joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098560
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400debc8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400985a7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007edb0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14009ba30
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007edb0
add rsp, 0x38
ret

Function at 0x14009bcf0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.140095c90
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x14009be94
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.140095c90
cmp rax, 0xffffffffffffffff
je 0x14009be94
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x14009be13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x14009bd99
call fcn.140082fc0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140082fc0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.14009beb0
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.140089b60
cmp eax, 0xffffffff
je 0x14009bdd5
cdqe
sub rbx, rax
test rbx, rbx
jg 0x14009bdb0
jmp 0x14009bdee
call fcn.140082ff0
cmp dword [rax], 5
jne 0x14009bdea
call fcn.140082fc0
mov dword [rax], SafeArrayGetDim
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.14009beb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x14009be6c
test rbx, rbx
jns 0x14009be76
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.140095c90
cmp rax, 0xffffffffffffffff
je 0x14009bd7a
mov ecx, esi
call fcn.140097310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x14009be76
call fcn.140082fc0
mov dword [rax], SafeArrayGetDim
call fcn.140082ff0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x14009bd7a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.140095c90
cmp rax, 0xffffffffffffffff
je 0x14009bd7a
xor eax, eax
jmp 0x14009bd81
call fcn.140082fc0
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x1400a069c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400debc8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.1400832b0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.1400832b0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400a072f
cmp dword [rsp + 0x24], 5
jb 0x1400a0749
jmp 0x1400a0745
cmp dword [rsp + 0x30], esi
jne 0x1400a0749
cmp dword [rsp + 0x24], 4
ja 0x1400a0745
jne 0x1400a0749
cmp dword [rsp + 0x28], 0
jbe 0x1400a0749
mov byte [rbx + 0x18], sil
lea rax, [0x1400b29c0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140049ca0
movzx ecx, byte [0x1400e90e8]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400e90e8], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14007edb0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002028
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r8d, 0x40
mov byte [0x14000feae], 1
lea rdx, [rsp + 0x20]
lea rcx, str._MSI_TEST
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140002092
movzx ecx, word [rsp + 0x20]
lea r8, [rsp + 0x20]
test ecx, ecx
je 0x140002090
mov edx, dword [0x1400100c0]
and ecx, 0x1f
lea r8, [r8 + 2]
bts edx, ecx
movzx ecx, word [r8]
test ecx, ecx
jne 0x140002078
mov dword [0x1400100c0], edx
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140009100
add rsp, 0xb8
ret

Function at 0x140004940
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r14d, r14d
mov ebx, eax
cmp dword [0x14000e02c], 0xffffffff
jne 0x140004a39
lea rax, [rsp + 0x30]
mov dword [0x14000e02c], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rdx, str.SoftwarePoliciesMicrosoftWindowsInstaller
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004a39
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, str.Debug
lea rax, [rsp + 0x38]
mov dword [rsp + 0x48], 0x28
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x50
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004a1c
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax]
and ecx, 3
mov dword [0x14000e02c], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x48], 0x28
jle 0x140004a39
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x14000e02c]
and eax, 3
test al, al
je 0x140004a9c
xor edx, edx
mov word [rbp - 0x60], r14w
mov r8d, 0x800
lea rcx, [rbp - 0x5e]
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x60]
mov edx, 0x401
test edi, edi
je 0x140004a7f
mov r9d, edi
mov qword [rsp + 0x20], rsi
lea r8, str.Error:__d.__s._r_n
call fcn.1400012e0
jmp 0x140004a8e
mov r9, rsi
lea r8, str._s_r_n
call fcn.1400012e0
test eax, eax
js 0x140004a9c
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140009100
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140005444
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x140005499
cmp al, 6
jb 0x140005499
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005499
lea rdx, str.HeapSetInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140005499
mov rcx, rax
call qword [0x14000a410]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140008a00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x22]
mov word [rsp + 0x20], di
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea ebp, [rdi + 0x5c]
test rbx, rbx
je 0x140008a78
cmp word [rbx], di
je 0x140008a78
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x140008a78
cmp word [rbx], 0x7f
jae 0x140008a6d
cmp word [rbx + 2], 0x3a
je 0x140008ada
cmp word [rbx], bp
jne 0x140008a78
cmp word [rbx + 2], bp
je 0x140008ada
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140008ada
lea ecx, [rax + 2]
cmp ecx, esi
ja 0x140008ada
mov ecx, eax
mov r8, rbx
inc eax
mov edx, esi
mov word [rsp + rcx*2 + 0x20], bp
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x20], di
call fcn.14000119c
test eax, eax
js 0x140008ada
lea r8, str..DLL
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14000119c
test eax, eax
js 0x140008ada
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140008adc
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140009100
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400095ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400095f8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400095f0
cmp dword [rcx + 0x3c], edx
jl 0x1400095f0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400095f0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400095f8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140003410
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r8, rdx
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x140003437
cmp qword [rcx + 0x40], 0
js 0x140003437
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
mov edx, 6
jmp fcn.140003c70
mov rdx, r8
jmp fcn.140003440

