joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008eab0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1400c4cb0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov r14, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400d3c50
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r15, [rbp + 0xfe8]
mov qword [rbp + 0xfc8], r15
lea r12, [0x140094f90]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xfb0]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x14008ec9e
mov r13, qword [sym.imp.kernel32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov rdi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r14
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfe8], 0
je 0x14008eb77
cmp dword [rbp + 0xfec], 0
jne 0x14008ecb3
mov ebx, dword [rbp + 0xff0]
test rbx, rbx
je 0x14008ecb3
cmp ebx, 0x1000
ja 0x14008ecf7
xor r14d, r14d
nop dword [rax + rax]
cmp r14, rbx
ja 0x14008ece3
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8d, ebx
sub r8d, r14d
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call rdi
test eax, eax
je 0x14008eca6
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfe8], 0
je 0x14008ec20
cmp dword [rbp + 0xfec], 0
jne 0x14008ecac
mov eax, dword [rbp + 0xff0]
add r14, rax
cmp r14, rbx
jne 0x14008ebc0
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov r14, qword [rbp + 0xfe0]
mov rcx, r14
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x14008eb77
call qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x14008ecb3
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1400fcdc0]
mov rcx, r14
mov rdx, rbx
call fcn.1400d5f20
jmp 0x14008ed0a
mov ecx, ebx
lea r8, [0x1400fcdc0]
mov edx, 0x1000
call fcn.1400d5ea0
ud2
Function at 0x140090cb0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140140641]
mov ecx, 0x10
mov edx, 8
call fcn.14007d420
test rax, rax
je 0x140090d8f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140090e20]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140090d81
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140090d58
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.14007d430
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.14007d430
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400d5830
ud2
Function at 0x1400955f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140095711
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140095628
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400956d4
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400956f3
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14009567e
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x1400956b1
jmp 0x1400956a6
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
movabs rcx, 0x3e500000000
cmp rax, rcx
je 0x1400956ac
movabs rcx, 0x6d00000000
cmp rax, rcx
jne 0x1400956c8
mov byte [rsi + 1], 0
jmp 0x1400956bc
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1400956be
mov r8d, 0x10
mov rcx, rbx
call fcn.1400d4d00
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140095635
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400d4d00
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140095635
mov qword [rsp + 0x30], 0
lea rax, str.library_std_src_syswindowspipe.rs
mov qword [rsp + 0x20], rax
lea r8, [0x1400fdf98]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rdi
call fcn.1400d4bf0
ud2
Function at 0x1400980c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
movzx ebp, byte [rdx + 0x38]
cmp bpl, 1
ja 0x14009811d
movzx ebx, byte [rdi + 0x3a]
mov rcx, rdi
call fcn.140097fa0
test bpl, bpl
jne 0x140098121
lea rcx, [rdi + 0x10]
xor r8d, r8d
cmp byte [rdi + 0x10], 6
cmove rcx, r8
je case.0x140098111.2
movzx edx, byte [rcx]
mov r8d, 6
lea r9, [0x140098294]
movsxd rdx, dword [r9 + rdx*4]
add rdx, r9
jmp rdx
mov r8, qword [rcx + 0x10]
add r8, 4
jmp case.0x140098111.2
xor eax, eax
xor ebx, ebx
xor r8d, r8d
movzx r10d, bl
movzx ebx, al
lea rcx, [r10 + rbx]
add rcx, r8
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140098278
mov r11, qword [rdi]
lea rax, [r11 + rcx]
cmp rdx, rcx
jne 0x140098158
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400981d9
movzx r9d, byte [rdi + 0x10]
add r8, rbx
add r8, r10
sub r8, rdx
inc r8
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400981a0
nop dword [rax]
cmp byte [rdi], 0x5c
je 0x1400981bb
inc r8
dec rdi
cmp r8, 1
jne 0x140098180
jmp 0x1400981d9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400981bb
cmp ebx, 0x5c
je 0x1400981bb
inc r8
dec rdi
cmp r8, 1
jne 0x1400981a0
jmp 0x1400981d9
neg r8
add rcx, r8
inc rcx
cmp rdx, rcx
jb 0x140098286
add r11, rcx
mov r10d, 1
mov rax, r11
sub rdx, rcx
je 0x140098202
mov cl, 9
cmp rdx, 2
je 0x140098206
cmp rdx, 1
jne 0x140098215
cmp byte [rax], 0x2e
jne 0x140098215
xor ecx, ecx
cmp r9b, 3
setae cl
lea ecx, [rcx + rcx*2]
add ecx, 7
jmp 0x140098215
mov cl, 0xa
jmp 0x140098215
cmp byte [rax], 0x2e
jne 0x140098215
cmp byte [rax + 1], 0x2e
sete cl
xor cl, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], cl
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea r8, [rcx + 1]
test rcx, rcx
cmove r8, rcx
add r8, rdx
add r8, 8
jmp case.0x140098111.2
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea r8, [rcx + 1]
test rcx, rcx
cmove r8, rcx
add r8, rdx
