joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14047ef40
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movdqu xmm5, xmmword [0x140658f90]
movdqu xmm6, xmmword [0x140658fa0]
movdqu xmm7, xmmword [0x140658fb0]
movdqu xmm4, xmmword [str._f__nc]
movdqu xmm3, xmmword [r9]
movdqu xmm2, xmmword [r9 + 0x10]
movdqu xmm1, xmmword [r9 + 0x20]
movdqu xmm0, xmmword [r9 + 0x30]
movdqu xmm11, xmmword [0x140658fc0]
movdqu xmm10, xmmword [0x140658fd0]
movdqu xmm9, xmmword [0x140658fe0]
movdqu xmm8, xmmword [0x140658ff0]
mov rax, rdx
mov r11, rcx
lea rdx, [rcx + 0x1c00]
lea rcx, [rcx + rax - 0x1c00]
mov r10, r11
lea rbx, [rcx + 0x3800]
mov rax, r10
cmp r10, rcx
jae 0x14047f09d
nop dword [rax]
aesdec xmm3, xmm11
aesenc xmm2, xmm10
aesenc xmm7, xmmword [rax]
sub rax, 0xffffffffffffff80
aesdec xmm1, xmm9
aesenc xmm0, xmm8
movups xmmword [rax - 0x80], xmm3
aesdec xmm6, xmmword [rax - 0x70]
aesenc xmm5, xmmword [rax - 0x60]
aesdec xmm4, xmmword [rax - 0x50]
movups xmmword [rax - 0x70], xmm2
prefetcht0 byte [rdx]
movups xmmword [rax - 0x60], xmm1
aesdec xmm3, xmm11
prefetcht0 byte [rdx + 0x40]
aesenc xmm2, xmm10
movups xmmword [rax - 0x50], xmm0
aesdec xmm1, xmm9
sub rdx, 0xffffffffffffff80
aesenc xmm0, xmm8
aesenc xmm7, xmmword [rax - 0x40]
aesdec xmm6, xmmword [rax - 0x30]
aesenc xmm5, xmmword [rax - 0x20]
movups xmmword [rax - 0x40], xmm3
aesdec xmm4, xmmword [rax - 0x10]
movups xmmword [rax - 0x30], xmm2
movups xmmword [rax - 0x20], xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rcx
jb 0x14047eff0
mov rax, rcx
sub rax, r10
sub rax, 1
and rax, 0xffffffffffffff80
lea r10, [r10 + rax + 0x80]
add rcx, 0x1c00
cmp rcx, rbx
je 0x14047f0b8
mov rdx, r11
jmp 0x14047efe0
movups xmmword [r9], xmm3
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmmword [r9 + 0x30], xmm0
movdqu xmm0, xmmword [0x140659000]
movups xmm10, xmmword [rsp + 0x40]
movups xmmword [r9 + 0x10], xmm2
movups xmm11, xmmword [rsp + 0x50]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r9 + 0x20], xmm1
aesdec xmm4, xmm0
movdqu xmm0, xmmword [0x140659010]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r8], xmm7
movups xmm7, xmmword [rsp + 0x10]
aesdec xmm4, xmm0
movups xmmword [r8 + 0x10], xmm6
movups xmm6, xmmword [rsp]
movups xmmword [r8 + 0x20], xmm5
movups xmmword [r8 + 0x30], xmm4
add rsp, 0x60
pop rbx
ret
Function at 0x1404fbf50
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movups xmmword [rsp + 0x60], xmm12
movups xmmword [rsp + 0x70], xmm13
mov rax, qword [0x140729730]
movdqu xmm0, xmmword [rcx]
movdqu xmm4, xmmword [rax + 0xb0]
movdqu xmm8, xmmword [rax + 0xf0]
movdqu xmm12, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
aesdec xmm0, xmm4
movdqu xmm5, xmmword [rax + 0xc0]
aesenc xmm12, xmm4
movdqu xmm9, xmmword [rax + 0x100]
aesdec xmm2, xmm8
aesenc xmm1, xmm8
add rdx, r8
sub r8, 0xffffffffffffff80
movdqu xmm6, xmmword [rax + 0xd0]
aesdec xmm0, xmm5
movdqu xmm10, xmmword [rax + 0x110]
aesenc xmm12, xmm5
movdqu xmm7, xmmword [rax + 0xe0]
aesdec xmm2, xmm9
movdqu xmm11, xmmword [rax + 0x120]
aesenc xmm1, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesdec xmm2, xmm10
aesenc xmm1, xmm10
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm11
aesenc xmm1, xmm11
movups xmmword [r8 - 0x80], xmm0
aesdec xmm0, xmm4
movups xmmword [r8 - 0x70], xmm12
aesenc xmm12, xmm4
aesdec xmm0, xmm5
movups xmmword [r8 - 0x60], xmm2
aesdec xmm2, xmm8
aesenc xmm12, xmm5
aesdec xmm0, xmm6
movups xmmword [r8 - 0x50], xmm1
aesenc xmm1, xmm8
aesdec xmm2, xmm9
aesenc xmm12, xmm6
aesenc xmm1, xmm9
aesdec xmm2, xmm10
aesdec xmm0, xmm7
aesenc xmm1, xmm10
aesenc xmm12, xmm7
aesdec xmm2, xmm11
movups xmmword [r8 - 0x40], xmm0
aesenc xmm1, xmm11
movups xmmword [r8 - 0x30], xmm12
movups xmmword [r8 - 0x20], xmm2
movups xmmword [r8 - 0x10], xmm1
cmp r8, rdx
jae 0x14047beed
mov rax, 0xffffffffff0707ff
movq xmm3, rax
punpcklqdq xmm3, xmm3
nop dword [rax + rax]
aesdec xmm0, xmm4
aesenc xmm12, xmm4
aesdec xmm2, xmm8
add r8, 0x40
aesdec xmm0, xmm5
aesenc xmm12, xmm5
aesdec xmm2, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesenc xmm1, xmm8
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm10
movdqa xmm13, xmm0
aesenc xmm1, xmm9
aesdec xmm2, xmm11
pand xmm13, xmm3
aesenc xmm1, xmm10
movups xmmword [r8 - 0x40], xmm13
movdqa xmm13, xmm12
