joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a870
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140057c30]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, r8d
mov dword [rsp + 0x20], 1
mov rbx, rdx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov ebp, r9d
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [0x1400570f0]
test eax, eax
je 0x14001a8de
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14001a8de
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
je 0x14001a8de
mov eax, reloc.WS2_32.dll_listen
jmp 0x14001a917
xor eax, eax
imul r8d, ebp, 0x3e8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x30], ax
lea edx, [rax - 0xf]
call qword [0x140057118]
xor ecx, ecx
mov edx, reloc.WS2_32.dll_listen
test eax, eax
cmovle ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140023730
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001a940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx r8d, word [reloc.WS2_32.dll_accept]
mov eax, edx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov r10d, edx
movsxd r11, eax
test eax, eax
jle 0x14001a9ed
cmp r11d, 0x10
jb 0x14001a9ed
mov r9d, r11d
xorps xmm2, xmm2
xorps xmm1, xmm1
and r9d, 0x8000000f
jge 0x14001a989
dec r9d
or r9d, 0xfffffff0
inc r9d
mov eax, r11d
sub eax, r9d
movsxd r9, eax
movdqu xmm0, xmmword [rcx + rdx*2]
add r10d, 0x10
pxor xmm0, xmm2
movdqa xmm2, xmm0
movdqu xmm0, xmmword [rcx + rdx*2 + 0x10]
add rdx, 0x10
pxor xmm0, xmm1
movdqa xmm1, xmm0
cmp rdx, r9
jl 0x14001a992
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movd eax, xmm1
xor r8w, ax
movsxd rax, r10d
cmp rax, r11
jge 0x14001aa0d
nop word [rax + rax]
xor r8w, word [rcx + rax*2]
inc rax
cmp rax, r11
jl 0x14001aa00
movzx ecx, r8w
call fcn.14002fc08
call fcn.14002fbdc
mov dword [reloc.WS2_32.dll_accept], eax
add rsp, 0x28
jmp fcn.14002fbdc

Function at 0x14001d920
Capabilities:
Encode data using base64

Disassembly:
test r8d, r8d
jle 0x14001d9d9
lea r9, [rcx + 2]
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rdx], al
cmp r8d, 1
jle 0x14001d960
movzx eax, byte [r9 - 1]
shr eax, 4
jmp 0x14001d962
xor eax, eax
movzx ecx, byte [r9 - 2]
and ecx, 3
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 1], al
cmp r8d, 1
jle 0x14001d9a6
cmp r8d, 2
jle 0x14001d98e
movzx eax, byte [r9]
shr eax, 6
jmp 0x14001d990
xor eax, eax
movzx ecx, byte [r9 - 1]
and ecx, 0xf
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r10]
jmp 0x14001d9a8
mov al, 0x3d
mov byte [rdx + 2], al
cmp r8d, 2
jle 0x14001d9bf
movzx eax, byte [r9]
and eax, 0x3f
movzx ecx, byte [rax + r10]
jmp 0x14001d9c1
mov cl, 0x3d
mov byte [rdx + 3], cl
sub r8d, 3
add rdx, 4
add r9, 3
test r8d, r8d
jg 0x14001d940
mov rax, rdx
mov byte [rdx], 0
ret
Function at 0x140021350
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x140057c30]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.140024b90
movabs rax, 0x5053534d4c544e
mov byte [rsp + 0xa8], 2
mov edx, 0x80
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400213d0
lea ebp, [rax + rax]
mov byte [rsp + 0xb0], 0x30
movzx eax, byte [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0xac], bpl
xor ebx, ebx
mov byte [rsp + 0xae], bpl
mov dword [rsp + 0xb4], 0xa0818203
nop dword [rax + rax]
movsx ecx, al
call fcn.14002a160
mov byte [rsp + rbx + 0xd0], al
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
mov byte [rsp + rbx + 0xd1], 0
add rbx, 2
test al, al
je 0x14002143c
cmp rbx, 0x40
jl 0x140021410
mov rcx, rsi
call fcn.140029234
cmp word [r14 + 0x194], 0x17
mov eax, 0x19c
mov ecx, 0x198
mov rbx, rsi
cmovne eax, ecx
mov edi, 8
mov eax, dword [rax + r14]
mov dword [rsi + 4], eax
movzx eax, byte [r14 + 0x196]
xor byte [rsi + 1], al
nop dword [rax]
nop dword [rax + rax]
mov edx, 8
mov rcx, rsi
call fcn.14001a940
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140021480
mov rax, qword [rsi]
lea r8d, [rbp + 0x30]
mov rdx, r15
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xa0]
call fcn.14001d920
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140023730
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002556c
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x140047a90]
lea rdx, str.FlsAlloc
call fcn.140025394
mov rbx, rax
test rax, rax
je 0x1400255ac
mov rcx, rax
call fcn.1400242c0
mov rcx, rdi
call rbx
jmp 0x1400255b2
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140025614
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140047ac8]
call fcn.140025394
mov rsi, rax
test rax, rax
je 0x140025660
mov rcx, rax
call fcn.1400242c0
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14002566b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140031558
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003137c

