joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ece0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ed83
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0045b620
nop
test bl, bl
je 0x45ed7d
mov qword [rsp + 0x18], rax
lea rcx, [0x0045edc0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046dee0
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045ece0

Function at 0x46aec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46b037
movzx edx, byte [rax]
test edx, edx
jne 0x46aef4
nop dword [rax]
test r8b, r8b
jne 0x46aef4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46af07
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46aff7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46afe5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46afd7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46af5d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46afa0
mov eax, 1
cmp rax, rbx
ja 0x46af8b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004703a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46afcf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46af93
mov rcx, r11
mov eax, r12d
jmp 0x46af62
mov rcx, rbx
call fcn.004702e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004702e0
mov eax, r8d
mov rcx, rbx
call fcn.004703a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46b02d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46aff0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46af0d
mov eax, edx
mov rcx, rbx
call fcn.004702e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004702e0
nop
int3
Function at 0x46c8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c98f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458ce0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046dee0
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046c8e0
Function at 0x46fe00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404503
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a4a0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4044e0
cmp byte [0x00ce710d], 0
je 0x46fe15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46d040
jmp 0x4044e0

Function at 0x46fe20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x00ce74a8]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00ce74a0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00ce710d], 0
je 0x46fe55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00ce77e0]
aesenc xmm0, xmmword [0x00ce77f0]
aesenc xmm0, xmmword [0x00ce7800]
movq rax, xmm0
ret
jmp 0x40a680

Function at 0x46fe60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x00ce74a8]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00ce74a0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00ce710d], 0
je 0x46fe96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00ce77e0]
aesenc xmm0, xmmword [0x00ce77f0]
aesenc xmm0, xmmword [0x00ce7800]
movq rax, xmm0
ret
jmp 0x40a6c0

Function at 0x471c40
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x471c74
mov rcx, 0x28
jmp 0x471c7f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00ce7388], rcx
pop rbp
ret
Function at 0x48b0a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b7df
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x48b0cd
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x48b351
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x48b37d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00556a60]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f8160]
lea rbx, [0x005540f0]
call fcn.004683a0
inc rax
cmp rax, r8
jge 0x48b3a2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x48b3d7
lea rdi, [0x004f81e0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x48b0c3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x48b3bb
jmp 0x48b390
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048b0a0

Function at 0x48b980
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x48b997
inc rax
cmp rax, 4
jge 0x48b9af
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x48b994
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x48b9c0
inc rax
cmp rax, 4
jge 0x48b9ce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x48b9f7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48b9db
jmp 0x48b9bd
Function at 0x491720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4917ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004039a0
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4917cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004f8260]
xor ebx, ebx
mov rcx, rdx
call fcn.00469740
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004925e0
inc rbx
cmp rcx, rbx
jae 0x4917be
mov edi, 1
lea rsi, [0x004f8260]
call fcn.00469820
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00554318]
lea rsi, [0x00553740]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00491720

