joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dba0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx + 8]
cmp rdi, 2
jb 0x1000dc0c
mov ebp, dword [rdx + 0x10]
mov rbx, qword [rdx]
lea r14, sym._ZN4core3ptr114drop_in_place_LT__RF_std..collections..hash..map..HashMap_LT_alloc..string..String_C_alloc..string..String_GT__
lea r15, [rsp + 0x20]
nop dword [rax + rax]
mov eax, dword [rbx]
xor eax, ebp
movzx ecx, ax
and eax, 0xffff0000
mov edx, dword [rbx + 4]
xor edx, ebp
shl rdx, 0x20
or rax, rdx
or rcx, rax
add rdi, 0xfffffffffffffffe
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov rdx, r15
mov r8, r14
call sym.core::fmt::builders::DebugSet::entry::h3e7a8265e596a97c
add rbx, 8
cmp rdi, 1
ja 0x1000dbd0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1001ae60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x18]
lea rax, [rdx - 2]
cmp rax, 4
jb 0x1001af9c
cmp rdx, 2
jb 0x1001afb2
mov r8, rcx
mov r11, qword [rcx + 8]
lea r10, [rdx - 6]
lea eax, [r11*4]
test r11, r11
je 0x1001af0d
mov r14, qword [r8]
shl r11, 2
xor r9d, r9d
jmp 0x1001aefd
movzx ecx, byte [r14 + r9]
movzx ebp, byte [r14 + r9 + 1]
movzx ebx, byte [r14 + r9 + 2]
movzx edi, byte [r14 + r9 + 3]
movzx esi, cl
mov ecx, r9d
rol esi, cl
movzx ebp, bpl
lea ecx, [r9 + 1]
rol ebp, cl
movzx ebx, bl
lea ecx, [r9 + 2]
rol ebx, cl
add esi, eax
add ebp, esi
movzx eax, dil
lea ecx, [r9 + 3]
rol eax, cl
add ebx, ebp
add eax, ebx
add r9, 4
cmp r11, r9
je 0x1001af0d
cmp r9d, 0x3c
jne 0x1001aeb0
xor ecx, ecx
xor ebp, ebp
xor ebx, ebx
xor edi, edi
jmp 0x1001aec7
cmp r10, 2
jb 0x1001af91
mov r8, qword [r8 + 0x10]
mov r9d, dword [r8 + 4]
test dl, 2
jne 0x1001af46
mov ebp, dword [r8 + 0x10]
xor ebp, r9d
mov ecx, dword [r8 + 0x14]
xor ecx, r9d
add r8, 0x18
lea r10, [rdx - 8]
rol ebp, cl
add eax, ebp
and rdx, 0xfffffffffffffffe
cmp rdx, 8
jne 0x1001af60
jmp 0x1001af91
add r8, 0x10
and rdx, 0xfffffffffffffffe
cmp rdx, 8
je 0x1001af91
nop word cs:[rax + rax]
mov edx, dword [r8]
xor edx, r9d
mov ecx, dword [r8 + 4]
xor ecx, r9d
rol edx, cl
add edx, eax
mov eax, dword [r8 + 8]
xor eax, r9d
mov ecx, dword [r8 + 0xc]
xor ecx, r9d
rol eax, cl
add r10, 0xfffffffffffffffc
add eax, edx
add r8, 0x10
cmp r10, 1
ja 0x1001af60
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str._root_.cargo_registry_src_github.com_1ecc6299db9ec823_pelite_0.9.2_src_rich_structure.rs0
mov ecx, 4
mov rdx, rax
call dbg.slice_index_order_fail
ud2
lea r8, str._root_.cargo_registry_src_github.com_1ecc6299db9ec823_pelite_0.9.2_src_rich_structure.rs0
mov rcx, rax
call dbg.slice_end_index_len_fail
ud2
Function at 0x1001ba30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rcx
lea rcx, [rsp + 0x28]
call sym.core::fmt::Formatter::debug_list::h772b731578f948a7
mov rsi, qword [rdi + 8]
cmp rsi, 2
jb 0x1001baac
mov ebp, dword [rdi + 0x10]
mov rdi, qword [rdi]
lea r14, sym._ZN4core3ptr114drop_in_place_LT__RF_std..collections..hash..map..HashMap_LT_alloc..string..String_C_alloc..string..String_GT__
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x20]
nop word [rax + rax]
mov eax, dword [rdi]
xor eax, ebp
movzx ecx, ax
and eax, 0xffff0000
mov edx, dword [rdi + 4]
xor edx, ebp
shl rdx, 0x20
or rax, rdx
or rcx, rax
add rsi, 0xfffffffffffffffe
mov qword [rsp + 0x20], rcx
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sym.core::fmt::builders::DebugSet::entry::h3e7a8265e596a97c
add rdi, 8
cmp rsi, 1
ja 0x1001ba70
lea rcx, [rsp + 0x28]
call sym.core::fmt::builders::DebugList::finish::h2cd88026bcd82d43