Function at 0x140036764
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140036784
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140034f70
or eax, 0xffffffff
jmp 0x140036786
xor eax, eax
add rsp, 0x28
ret
Function at 0x14003ac24
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14003ac01
call fcn.140034fe0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140034ec0
or eax, 0xffffffff
jmp 0x14003ac1e
sub dword [rcx + 0x10], 1
jns 0x14003ac10
add rsp, 0x28
jmp 0x14003f4cc
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14003abe0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14003f514
call fcn.140034fe0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140034ec0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14003f4f9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14003f4f9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14003f538
lock or dword [rcx + 0x14], 0x10
jmp 0x14003f4f9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14003f54c
call fcn.14003f62c
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.1400347b4
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.14003420c
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
ja 0x14003f58b
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
jmp 0x14003f4f9
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x14003f5f1
mov rcx, rdi
call fcn.1400347b4
cmp eax, esi
je 0x14003f5dc
mov rcx, rdi
call fcn.1400347b4
cmp eax, 0xfffffffe
je 0x14003f5dc
mov rcx, rdi
call fcn.1400347b4
movsxd rbx, eax
lea r14, [0x1400593c0]
mov rcx, rdi
sar rbx, 6
call fcn.1400347b4
mov rdx, qword [r14 + rbx*8]
and eax, 0x3f
shl rax, 6
add rdx, rax
jmp 0x14003f5e3
lea rdx, [0x140057ea0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14003f5f1
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x14003f615
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x14003f615
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x14003f615
mov dword [rdi + 0x20], 0x1000
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x14003f4fc
Function at 0x1400012e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rax, qword gs:[0x30]
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
lea rcx, [rsp + 0x230]
add rdi, 0x20
mov rbx, qword [rdi]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
cmp rbx, rdi
je 0x1400013e8
nop
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx + 0x40]
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rsi
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov edx, 0x104
lea rcx, [rsp + 0x230]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000141e
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001350
mov rdx, rsi
lea rcx, str.failed_to_get_a_handle_to__ls_n
call fcn.140001950
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001d60
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400013f9

Function at 0x140001430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov esi, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x24]
add rsi, rcx
mov r10d, dword [r8 + 0x20]
add rbp, rcx
mov ebx, dword [r8 + 0x18]
add r10, rcx
test ebx, ebx
je 0x1400014b3
nop dword [rax]
mov r8d, dword [r10]
mov rax, rdi
add r8, r11
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400014a3
inc rax
test ecx, ecx
jne 0x140001490
test edx, edx
je 0x1400014ca
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140001480
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x1400014b5
Function at 0x14000a400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000a490
cmp r11, r10
ja 0x14000a506
cmp r10, rdx
ja 0x14000a518
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000a492
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000a470
jmp 0x14000a4f4
ja 0x14000a49a
mov r11, r10
cmp rax, r8
jne 0x14000a434
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000a4d0
mov rdi, r8
sub ecx, edx
jns 0x14000a4eb
jmp 0x14000a4f6
cmp r8, rsi
je 0x14000a527
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000a4f6
xor al, 1
cmp rdi, rsi
jne 0x14000a4b0
jmp 0x14000a4f6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140097030
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140096da0
lea rcx, [0x1400f5880]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140096e20
int3

Function at 0x14000c670
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14000c696
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14000c680
mov qword [rcx], rax
ret

