a6fa
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x14004c430]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140065eb8]
jmp 0x14002a70f
cmp ebx, r15d
jne 0x14002a715
lea rcx, [0x140065ed0]
call fcn.14002ec94
nop
test ebx, ebx
jne 0x14002a72c
lea rdx, [0x14004c4b8]
lea rcx, [0x14004c490]
call fcn.14002c998
lea rdx, [0x14004c4c8]
lea rcx, [0x14004c4c0]
call fcn.14002c998
movzx eax, byte [0x1400654f0]
test esi, esi
cmove eax, r15d
mov byte [0x1400654f0], al
jmp 0x14002a75a
mov ecx, 2
call fcn.140037d98
test esi, esi
jne 0x14002a771
mov ecx, r14d
call fcn.14002a78c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14002a620
Function at 0x14006e920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x14006e952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x14006e9fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x14006e996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x14006e9e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14006e9b2
mov dword [rsp + 0x1c], 1
jmp 0x14006e9ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x14006e9e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14006e98c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x14006e948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret

Function at 0x14006eff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x6b
mov word [rsp + 0x20], ax
mov eax, 0x65
mov word [rsp + 0x22], ax
mov eax, 0x72
mov word [rsp + 0x24], ax
mov eax, 0x6e
mov word [rsp + 0x26], ax
mov eax, 0x65
mov word [rsp + 0x28], ax
mov eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, 0x33
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
mov eax, 0x2e
mov word [rsp + 0x30], ax
mov eax, 0x64
mov word [rsp + 0x32], ax
mov eax, 0x6c
mov word [rsp + 0x34], ax
mov eax, 0x6c
mov word [rsp + 0x36], ax
xor eax, eax
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x60]
call fcn.14006ea10
test eax, eax
jne 0x14006f0c3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x14006f0ec
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x30], 0
je 0x14006f0ec
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x50], rax
jne 0x14006f09c
mov rax, qword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x1407960b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140796237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407960e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407960c7
add dl, dl
jne 0x1407960ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079614e
xor eax, eax
add dl, dl
jne 0x1407960fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140796205
add dl, dl
jne 0x14079610e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079611b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140796142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407960d6
mov eax, 1
add dl, dl
jne 0x14079615e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079616b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140796153
sub eax, ebx
mov ebx, 1
jne 0x1407961a4
mov ecx, 1
add dl, dl
jne 0x140796186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140796193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079617b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407960d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407961c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407961cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407961b5
cmp eax, 0x7d00
jae 0x1407961f3
cmp eax, 0x500
jb 0x1407961ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407960d6
cmp eax, 0x7f
ja 0x1407961f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407960d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14079622a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407960d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400eb910
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400eb9a0
jmp 0x1400eb98f
jae 0x1400eba60
cmp r8, 0x201
jae 0x1400eb9a0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400eb9f8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400eb9cf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140127830
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400eba21
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400ebac8
mov r8d, r14d
cmp r15, r8
jne 0x1400eb980
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400ebaeb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400eb98f
jmp 0x1400eb9a0
cmp rsi, r8
jb 0x1400ebb05
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400efd80
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400ebab1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140003aa0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400eba99
jmp 0x1400ebab1
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140128580
jmp 0x1400ebb1a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140128ab0
ud2
Function at 0x1400ec9d0
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x1400ec9e0
mov rcx, rdx
mov rdx, r8
jmp fcn.1400ec9f0
mov rcx, rdx
mov rdx, r8
jmp fcn.1400f7ea0

Function at 0x1400f3f80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1401190f0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov rbx, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14011a600
mov dword [rbp + 0xfec], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r14, [rbp + 0xfec]
mov qword [rbp + 0xfc8], r14
lea r15, [0x1400fb780]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xfb0]
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1400f4171
mov r12, qword [sym.imp.kernel32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov r13, qword [sym.imp.kernel32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], rbx
mov ecx, 0xffffffff
mov edx, 1
call r12
cmp dword [rbp + 0xfec], 0
je 0x1400f4047
cmp dword [rbp + 0xff0], 0
jne 0x1400f4186
mov eax, dword [rbp + 0xff4]
test rax, rax
je 0x1400f4186
cmp eax, 0x1000
ja 0x1400f41d1
xor ebx, ebx
nop word cs:[rax + rax]
cmp rbx, rax
ja 0x1400f41b6
lea rdx, [rbx + rbp]
add rdx, 0xffffffffffffffb0
mov rdi, rax
mov r8d, eax
sub r8d, ebx
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r14
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call r13
test eax, eax
je 0x1400f4179
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r12
cmp dword [rbp + 0xfec], 0
je 0x1400f40f0
cmp dword [rbp + 0xff0], 0
jne 0x1400f417f
mov eax, dword [rbp + 0xff4]
add rbx, rax
mov rax, rdi
cmp rbx, rdi
jne 0x1400f4090
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r14
mov qword [rsp + 0x20], r15
mov rbx, qword [rbp + 0xfe0]
mov rcx, rbx
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x1400f4047
call qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1400f4186
call qword [sym.imp.kernel32.dll_GetLastError]
mov rbx, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbx
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rbx
mov qword [rbp + 0xfd0], rax
mov rdx, rax
call fcn.140128b20
jmp 0x1400f41ec
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov qword [rbp + 0xfd0], rax
mov rcx, rax
call fcn.140128ab0
ud2
Function at 0x1400f7ea0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
and al, ch
cmp dword [rsi - 0x74b80000], esp
mov eax, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je case.0x1400eeadc.406
lea eax, [rax]
add byte [rax], al
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
and al, 0x30
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.1400fa130
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je case.0x1400eeadc.406
mov rcx, rdi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
adc eax, 0x323a6
test eax, eax
je 0x1400f7f2b
test rsi, rsi
je 0x1400f7f27
add rsi, rsi
mov r8d, 2
add al, byte [rax]
add byte [rax], al
mov rcx, rdi
mov rdx, rsi
call fcn.140003aa0
invalid
xor esi, esi
jmp case.0x1400eeadc.406
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
shl ebx, 0x20
or rbx, 2
test rsi, rsi
je 0x1400f7f54
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.140003aa0
invalid
invalid
invalid
invalid
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400f88f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140141948]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400f8934
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400f8993
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1400f89a2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400f89da
cmp eax, 0x103
je 0x1400f89e4
test eax, eax
js 0x1400f89bf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400f89da
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.1400e4590
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1400ef9a0
mov rcx, rax
call fcn.1400e5920
mov ecx, 7
int 0x29
ud2
Function at 0x1400f8a40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140141948]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400f8a84
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400f8aea
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400f8b21
test eax, eax
js 0x1400f8afb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400f8b14
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.1400e4590
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1400ef9a0
mov rcx, rax
call fcn.1400e5920
mov ecx, 7
int 0x29
ud2

Function at 0x1400fa870
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x90], xmm6
mov qword [rbp + 0x88], 0xfffffffffffffffe
mov qword [rbp + 0x38], rcx
mov byte [rbp + 0x85], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x34], ecx
xor edi, edi
mov ebx, 8
mov sil, 1
xorps xmm6, xmm6
mov r14, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 0x18], rax
nop