Function at 0x140003440
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
mov r8d, 0x20
call fcn.140006410
test rax, rax
je 0x1400034ac
mov qword [rbp + 0x18], rax
mov rcx, rax
mov qword [rbp + 0x20], rdx
call qword [rdx]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400034fd
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.1400038c0
jmp 0x1400034fd
movaps xmm0, xmmword [rbp - 0x10]
movaps xmm1, xmmword [rbp]
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x60], xmm0
lea r8, [0x1407cb208]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov r9d, 8
call fcn.140006200
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
mov qword [rdi + 0x28], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdi + 0x18], xmm0
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdi + 8], xmm0
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
jmp fcn.140003c70
Function at 0x1400066c0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140006732
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x1400066f8
add rdi, rbx
sub rsi, rbx
je 0x140006732
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x1400066f0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x1400066f0
add ebp, 0x80000000
jmp 0x140006734
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140007280
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x18], r9
mov r14, r8
mov r15, rdx
mov qword [rbp - 0x10], rcx
mov r13, qword [rbp + 0x78]
mov rax, qword [rbp + 0x70]
lea rdx, [rax + r8]
add rdx, r13
lea r12, [rbp - 0x38]
mov rcx, r12
call fcn.140018ae0
mov rcx, r12
mov rdx, r15
mov r8, r14
call fcn.140018b50
mov dword [rbp - 4], 0
movabs r12, 0xa0761d6478bd642f
movabs rbx, 0xe7037ed1a0b428db
mov edi, 0x3e
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789too_many_temporary_files_exist
lea r14, [rbp - 0x38]
lea r15, [rbp - 4]
jmp 0x14000731e
mov byte [rbp - 4], al
mov rcx, r14
mov rdx, r15
call fcn.140018b50
sub r13, 1
jb 0x1400073ec
call fcn.140007f20
mov rcx, rax
cmp qword [rax], 0
je 0x140007340
add rcx, 8
jmp 0x14000734a
xor edx, edx
call fcn.140006eb0
mov rcx, rax
mov r10, qword [rcx]
lea r9, [r10 + r12]
mov rax, r9
xor rax, rbx
mul r9
mov r8, rdx
xor r8, rax
mov rax, r8
mul rdi
lea rax, [r8 + r8]
shl r8, 6
sub r8, rax
cmp r8, 0xf
ja 0x1400073bb
movabs rax, 0x40ec3ac8f17ac85e
add r10, rax
nop word cs:[rax + rax]
add r9, r12
mov rax, r10
xor rax, rbx
mul r10
xor rdx, rax
mov r8, rdx
shl r8, 6
sub r8, rdx
sub r8, rdx
add r10, r12
cmp r8, 0x10
jb 0x140007390
mov rax, rdx
mul rdi
movzx eax, byte [rdx + rsi]
mov qword [rcx], r9
mov r8d, 1
test al, al
jns 0x140007310
mov ecx, eax
shr cl, 6
or cl, 0xc0
and al, 0x3f
or al, 0x80
mov byte [rbp - 3], al
mov r8d, 2
mov eax, ecx
jmp 0x140007310
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp + 0x70]
call fcn.140018b50
movups xmm0, xmmword [rbp - 0x38]
movups xmm1, xmmword [rbp - 0x28]
mov rax, qword [rbp - 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140007b00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140007b42
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140007b4a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140007b5b
jmp 0x140007b72
xor r10d, r10d
jmp 0x140007bfd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140007b72
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140007b89
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140007ba9
add r11, r8
jmp 0x140007cda
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140007c72
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140007c20
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140007c90
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140007ca2
jmp 0x140007cbc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140007cbc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140007cd6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000ee20
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14000eeb0
jmp 0x14000ee9f
jae 0x14000ef70
cmp r8, 0x201
jae 0x14000eeb0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000ef08
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14000eedf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14003ebc0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000ef31
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000efd8
mov r8d, r14d
cmp r15, r8
jne 0x14000ee90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000effb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000ee9f
jmp 0x14000eeb0
cmp rsi, r8
jb 0x14000f015
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400114d0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14000efc1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400038c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14000efa9
jmp 0x14000efc1
lea rcx, str.internal_error:_entered_unreachable_codex
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14003f9e0
jmp 0x14000f02a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14003fe30
ud2
Function at 0x14000f080
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400210d0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x14000f206
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14000f140
jmp 0x14000f12f
jae 0x14000f218
cmp r8, 0x201
jae 0x14000f140
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x14000f198
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14000f16f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.14003ebc0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000f1c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000f2eb
mov r8d, esi
cmp r12, r8
jne 0x14000f120
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000f315
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000f12f
jmp 0x14000f140
lea rcx, [rbp - 0x58]
call fcn.1400090f0
mov byte [rsi + 0x18], 2
jmp 0x14000f2aa
cmp r15, r8
jb 0x14000f32f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.1400114d0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x14000f269
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.1400038c0
cmp byte [rbp + 0x3d8], 2
jne 0x14000f2c1
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400090f0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x14000f2aa
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.1400038c0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x14000f295
jmp 0x14000f2aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x14000f251
jmp 0x14000f269
lea rcx, str.internal_error:_entered_unreachable_codex
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14003f9e0
jmp 0x14000f344
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14003fe30
ud2
Function at 0x1400147c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002f640
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call fcn.14003e6c0
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x14001a6f0]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.14001a490
cmp qword [rbp + 0xfe8], 0
jne 0x140014997
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x140014963
cmp r12, 0x1000
ja 0x1400149b9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140014937
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x1400148e0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14001493d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140014920
jbe 0x140014890
jmp 0x1400149a5
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140014845
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.1400090f0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.1400090f0
jmp 0x140014963
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14003feb0
jmp 0x1400149cd
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14003fe30
ud2