aesenc xmm1, xmm11
pand xmm13, xmm3
movups xmmword [r8 - 0x30], xmm13
movdqa xmm13, xmm2
pand xmm13, xmm3
movups xmmword [r8 - 0x20], xmm13
movdqa xmm13, xmm1
pand xmm13, xmm3
movups xmmword [r8 - 0x10], xmm13
cmp r8, rdx
jb 0x14047be48
movups xmm6, xmmword [rsp]
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmm10, xmmword [rsp + 0x40]
movups xmm11, xmmword [rsp + 0x50]
movups xmm12, xmmword [rsp + 0x60]
movups xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
mov rax, rcx
mov rcx, rdx
mov rdx, qword [0x140729730]
lea r8, [rax + 0x40]
mov edx, dword [rdx + 0x20]
lea edx, [rdx*8 + 0x80]
jmp 0x14047bcb0
Function at 0x14058d900
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.msvcrt.dll__read]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, rdi
call fcn.14058d710
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call rbp
movsxd r13, eax
cmp eax, 0xffffffff
je 0x14058d950
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call r12
cmp dword [rax], 4
je 0x14058d923
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x1405a1e40
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [0x14072af60]
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov r13, rcx
test rax, rax
je 0x1405a1e90
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1405a1f24
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp rax
mov rdi, qword [sym.imp.msvcrt.dll__read]
mov ebx, 4
lea rsi, [rsp + 0x24]
mov rbp, qword [sym.imp.msvcrt.dll__errno]
nop dword [rax + rax]
mov ecx, dword [r13 + 0x10]
mov r8d, ebx
mov rdx, rsi
call rdi
test eax, eax
jle 0x1405a1ef0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1405a1eb0
mov eax, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1405a1f24
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0xffffffff
jne 0x1405a1f1b
call rbp
mov r14, rbp
cmp dword [rax], 4
je 0x1405a1eb0
call r14
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1405a1f24
mov ecx, dword [rax]
lea rdx, str.random_device_could_not_be_read
call fcn.1405f76c0
mov r14, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1405a1eff
call fcn.140466a70
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [str._qs_]
add rax, 0x10
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov edx, dword [rax - 8]
mov rax, qword [rcx + 8]
test edx, edx
jg 0x1405a1f60
mov dword [rax - 8], 1
ret
lock add dword [rax - 8], 1
ret
Function at 0x1405db0f0
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x1405db130
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x1405db118
cmp eax, 2
je 0x1405db120
cmp eax, 1
je 0x1405db128
ret
jmp 0x1405db280
jmp fcn.1405dc280
jmp 0x1405db6b0
mov dword [rcx + 0x90], 0x1b
ret
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0xb0]
mov rdi, qword [rcx + 0xc0]
lea rdx, [rax + 1]
mov qword [rcx + 0xb0], rdx
movzx ebp, byte [rax]
mov rbx, rcx
movsx edx, byte [rdi + rbp + 0x139]
mov rsi, rbp
test dl, dl
jne 0x1405db2e0
mov rax, qword [rdi]
lea rcx, [0x140526890]
movsx edx, bpl
mov r9, qword [rax + 0x40]
mov eax, ebp
cmp r9, rcx
jne 0x1405db550
cmp al, 0x20
je 0x1405db2e0
mov byte [rdi + rbp + 0x139], al
mov rcx, qword [rbx + 0xa0]
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1405db510
cmp sil, 0x5c
je 0x1405db3d0
cmp sil, 0x28
je 0x1405db3a8
cmp sil, 0x29
je 0x1405db4f8
cmp sil, 0x5b
je 0x1405db568
cmp sil, 0x7b
je 0x1405db4a8
test sil, sil
je 0x1405db600
mov eax, esi
and eax, 0xffffffdf
cmp al, 0x5d
je 0x1405db510
mov rbp, qword [rbx + 0xc0]
movzx r12d, sil
mov rdi, rbx
movzx eax, byte [rbp + r12 + 0x139]
test al, al
jne 0x1405db37a
mov rax, qword [rbp]
lea rdx, [0x140526890]
mov rax, qword [rax + 0x40]
cmp rax, rdx
jne 0x1405db5c0
mov byte [rbp + r12 + 0x139], sil
mov eax, esi
movzx edx, byte [rbx]
test dl, dl
jne 0x1405db394
jmp 0x1405db3c3
movzx edx, byte [rdi + 8]
add rdi, 8
test dl, dl
je 0x1405db3c3
cmp al, dl
jne 0x1405db388
mov eax, dword [rdi + 4]
invalid
invalid
nop
Function at 0x1405db280
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x1405db130
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x1405db118
cmp eax, 2
je 0x1405db120
cmp eax, 1
je 0x1405db128
ret
jmp 0x1405db280
jmp fcn.1405dc280
jmp 0x1405db6b0
mov dword [rcx + 0x90], 0x1b
ret
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0xb0]
mov rdi, qword [rcx + 0xc0]
lea rdx, [rax + 1]