add r8, 2
jmp case.0x140098111.2
mov r8d, 2
jmp case.0x140098111.2
lea r8, str.library_std_srcpath.rs
call fcn.1400d5e20
ud2
lea r8, str.library_std_srcpath.rs
call fcn.1400d5e20
ud2
Function at 0x14009e430
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov rax, qword [rdx]
mov qword [rbp + 0x3c0], rax
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14009e4d0
jmp 0x14009e4bf
jae 0x14009e596
cmp r8, 0x201
jae 0x14009e4d0
mov r15d, 0x200
lea rdi, [rbp - 0x60]
mov r12, r8
jmp 0x14009e528
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14009e4ff
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.1400d49b0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r14, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3d8], r13
mov rbx, r14
mov r15, r13
mov rdi, qword [rbp + 0x3e8]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x3c0]
mov rdx, rdi
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14009e557
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14009e5fe
mov r8d, esi
cmp r12, r8
jne 0x14009e4b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009e621
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14009e4bf
jmp 0x14009e4d0
cmp r15, r8
jb 0x14009e63b
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
call fcn.1400a6bc0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r14, r14
je 0x14009e5e7
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r14
call fcn.14007d430
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r14, r14
jne 0x14009e5cf
jmp 0x14009e5e7
lea rcx, [0x1400fef30]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400d5a10
jmp 0x14009e650
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400d5ea0
ud2
Function at 0x14009e6a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov qword [rbp + 0x3b8], rcx
mov qword [rbp + 0x3a0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a8], xmm0
mov r14d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor eax, eax
mov qword [rbp + 0x3c0], rax
xor ebx, ebx
xor r15d, r15d
cmp r14, 0x201
jae 0x14009e730
jmp 0x14009e71f
jae 0x14009e7fc
cmp r14, 0x201
jae 0x14009e730
mov esi, 0x200
lea r13, [rbp - 0x60]
mov r12, r14
jmp 0x14009e799
sub r14, r15
sub rbx, r15
cmp rbx, r14
mov rbx, qword [rbp + 0x3c0]
jae 0x14009e769
lea rcx, [rbp + 0x3a0]
mov rdx, r15
mov r8, r14
call fcn.1400d49b0
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x3c8], rax
mov rbx, qword [rbp + 0x3a8]
mov eax, 0xffffffff
cmp rbx, rax
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rbp + 0x3b0], r15
mov rax, rbx
mov qword [rbp + 0x3c0], rbx
mov rsi, r15
mov r13, qword [rbp + 0x3c8]
mov r12, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
jne 0x14009e7bd
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14009e82f
mov r14d, edi
cmp r12, r14
jne 0x14009e710
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009e8bc
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r14, r12
cmp r14, 0x201
jb 0x14009e71f
jmp 0x14009e730
cmp rsi, r14
jb 0x14009e8d6
test edi, edi
je 0x14009e85d
lea rsi, [r14 + r14]
movzx eax, byte [0x140140641]
mov edx, 2
mov rcx, rsi
call fcn.14007d420
test rax, rax
je 0x14009e8ea
mov rdi, rax
jmp 0x14009e864
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3b8]
mov qword [rsi + 8], rax
mov qword [rsi], 0
mov rdx, qword [rbp + 0x3c0]
test rdx, rdx
jne 0x14009e890
jmp 0x14009e8a5
mov edi, 2
xor esi, esi
mov rcx, rdi
mov rdx, r13
mov r8, rsi
call fcn.1400d35b0
mov rsi, qword [rbp + 0x3b8]
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
mov rdx, qword [rbp + 0x3c0]
add eax, dword [rax]
add byte [rax - 0x7b], cl
invalid
je 0x14009e8a5
add rdx, rdx
lea rcx, [0x1400fef30]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400d5a10
jmp 0x14009e8f7
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r14
mov rdx, rsi
call fcn.1400d5ea0
mov ecx, 2
mov rdx, rsi
call fcn.1400d5830
Function at 0x14009e940
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3c0], rdx
mov qword [rbp + 0x400], rcx
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14009e9d0
jmp 0x14009e9bf
jae 0x14009ea90
cmp r8, 0x201
jae 0x14009e9d0
mov esi, 0x200
lea rdi, [rbp - 0x58]
mov r12, r8
jmp 0x14009ea28
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14009e9ff
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.1400d49b0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x408], rax
mov r14, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3f8], r13
mov rbx, r14
mov rsi, r13
mov rdi, qword [rbp + 0x408]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rdi
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
jne 0x14009ea51
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14009eb77
mov r8d, r15d
cmp r12, r8
jne 0x14009e9b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009eb9e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14009e9bf
jmp 0x14009e9d0
cmp rsi, r8
jb 0x14009ebb8
mov rax, qword [rbp + 0x3c0]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1400a6bc0
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x3c8]
call fcn.140098d60
cmp byte [rsi], 0
jne 0x14009eae7
lea rdx, [0x1400ff038]
lea rcx, [rbp + 0x3c8]
mov r8d, 3
call fcn.140099860
mov rdx, qword [rbp + 0x3c8]
mov r8, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x3a8]
