joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18013d020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140D.dll_memset
jmp 0x18013d068
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18013d088
jmp 0x18013d125
cmp dword [rsp + 0x68], 0x1000
jne 0x18013d0ad
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x18013d0ad
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x18013d0af
jmp 0x18013d053
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18013d0e5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x18013d0e5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x18013d0ea
jmp 0x18013d053
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x18013d053
mov rax, qword [rsp + 0x20]
jmp 0x18013d127
xor eax, eax
add rsp, 0x88
ret

Function at 0x18013d6e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140D.dll_memset
nop
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18013d72c
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18013d7fa
cmp dword [rsp + 0x60], 0x1000
jne 0x18013d751
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x18013d751
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x18013d763
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18013d7fa
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18013d78b
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18013d7fa
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18013d7c0
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18013d7fa
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18013d7dc
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18013d7fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x28]
jmp 0x18013d7fa
add rsp, 0x78
ret
Function at 0x18013ef90
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.18013ed80
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18013f067
mov dword [rsp + 0x20], 0
jmp 0x18013f004
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18013f067
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18013f065
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.18013eb60
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18013effa
add rsp, 0x30
pop rdi
ret

Function at 0x18013f080
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18013f124
mov dword [rsp + 0x20], 0
jmp 0x18013f0bd
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18013f10d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18013f10b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18013f0b3
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180229660]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret
Function at 0x18013f130
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x180229cb0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18013f1b4
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18013f1dd
mov eax, 0xa
jmp 0x18013f317
cmp dword [rsp + 0x88], 0
je 0x18013f24b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18013f249
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x18013f297
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18013f27b
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140D.dll_memcpy
jmp 0x18013f297
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140D.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1801960d0]
call fcn.180141c60
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x180140800
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18014086e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18014086e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18014086e
xor eax, eax
jmp 0x1801408b5
mov dword [rsp], 1
jmp 0x18014087f
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x1801408b0
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1801408ae
xor eax, eax
jmp 0x1801408b5
jmp 0x180140877
mov eax, 1
add rsp, 0x10
pop rdi
ret
Function at 0x140002680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov qword [rsp + 0x28], r8
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140002900
mov rbx, rdx
mov rsi, qword [rcx + 0x10]
shl rax, 4
lea rbp, [rax + rax*4]
jmp 0x1400026ce
add rsi, 0x50
add rbp, 0xffffffffffffffb0
je 0x140002900
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x70]
call fcn.14000ee10
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14000ee10
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
cmp r12, r13
jne 0x140002750
movzx edi, byte [rsp + 0x80]
movzx eax, byte [rsp + 0xa8]
cmp al, byte [rsp + 0x68]
jne 0x140002758
cmp byte [rsp + 0xa9], 2
jne 0x140002758
cmp byte [rsp + 0x69], 2
jne 0x140002758
cmp dil, 6
jne 0x1400028bf
cmp byte [rsp + 0x40], 2
ja 0x1400028e8
mov al, 6
jmp 0x14000278d
movzx edi, byte [rsp + 0x80]
mov al, 6
cmp dil, 6
je 0x14000278d
lea rcx, [rsp + 0x81]
mov rax, qword [rcx + 0x1f]
mov qword [rsp + 0xcf], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov eax, edi
movzx ecx, byte [rsp + 0xaa]
movzx edx, word [rsp + 0xa8]
mov qword [rsp + 0x108], r15
mov qword [rsp + 0x110], r12
mov byte [rsp + 0x118], al
mov rax, qword [rsp + 0xcf]
lea r8, [rsp + 0x119]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x140], dx
mov byte [rsp + 0x142], cl
movzx eax, byte [rsp + 0x40]
cmp al, 6
je 0x140002821
lea rdx, [rsp + 0x41]
mov rcx, qword [rdx + 0x1f]
mov qword [rsp + 0xff], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
movzx ecx, byte [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xff]
lea r8, [rsp + 0x159]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x180], dx
mov byte [rsp + 0x182], cl
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x148]
call fcn.140001600
test al, al
jne 0x140002907
cmp dword [rsi + 0x48], 0x3b9aca01
jne 0x1400026c0
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.140002930
test rax, rax
je 0x1400026c0
jmp 0x140002904
movzx eax, byte [rsp + 0x40]
cmp al, 6
jne 0x1400028d4
cmp dil, 3
jb 0x140002760
jmp 0x1400028e8
cmp dil, 3
setb cl
cmp al, 3
setb al
xor al, cl
jne 0x140002760
mov rcx, r15
mov rdx, r14
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002758
jmp 0x140002907
xor eax, eax
jmp 0x140002914
mov rsi, rax
xor eax, eax
cmp dword [rsi + 0x48], 0x3b9aca01
cmovne rax, rsi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov qword [rsp + 0x28], r8
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140002bb0
mov rbx, rdx