mov qword [rcx + 0xb0], rdx
movzx ebp, byte [rax]
mov rbx, rcx
movsx edx, byte [rdi + rbp + 0x139]
mov rsi, rbp
test dl, dl
jne 0x1405db2e0
mov rax, qword [rdi]
lea rcx, [0x140526890]
movsx edx, bpl
mov r9, qword [rax + 0x40]
mov eax, ebp
cmp r9, rcx
jne 0x1405db550
cmp al, 0x20
je 0x1405db2e0
mov byte [rdi + rbp + 0x139], al
mov rcx, qword [rbx + 0xa0]
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1405db510
cmp sil, 0x5c
je 0x1405db3d0
cmp sil, 0x28
je 0x1405db3a8
cmp sil, 0x29
je 0x1405db4f8
cmp sil, 0x5b
je 0x1405db568
cmp sil, 0x7b
je 0x1405db4a8
test sil, sil
je 0x1405db600
mov eax, esi
and eax, 0xffffffdf
cmp al, 0x5d
je 0x1405db510
mov rbp, qword [rbx + 0xc0]
movzx r12d, sil
mov rdi, rbx
movzx eax, byte [rbp + r12 + 0x139]
test al, al
jne 0x1405db37a
mov rax, qword [rbp]
lea rdx, [0x140526890]
mov rax, qword [rax + 0x40]
cmp rax, rdx
jne 0x1405db5c0
mov byte [rbp + r12 + 0x139], sil
mov eax, esi
movzx edx, byte [rbx]
test dl, dl
jne 0x1405db394
jmp 0x1405db3c3
movzx edx, byte [rdi + 8]
add rdi, 8
test dl, dl
je 0x1405db3c3
cmp al, dl
jne 0x1405db388
mov eax, dword [rdi + 4]
invalid
invalid
nop

Function at 0x1405e8b80
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1405e8bd8
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1405e8bb0
and edx, 7
je 0x1405e8c0d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1405e8be8
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x1400017e0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x110
mov r11, r9
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x160]
mov qword [rsp + 0x50], r8
mov r9d, dword [rsp + 0x158]
mov dword [rsp + 0x84], r9d
mov r9, qword [rsp + 0x150]
mov qword [rsp + 0x48], r9
mov r10, qword [rsp + 0x148]
mov qword [rsp + 0x40], r10
mov rsi, qword [rsp + 0x140]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xc0], r10
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
xor eax, eax
mov r8d, eax
call fcn.140001260
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
xor eax, eax
mov r8d, eax
call fcn.1400011c0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
xor eax, eax
mov r8d, eax
call fcn.140001210
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
mov r10d, dword [rsp + 0x84]
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x28], rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xa0]
call fcn.140002870
mov cl, al
xor cl, 0xff
and cl, 1
lea rdx, [rsp + 0xa0]
call fcn.140001060
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov r8, rdx
mov rdx, qword [rsp + 0x90]
call fcn.140001150
mov rax, qword [rsp + 0x98]
add rsp, 0x110
pop rsi
ret
Function at 0x140016830
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400168d0
jmp 0x1400168bf
jae 0x14001698f
cmp r8, 0x201
jae 0x1400168d0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140016927
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400168ff
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14002b5d0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140016950
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400169fb
mov r8d, r13d
cmp r12, r8
jne 0x1400168b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140016a2f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400168bf
jmp 0x1400168d0
cmp r14, r8
jb 0x140016a49
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140018680
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1400169e4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400025e0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400169cf
jmp 0x1400169e4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002c450
jmp 0x140016a5e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002c8c0
ud2
Function at 0x14001cb60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140034e30]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14001cb98
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001cbf6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001cc23
test eax, eax
js 0x14001cc02
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001cc19
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140018370
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140014ff0
mov ecx, 7
int 0x29
ud2
Function at 0x1400295b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14002963a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140029630