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1001da80
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rdx]
mov edx, r8d
call sub.KERNEL32.dll_TerminateProcess
test eax, eax
je 0x1001daa0
mov qword [rsi], 4
jmp 0x1001dab8
call sym.std::sys::windows::os::errno::h2cf8161a54ff713e
shl rax, 0x20
or rax, 2
mov qword [rsi], 0
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x1001dbf0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 8
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov edi, 8
lea r12, [rsp + 0x34]
lea r15, [rsp + 0x38]
xor r14d, r14d
xor esi, esi
jmp 0x1001dc5d
mov rsi, rbp
mov qword [rsp + 0x48], rsi
mov r14, rsi
mov esi, ebp
mov rcx, qword [r13]
lea r8d, [r14*8]
mov dword [rsp + 0x20], 3
mov rdx, rdi
mov r9, r12
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x1001dd0e
mov ebp, dword [rsp + 0x34]
cmp ebp, esi
jbe 0x1001dd4d
cmp r14, rbp
jae 0x1001dc50
mov rbx, rbp
sub rbx, r14
mov rax, qword [rsp + 0x38]
sub rax, r14
mov rsi, r14
cmp rax, rbx
jae 0x1001dcc3
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h82dc6b755082e43f
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
lea rcx, [rdi + rsi*8]
cmp rbx, 2
jb 0x1001dcf6
mov r8, r14
not r8
add r8, rbp
shl r8, 3
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsi + rbp]
sub rax, r14
lea rcx, [rdi + rax*8]
add rcx, 0xfffffffffffffff8
add rsi, rbx
dec rsi
cmp r14, rbp
je 0x1001dc53
mov qword [rcx], 0
inc rsi
jmp 0x1001dc53
call sym.std::sys::windows::os::errno::h2cf8161a54ff713e
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x50]
mov qword [rsi + 8], rax
mov qword [rsi], 0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1001dddd
mov rcx, qword [rsp + 0x40]
shl rdx, 3
mov r8d, 8
jmp 0x1001ddd8
mov r15, rbp
shr r15, 3
cmp r14, r15
jb 0x1001ddf1
cmp ebp, 8
jae 0x1001dd6b
mov eax, 8
xor ecx, ecx
jmp 0x1001dda9
mov rsi, r15
shl rsi, 4
mov edx, 8
mov rcx, rsi
call sym.__rust_alloc
test rax, rax
je 0x1001de05
xor edx, edx
xor ecx, ecx
nop dword [rax]
mov rbp, qword [rdi + rcx*8]
mov qword [rax + rdx], rbp
mov qword [rax + rdx + 8], r13
inc rcx
add rdx, 0x10
cmp rsi, rdx
jne 0x1001dd90
mov rsi, qword [rsp + 0x50]
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov qword [rsi], 4
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1001dddd
shl rdx, 3
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str._root_.cargo_registry_src_github.com_1ecc6299db9ec823_winproc_0.6.4_src_process_mod.rs
mov rcx, r15
mov rdx, r14
call dbg.slice_end_index_len_fail
jmp 0x1001de12
mov edx, 8
mov rcx, rsi
call dbg.handle_alloc_error
ud2

Function at 0x100216f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, qword [rcx]
mov rcx, qword [rax]
jmp sym.__std::sys_common::net::TcpListener_as_core::fmt::Debug_::fmt::h309f0df7e81f095f
Function at 0x10022920
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x10022978
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x10022992
lea rax, [0x100d8f14]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, [0x1055ccb0]
lea r8, str.library_std_src_synconce.rs
mov edx, 0x2b
call dbg.panic
ud2
mov qword [rsp + 0x40], 0
lea rdx, [0x10561700]
lea r9, str.library_std_src_syswindows_net.rs
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call dbg.assert_failed<i32, i32>
ud2
Function at 0x100400b0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rcx
mov rsi, qword [rcx + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x100400cb