mov rsi, qword [rcx + 0x10]
shl rax, 4
lea r13, [rax + rax*4]
jmp 0x14000297e
add rsi, 0x50
add r13, 0xffffffffffffffb0
je 0x140002bb0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x70]
call fcn.14000ee10
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14000ee10
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
cmp r15, r12
jne 0x140002a00
movzx edi, byte [rsp + 0x80]
movzx eax, byte [rsp + 0xa8]
cmp al, byte [rsp + 0x68]
jne 0x140002a08
cmp byte [rsp + 0xa9], 2
jne 0x140002a08
cmp byte [rsp + 0x69], 2
jne 0x140002a08
cmp dil, 6
jne 0x140002b6f
cmp byte [rsp + 0x40], 2
ja 0x140002b98
mov al, 6
jmp 0x140002a3d
movzx edi, byte [rsp + 0x80]
mov al, 6
cmp dil, 6
je 0x140002a3d
lea rcx, [rsp + 0x81]
mov rax, qword [rcx + 0x1f]
mov qword [rsp + 0xcf], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov eax, edi
movzx ecx, byte [rsp + 0xaa]
movzx edx, word [rsp + 0xa8]
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], r15
mov byte [rsp + 0x118], al
mov rax, qword [rsp + 0xcf]
lea r8, [rsp + 0x119]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x140], dx
mov byte [rsp + 0x142], cl
movzx eax, byte [rsp + 0x40]
cmp al, 6
je 0x140002ad1
lea rdx, [rsp + 0x41]
mov rcx, qword [rdx + 0x1f]
mov qword [rsp + 0xff], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
movzx ecx, byte [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x150], r12
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xff]
lea r8, [rsp + 0x159]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x180], dx
mov byte [rsp + 0x182], cl
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x148]
call fcn.140001600
test al, al
jne 0x140002bb2
cmp dword [rsi + 0x48], 0x3b9aca01
jne 0x140002970
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.140002930
test rax, rax
je 0x140002970
jmp 0x140002bc9
movzx eax, byte [rsp + 0x40]
cmp al, 6
jne 0x140002b84
cmp dil, 3
jb 0x140002a10
jmp 0x140002b98
cmp dil, 3
setb cl
cmp al, 3
setb al
xor al, cl
jne 0x140002a10
mov rcx, r14
mov rdx, rbp
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002a08
jmp 0x140002bb2
xor esi, esi
mov rax, rsi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rax
jmp 0x140002bb2
Function at 0x140009650
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400096f0
jmp 0x1400096df
jae 0x1400097af
cmp r8, 0x201
jae 0x1400096f0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140009747
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x14000971f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14002a220
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140009770
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000981b
mov r8d, r13d
cmp r12, r8
jne 0x1400096d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000984f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400096df
jmp 0x1400096f0
cmp r14, r8
jb 0x140009869
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000c4f0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140009804
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140002c10
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400097ef
jmp 0x140009804
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002b5d0
jmp 0x14000987e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002b980
ud2
Function at 0x14000f830
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.1400295b0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x140014460]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call fcn.140014250
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x14000fa20
test r15, r15
je 0x14000f9ec
cmp r15, 0x1000
ja 0x14000fa42
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x14000f9c0
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14000f950
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x14000f9e0
add r12, rax
cmp r12, r15
je 0x14000f9b0
jbe 0x14000f900
jmp 0x14000fa2e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14000f8ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140003ec0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140003ec0
jmp 0x14000f9ec
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14002b9f0
jmp 0x14000fa56
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14002b980
ud2
Function at 0x140012d20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14006e508]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140012d58
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140012db6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140012de3
test eax, eax
js 0x140012dc2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140012dd9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14000c190
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140004450
mov ecx, 7
int 0x29
ud2

Function at 0x140013900
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp + 0x70], rcx
mov byte [rbp + 0xb5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
mov r12d, 8
mov sil, 1
xorps xmm6, xmm6
lea rbx, [rbp + 0x20]
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 8], rax
nop word cs:[rax + rax]
Function at 0x1400196f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
mov esi, ecx

Function at 0x14001aca0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rsi
push rdi
push rbx
sub rsp, 0x50
in al, dx
push rax
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov dword [rbp - 8], 0xfffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov esi, ecx
movzx eax, byte [0x140079141]
mov ecx, 0x10
mov edx, 8
call fcn.140002c00
invalid
invalid
test rax, rax
je 0x14001ad8b
invalid
lodsb al, byte [rsi]
add byte [rax], al
invalid
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
invalid
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, case.0x14000e907.223
xor edi, edi
xor ecx, ecx
leave
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
adc eax, 0x112ef
mov rdx, rax
test rax, rax
jne 0x14001ad7d
invalid
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
test eax, eax
je case.0x14000d92a.236
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
invalid
je case.0x14000d857.274
mov r8, qword [rax + 0x10]
call fcn.140002c10
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x20]
call fcn.140002c10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rsi
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14002b420
ud2