cmp r11, r10
ja 0x1400296b6
cmp r10, rdx
ja 0x1400296c8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140029632
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140029610
jmp 0x140029697
ja 0x14002963a
mov r11, r10
cmp rax, r8
jne 0x1400295d7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14002969b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140029670
mov r8, r10
sub ecx, r9d
jns 0x14002968e
jmp 0x14002969d
cmp r10, rdx
je 0x1400296aa
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002969d
xor al, 1
cmp r8, rdx
jne 0x140029650
jmp 0x14002969d
xor eax, eax
jmp 0x14002969d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14002c310
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002c930
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002c8c0
int3

Function at 0x14002afbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b006
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b006
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b006
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b006
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b006
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002b008
xor al, al
add rsp, 0x28
ret
Function at 0x1400039b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor r15d, r15d
lea rcx, str.C:Windows_system32_rdpuos.log
mov rdi, r8
mov qword [rsp + 0x30], r15
mov r14, rdx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 1]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003a0c
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov qword [rsp + 0x88], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebp, dword [rsp + 0x88]
mov ecx, 0x40
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
jne 0x140003a61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x40]
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x78], rbx
mov ebx, ebp
mov dword [rdi], r15d
test ebp, ebp
jle 0x140003a9e
nop
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov dword [rsp + 0x70], r15d
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140003a9e
add dword [rdi], eax
sub ebx, eax
test ebx, ebx
jg 0x140003a70
mov rcx, rsi
mov rbx, qword [rsp + 0x78]
cmp dword [rdi], ebp
je 0x140003acb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x40]
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x40]
mov al, 1
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret

Function at 0x140003d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edi, r8d
mov dword [rsp + 0x28], 0x80
mov rsi, rdx
mov dword [rsp + 0x68], 0
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
test rax, rax
je 0x140003dfa
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x140003e0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov al, 1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140006270
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x390
mov rax, qword [0x140030008]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140011b90
lea rax, str.Diagnostics.txt
mov r9, rdi
lea r8, [0x14002b2e0]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140004200
xor ebx, ebx
lea rcx, str.C:Windows_system32_rdpuos.log
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140006411
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
lea r8, [rsp + 0x48]
mov dword [rsp + 0x40], ebx
mov edx, 0x153
call fcn.140003af0
test al, al
je 0x140006411
mov rbx, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
mov rdx, rbx
call fcn.140003d80
test al, al
je 0x140006411
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400040a0
test al, al
je 0x140006411
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x104
call fcn.140011b90
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x104
call fcn.140011b90
mov r9, rdi
lea r8, str._sx86.dll
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.140004200
mov r9, rdi
lea r8, str._sx64.dll
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.140004200
lea r8, [rsp + 0x160]
mov edx, 0x1a7
call fcn.140006440
test al, al
je 0x140006411
lea r8, [rsp + 0x270]
mov edx, 0x1ac
call fcn.140006440
test al, al
setne al
jmp 0x140006413
xor al, al
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.14000e940
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x390
pop rdi
ret