Function at 0x4a1c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1ccc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.004039a0
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a1c93
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.00450320
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a1ca6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a1cb9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a1ca3
mov byte [rax + rcx], dl
jmp 0x4a1ca3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0046a180
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.004a1c20
Function at 0x4b9520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b972b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4b9644
cmp rdx, 0x40
ja 0x4b971d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4b95b4
mov rax, rdx
mov rcx, rsi
call fcn.00470c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4b9620
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004b9960
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4b9715
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4b9647
mov r8, rcx
cmp r8, 0x40
jl 0x4b96c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004b9960
xorps xmm15, xmm15
mov r14, qword [0x00ce7388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4b9708
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4b9704
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00470c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.004703a0
mov rax, rdx
mov ecx, 0x40
call fcn.004703a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b9520
Function at 0x140003770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp byte [rcx + 0x79], 0
je 0x140003784
xor eax, eax
jmp 0x1400039ad
mov r8, qword [rcx + 0x48]
mov r9, qword [rcx + 0x50]
test byte [rcx], 1
je 0x1400037bf
lea rdx, [rcx + 8]
mov rax, qword [rcx + 0x58]
cmp qword [rcx + 0x38], 0xffffffffffffffff
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
je 0x1400038f6
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x140003905
cmp byte [rcx + 0x1a], 0
je 0x1400037df
mov rsi, r8
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x140003945
jmp 0x140003977
mov rax, qword [rcx + 8]
movzx edx, byte [rcx + 0x18]
jmp 0x1400037f7
add rax, r10
mov qword [rcx + 8], rax
mov r10d, edx
xor dl, 1
test rax, rax
je 0x140003826
cmp rax, r9
jae 0x140003820
cmp byte [r8 + rax], 0xbf
jg 0x140003826
jmp 0x1400039b5
jne 0x1400039b5
cmp rax, r9
je 0x14000391e
movzx ebx, byte [r8 + rax]
movzx r11d, bl
test r11b, r11b
jns 0x1400038a0
mov esi, r11d
and esi, 0x1f
movzx edi, byte [r8 + rax + 1]
and edi, 0x3f
cmp r11b, 0xdf
jbe 0x14000388a
movzx r11d, byte [r8 + rax + 2]
shl edi, 6
and r11d, 0x3f
or r11d, edi
cmp bl, 0xf0
jb 0x1400038e2
movzx edi, byte [r8 + rax + 3]
and esi, 7
shl esi, 0x12
shl r11d, 6
and edi, 0x3f
or edi, r11d
or edi, esi
mov r11d, edi
test r10b, 1
je 0x1400038a6
jmp 0x1400038ee
shl esi, 6
or esi, edi
mov r11d, esi
nop word cs:[rax + rax]
test r10b, 1
jne 0x1400038ee
mov r10d, 1
cmp r11d, 0x80
jb 0x1400037f0
mov r10d, 2
cmp r11d, 0x800
jb 0x1400037f0
cmp r11d, 0x10000
mov r10d, 4
sbb r10, 0
jmp 0x1400037f0
shl esi, 0xc
or r11d, esi
test r10b, 1
je 0x1400038a6
mov byte [rcx + 0x18], dl
mov r9, rax
jmp 0x140003927
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
mov rsi, r8
call fcn.140003570
mov rcx, rdi
test byte [rsp + 0x38], 1
jne 0x140003945
jmp 0x140003977
mov byte [rcx + 0x18], dl
test r10b, 1
je 0x140003962
mov rsi, r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r9
mov eax, 1
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
je 0x140003977
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rcx + 0x68]
sub rdx, r9
mov rax, rsi
add rax, r9
mov qword [rcx + 0x68], r8
jmp 0x1400039ad
mov rsi, r8
mov byte [rcx + 0x1a], 1
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x140003945
cmp byte [rcx + 0x79], 0
jne 0x14000377d
mov byte [rcx + 0x79], 1
cmp byte [rcx + 0x78], 1
jne 0x140003995
mov rax, qword [rcx + 0x68]
mov rdx, qword [rcx + 0x70]
jmp 0x1400039a6
mov rax, qword [rcx + 0x68]
mov rdx, qword [rcx + 0x70]
cmp rdx, rax
je 0x14000377d
sub rdx, rax
add rax, qword [rcx + 0x48]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rcx + 0x18], dl
lea rcx, [0x140675f80]
mov qword [rsp + 0x20], rcx
mov rcx, r8
mov rdx, r9
mov r8, rax
call fcn.140020b60
int3
Function at 0x140008270
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140008310
jmp 0x1400082ff
jae 0x1400083de
cmp r8, 0x201
jae 0x140008310
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140008376
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000834e
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001fb20
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14000839f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000844a
mov r8d, r13d
cmp r12, r8
jne 0x1400082f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000847e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400082ff
jmp 0x140008310
cmp r14, r8
jb 0x140008498
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000a4d0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140008433
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140005990
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000841e
jmp 0x140008433
lea rcx, str.internal_error:_entered_unreachable_code_rustc_8d6b88b168e45ee1624699c19443c49665322a91library_alloc_src_vecmod.rs
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400206f0
jmp 0x1400084ad
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140020a40
ud2
Function at 0x14000eb10
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000fe30
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rcx, rax
neg rcx
jo 0x14000eb6b
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov r8b, 1
call fcn.140010c50
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov rax, rdi
neg rax
jno 0x14000eb76
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000eba0
test rdi, rdi
je 0x14000ebcc
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140005990
xor eax, eax
jmp 0x14000eb6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14000eb6e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140005990
jmp 0x14000eb6b
xor eax, eax
jmp 0x14000eb6e

Function at 0x14000ebd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x140677d88]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000ec66
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x14000ec93
test eax, eax
js 0x14000ec72
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x14000ec89
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.14000a060
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.1400065d0
mov ecx, 7
int 0x29
ud2
Function at 0x14000f650
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140683141]
mov ecx, 0x10
mov edx, 8
call fcn.140005980
test rax, rax
je 0x14000f73b
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, case.0x14000b35e.306
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14000f72d
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x14000f6ea
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000f704
mov r8, qword [rax + 0x10]
call fcn.140005990
mov edx, 0x10
mov r8d, 8
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
Function at 0x14001f1c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f20e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f20e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f20e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f20e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f20e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001f210
xor al, al
add rsp, 0x28
ret