dec ecx
jmp 0x100400d5
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x100400fd
dec ecx
jmp 0x10040107
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.100d8ac4

Function at 0x10040200
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x30], rcx
mov rsi, qword [rcx + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004021d
dec ecx
jmp 0x10040227
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov rdi, qword [rsp + 0x30]
cmp qword [rdi], 0
je 0x10040254
mov rax, qword [rdi + 8]
test rax, rax
je 0x10040254
lock dec qword [rax]
jne 0x10040254
mov rcx, qword [rdi + 8]
call dbg.drop_slow<std::sync::mpmc::context::Inner>
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x10040272
dec ecx
jmp 0x1004027c
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
call fcn.100d8ac4
nop
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x10040370
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x30], rcx
mov rsi, qword [rcx + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004038d
dec ecx
jmp 0x10040397
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov rdi, qword [rsp + 0x30]
cmp qword [rdi], 0
je 0x100403c4
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x100403c4
lock dec qword [rax]
jne 0x100403c4
mov rcx, qword [rdi + 0x10]
call dbg.drop_slow<std::thread::Inner>
mov edx, 0x20
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x100403e2
dec ecx
jmp 0x100403ec
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
call fcn.100d8ac4
nop
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x100404e0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rcx
mov rsi, qword [rcx + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x100404fb
dec ecx
jmp 0x10040505
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov edx, 0x20
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004052d
dec ecx
jmp 0x10040537
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.100d8ac4

Function at 0x10040630
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004064a
dec ecx
jmp 0x10040654
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004067c
dec ecx
jmp 0x10040686
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.100d8ac4

Function at 0x10040780
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x30], rcx
mov rsi, qword [rcx + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1004079d
dec ecx
jmp 0x100407a7
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
mov edx, 1
call fcn.100d8ac4
mov rdi, qword [rsp + 0x30]
cmp qword [rdi], 0
je 0x100407d4
mov rax, qword [rdi + 8]
test rax, rax
je 0x100407d4
lock dec qword [rax]
jne 0x100407d4
mov rcx, qword [rdi + 8]
call dbg.drop_slow<std::sync::mutex::Mutex<alloc::vec::Vec<u8, alloc::alloc::Global>>>
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x100407f2
dec ecx
jmp 0x100407fc
mov rcx, rsi
call sym.std::sys::windows::thread_local_key::StaticKey::init::hfcbb047e39b8e62f
mov ecx, eax
xor edx, edx
call fcn.100d8ac4
nop
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x10041240
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x10041275
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x10041285
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x10042b10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor r12d, r12d
mov r15d, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x10042b90
jmp 0x10042b7f
jae 0x10042c34
cmp r8, 0x201
jae 0x10042b90
lea rdi, [rsp + 0x68]
mov esi, 0x200
mov rbp, r8
jmp 0x10042bd6