call fcn.1400a5e30
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x14009eb1f
mov rcx, qword [rbp + 0x3c8]
mov r8d, 1
call fcn.14007d430
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r14, r14
je 0x14009eb60
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x408]
mov rdx, r14
call fcn.14007d430
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r14, r14
jne 0x14009eb48
jmp 0x14009eb60
lea rcx, [0x1400fef30]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400d5a10
jmp 0x14009ebcd
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400d5ea0
ud2
Function at 0x14009ec60
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3c0], rdx
mov qword [rbp + 0x400], rcx
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14009ecf0
jmp 0x14009ecdf
jae 0x14009edb0
cmp r8, 0x201
jae 0x14009ecf0
mov esi, 0x200
lea rdi, [rbp - 0x58]
mov r12, r8
jmp 0x14009ed48
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14009ed1f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.1400d49b0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x408], rax
mov r14, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3f8], r13
mov rbx, r14
mov rsi, r13
mov rdi, qword [rbp + 0x408]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rdi
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov r15d, eax
test eax, eax
jne 0x14009ed71
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14009ee97
mov r8d, r15d
cmp r12, r8
jne 0x14009ecd0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009eebe
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14009ecdf
jmp 0x14009ecf0
cmp rsi, r8
jb 0x14009eed8
mov rax, qword [rbp + 0x3c0]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1400a6bc0
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x3c8]
call fcn.140098d60
cmp byte [rsi], 0
jne 0x14009ee07
lea rdx, [0x1400ff038]
lea rcx, [rbp + 0x3c8]
mov r8d, 3
call fcn.140099860
mov rdx, qword [rbp + 0x3c8]
mov r8, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x3a8]
call fcn.1400a5e30
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x14009ee3f
mov rcx, qword [rbp + 0x3c8]
mov r8d, 1
call fcn.14007d430
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r14, r14
je 0x14009ee80
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x408]
mov rdx, r14
call fcn.14007d430
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r14, r14
jne 0x14009ee68
jmp 0x14009ee80
lea rcx, [0x1400fef30]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400d5a10
jmp 0x14009eeed
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400d5ea0
ud2
Function at 0x14009fa50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14009fae0
jmp 0x14009facf
jae 0x14009fba0
cmp r8, 0x201
jae 0x14009fae0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14009fb38
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14009fb0f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400d49b0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14009fb61
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14009fc08
mov r8d, r14d
cmp r15, r8
jne 0x14009fac0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009fc2b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14009facf
jmp 0x14009fae0
cmp rsi, r8
jb 0x14009fc45
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400a6bc0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14009fbf1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.14007d430
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14009fbd9
jmp 0x14009fbf1
lea rcx, [0x1400fef30]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400d5a10
jmp 0x14009fc5a
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400d5ea0
ud2

Function at 0x1400a1a60
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400a1a98
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400a1ab0
nop
add rsp, 0x38
ret
Function at 0x1400a1ab0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400a1af3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140093a10]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400d5970
ud2
Function at 0x1400a5e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x10], xmm6
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.14009db10
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
test rcx, rcx
je 0x1400a5eb3
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.14009d380
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400a5eaf
movdqu xmm6, xmmword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a5f28
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x1400a5f16
mov rax, qword [rbp - 0x20]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400a5f0f
test rcx, rcx
je 0x1400a5f0f
lea rcx, [rax - 1]
mov qword [rbp - 0x10], rcx
mov rcx, qword [rax - 1]
mov rax, qword [rax + 7]
mov qword [rbp], rcx
mov qword [rbp - 8], rax
call qword [rax]
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400a5efb
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp]
call fcn.14007d430
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 0x10]
call fcn.14007d430
mov qword [rsi], 0
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov qword [rsi], 0
movq rdx, xmm6
test rdx, rdx
je 0x1400a5f16
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.14007d430
jmp 0x1400a5f16