Function at 0x14000c829
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.1400207e3
test rbx, rbx
je 0x14000c862
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14000c670
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14000c668
Function at 0x1400965d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14009a230]
test rax, rax
je 0x14009661a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009661a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009661a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009661a
cmp dword [rcx + 0x84], 0xe
jbe 0x14009661a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009661c
xor al, al
add rsp, 0x28
ret
Function at 0x1400036d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140003770
jmp 0x14000375f
jae 0x140003830
cmp r8, 0x201
jae 0x140003770
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400037c8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000379f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140017ac0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400037f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003898
mov r8d, r14d
cmp r15, r8
jne 0x140003750
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400038c5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000375f
jmp 0x140003770
cmp rsi, r8
jb 0x1400038df
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140004a40
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140003881
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001150
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140003869
jmp 0x140003881
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140018300
jmp 0x1400038f4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140018750
ud2
Function at 0x140015ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140015f5a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140015f50
cmp r11, r10
ja 0x140015ff1
cmp r10, rdx
ja 0x140016003
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140015f52
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140015f30
jmp 0x140015fc7
ja 0x140015f5a
mov r11, r10
cmp rax, r8
jne 0x140015f02
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140015fcb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140015fa0
mov r8, r10
sub ecx, r9d
jns 0x140015fbe
jmp 0x140015fcd
cmp r10, rdx
je 0x140015fd9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140015fcd
xor al, 1
cmp r8, rdx
jne 0x140015f80
jmp 0x140015fcd
xor eax, eax
jmp 0x140015fcd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14001c59b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140018300
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400187d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140018750
int3

Function at 0x14001752c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017576
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017576
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017576
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017576
cmp dword [rcx + 0x84], 0xe
jbe 0x140017576
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017578
xor al, al
add rsp, 0x28
ret
Function at 0x140003980
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x1400039b4
cmp word [rcx], 0x5a4d
jne 0x1400039b4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400039b4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039b4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400038c0
test eax, eax
jne 0x1400039d0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003930
test rax, rax
je 0x1400039c5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004179
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004080
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004020
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004c30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004c53
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004c53
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004d01
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1427dcd50]
mov r8, rcx
mov rcx, r9
call fcn.140004c30
test eax, eax
je 0x140004d2d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004c54
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400011a8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xf]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xf
jb 0x1400011ae
mov rax, rcx
ret

Function at 0x1400011c4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xa]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xa
jb 0x1400011ca
mov rax, rcx
ret
Function at 0x140001f20
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x17]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x17
jb 0x140001f26
mov rax, rcx
ret

Function at 0x140001f3c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x13]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x13
jb 0x140001f42
mov rax, rcx
ret

Function at 0x140001f58
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x11]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x11
jb 0x140001f5e
mov rax, rcx
ret

Function at 0x140001f74
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 6]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 6
jb 0x140001f7a
mov rax, rcx
ret

Function at 0x140001f90
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x10]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x10
jb 0x140001f96
mov rax, rcx
ret

Function at 0x140001fac
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x12
jb 0x140001fb2
mov rax, rcx
ret

Function at 0x140001fc8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 9]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 9
jb 0x140001fce
mov rax, rcx
ret

Function at 0x140001fe4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x15]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x15
jb 0x140001fea
mov rax, rcx
ret

Function at 0x140002000
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x14]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x14
jb 0x140002006
mov rax, rcx
ret

Function at 0x14000201c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x19]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x19
jb 0x140002022
mov rax, rcx
ret

Function at 0x140002038
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xe]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xe
jb 0x14000203e
mov rax, rcx
ret

Function at 0x140002054
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xb]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xb
jb 0x14000205a
mov rax, rcx
ret

Function at 0x140002070
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xc]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xc
jb 0x140002076
mov rax, rcx
ret

Function at 0x14000208c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xd]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xd
jb 0x140002092
mov rax, rcx
ret

Function at 0x1400020a8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 9
jb 0x1400020ae
mov rax, rcx
ret
Function at 0x1400020cc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 2]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 2
jb 0x1400020d2
mov rax, rcx
ret

Function at 0x1400020e8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 7]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 7
jb 0x1400020ee
mov rax, rcx
ret

Function at 0x140002104
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 8
jb 0x14000210a
mov rax, rcx
ret