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x10042bb7
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h230005e80921748b
mov r12, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp r12, r15
mov ebx, 0xffffffff
cmovb rbx, r12
mov qword [rsp + 0x40], rbx
mov r13, r12
mov rdi, qword [rsp + 0x20]
mov rsi, rbx
mov rbp, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebp
mov rdx, rdi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r14d, eax
test eax, eax
jne 0x10042bfb
call fcn.100d8c94
test eax, eax
jne 0x10042c92
mov r8d, r14d
cmp rbp, r8
jne 0x10042b70
call fcn.100d8c94
cmp eax, 0x7a
jne 0x10042cb2
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov r8, rbp
cmp r8, 0x201
jb 0x10042b7f
jmp 0x10042b90
cmp rsi, r8
jb 0x10042ccc
lea rcx, [rsp + 0x48]
mov rdx, rdi
call dbg.from_wide
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rsi, qword [rsp + 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x10042c7b
add r12, r12
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, r12
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.100d8c94
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x10042c65
jmp 0x10042c7b
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call dbg.panic
jmp 0x10042ce1
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call dbg.slice_end_index_len_fail
ud2

Function at 0x10042d20
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x70
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x10042d38
mov rdx, rax
add rsp, 0x70
pop rsi
ret
call fcn.100d8c94
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h26c9af03b99da041]
mov qword [rsp + 0x38], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindowsos.rs
lea rcx, [rsp + 0x40]
call dbg.panic_fmt
ud2
Function at 0x10043720
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], r9
lea r14, [rsp + 0x28]
mov rcx, r14
call sym.std::sys::windows::to_u16s::inner::hf098d0b6c6656771
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
test r15, r15
je 0x100437fd
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r8, rsi
call sym.std::sys::windows::to_u16s::inner::hf098d0b6c6656771
mov rbx, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
test r12, r12
je 0x10043819
mov rcx, r15
mov rdx, r12
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
je 0x100438c2
xor esi, esi
test rbx, rbx
je 0x100437dd
add rbx, rbx
mov r8d, 2
mov rcx, r12
mov rdx, rbx
call sym.__rust_dealloc
test rdi, rdi
je 0x10043803
add rdi, rdi
mov r8d, 2
mov rcx, r15
mov rdx, rdi
call sym.__rust_dealloc
test rsi, rsi
je 0x10043808
jmp 0x1004383a
mov rbx, rdi
mov rsi, rbx
test rsi, rsi
jne 0x1004383a
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test rdi, rdi
je 0x10043800
add rdi, rdi
mov r8d, 2
mov rcx, r15
mov rdx, rdi
call sym.__rust_dealloc
mov rsi, rbx
test rsi, rsi
je 0x10043808
mov qword [rsp + 0x20], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [sym.__std::path::Display_as_core::fmt::Debug_::fmt::h2609e6f6a172ff79]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h26c9af03b99da041]
mov qword [rsp + 0x50], rax
lea rax, [0x1055e4e8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 3
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 3
lea rdx, [0x1055e518]
lea rcx, [rsp + 0x58]
call dbg.panic_fmt
ud2
call fcn.100d8c94
mov esi, eax
shl rsi, 0x20
or rsi, 2
test rbx, rbx
jne 0x100437c9
jmp 0x100437dd
Function at 0x10043920
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
lea rcx, [rsp + 0x40]
call sym.std::sys::windows::to_u16s::inner::hf098d0b6c6656771
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1004398d
xor esi, esi
mov rcx, rbx
xor edx, edx
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
jne 0x10043972
call fcn.100d8c94
mov esi, eax
shl rsi, 0x20
or rsi, 2
test rdi, rdi
je 0x10043990
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
jmp 0x10043990
mov rsi, rdi
test rsi, rsi
jne 0x100439a0
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
lea rax, [sym.__std::path::Display_as_core::fmt::Debug_::fmt::h2609e6f6a172ff79]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h26c9af03b99da041]
mov qword [rsp + 0x88], rax
lea rax, str.failed_to_remove_environment_variable__
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x1055e578]
lea rcx, [rsp + 0x40]
call dbg.panic_fmt
ud2
Function at 0x100450a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov r14, rcx
test r8, r8
je 0x10045113
setns al
js 0x10045258
mov r15, rdx
movzx ebx, al
mov rcx, rsi
mov rdx, rbx
call sym.__rust_alloc
test rax, rax
je 0x1004525f
mov rdi, rax
mov rbx, rax
mov rcx, rdi
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rdi
cmp rsi, 8
jb 0x1004520c
cmp rsi, 0x20
jae 0x1004511d
xor eax, eax
jmp 0x100451a6
mov ebx, 1
jmp 0x1004522f
mov rax, rsi
and rax, 0xffffffffffffffe0
xor ecx, ecx
movdqa xmm0, xmmword [0x1055c530]
movdqa xmm1, xmmword [0x1055c540]
movdqa xmm2, xmmword [0x1055c550]
nop
movdqu xmm3, xmmword [rbx + rcx]
movdqu xmm4, xmmword [rbx + rcx + 0x10]
movdqa xmm5, xmm3
paddb xmm5, xmm0
movdqa xmm6, xmm4
paddb xmm6, xmm0
movdqa xmm7, xmm5
pminub xmm7, xmm1
pcmpeqb xmm7, xmm5
pand xmm7, xmm2
movdqa xmm5, xmm6
pminub xmm5, xmm1
pcmpeqb xmm5, xmm6
pand xmm5, xmm2
pxor xmm7, xmm3
pxor xmm5, xmm4
movdqu xmmword [rbx + rcx], xmm7
movdqu xmmword [rbx + rcx + 0x10], xmm5
add rcx, 0x20
cmp rax, rcx
jne 0x10045140
cmp rax, rsi
je 0x1004522f
test sil, 0x18
je 0x10045206
mov rdx, rsi
and rdx, 0xfffffffffffffff8
lea rcx, [rdi + rdx]
movdqa xmm0, xmmword [0x1055c560]
movdqa xmm1, xmmword [0x1055c570]
movdqa xmm2, xmmword [0x1055c580]
nop dword [rax]
movq xmm3, qword [rbx + rax]
movdqa xmm4, xmm3
paddb xmm4, xmm0
movdqa xmm5, xmm4
pmaxub xmm5, xmm1
pcmpeqb xmm5, xmm4
pandn xmm5, xmm2
pxor xmm5, xmm3
movq qword [rbx + rax], xmm5
add rax, 8
cmp rdx, rax
jne 0x100451d0
cmp rdx, rsi
jne 0x1004520c
jmp 0x1004522f
add rax, rdi
mov rcx, rax
add rdi, rsi
nop
movzx eax, byte [rcx]
lea edx, [rax - 0x61]
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, al
mov byte [rcx], dl
lea rax, [rcx + 1]
mov rcx, rax
cmp rax, rdi
jne 0x10045210
mov qword [r14], rsi
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rsi
mov byte [r14 + 0x18], 0
mov rax, r14
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call dbg.capacity_overflow
ud2
mov rcx, rsi
mov rdx, rbx
call dbg.handle_alloc_error
ud2

Function at 0x10046910
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
cmp byte [rcx], 0
je 0x1004692e
mov rcx, rdx
mov rdx, r8
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp dbg.create_dir_all
lea rcx, [rsp + 0x28]
call dbg.maybe_verbatim
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1004695e
mov rcx, rdi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x10046963
xor ebx, ebx
test rsi, rsi
jne 0x10046977
jmp 0x1004698b
mov rbx, rsi
jmp 0x1004698b
call fcn.100d8c94
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1004698b
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret