joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fed03830
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x2fed03848
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x2fed03850
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x2fed03860
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x2fed038ad
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x2fed038a4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x2fed038af
add rax, 0x28
cmp rax, r9
jne 0x2fed03890
xor eax, eax
ret

Function at 0x2fed038b0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x2fed03940
mov rdx, qword [0x2fed0b850]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x2fed0392e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x2fed0392e
cmp word [rax + 0x18], 0x20b
jne 0x2fed0392e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x2fed03940
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x2fed03919
add rbx, 0x28
cmp rbx, rdi
je 0x2fed03940
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x2fed03910
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x2fed03950
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2fed0b850]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2fed03970
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2fed03978
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2fed03970
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x2fed039cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x2fed039c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2fed03970
add rax, 0x28
cmp rax, r9
jne 0x2fed039b0
xor eax, eax
ret

Function at 0x2fed039d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2fed0b850]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x2fed039ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x2fed039f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x2fed039ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x2fed03a10
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x2fed0b850]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x2fed03a30
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x2fed03a38
ret
cmp word [rdx + 0x18], 0x20b
jne 0x2fed03a30
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x2fed03a80
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x2fed03a77
test rcx, rcx
je 0x2fed03a30
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x2fed03a68
xor eax, eax
ret

Function at 0x2fed03a90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2fed0b850]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x2fed03aaf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x2fed03ab8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x2fed03ad0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2fed0b850]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2fed03af0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2fed03af8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2fed03af0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x2fed03af0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x2fed03b44
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x2fed03b50
add rdx, 0x28
cmp r9, rdx
jne 0x2fed03b30
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x2fed03b60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x2fed0b850]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x2fed03b82
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x2fed03b90
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2fed03b82
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x2fed03b82
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x2fed03b82
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x2fed03be5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x2fed03bf8
add rdx, 0x28
cmp rdx, r10
jne 0x2fed03bd0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x2fed03c07
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x2fed03c17
mov edx, dword [rax + 0xc]
test edx, edx
je 0x2fed03bee
test ecx, ecx
jg 0x2fed03c00
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400020b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x168
lea rax, str._ProgramFiles_Windows_DefenderMpClient.dll
mov qword [rsp + 0x40], rax
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400020f5
xor al, al
jmp 0x14000216a
lea rdx, str.WDStatus
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140002123
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x14000216a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x34]
call qword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
jl 0x14000215d
cmp dword [rsp + 0x34], 0
je 0x14000215d
mov dword [rsp + 0x20], 1
jmp 0x140002165
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x168
ret
Function at 0x140002180
Capabilities:
Disable windows defender features via registry on windows
Set registry value

Disassembly:
sub rsp, 0x78
call fcn.1400020b0
movzx eax, al
test eax, eax
je 0x140002357
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x14000233a
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Real_Time_Protection
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableBehaviorMonitoring
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableOnAccessProtection
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableIOAVProtection
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Windows_Defender_is_currently_enabled._We_has_been_disabled_Windows_Defender_automatically._Please_restart_your_computer_to_apply_this_change._n
call fcn.140003770
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x140002374
lea rcx, str.Windows_Defender_is_already_disabled._GOOD._n
call fcn.140003770
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x140002374
add rsp, 0x78
ret
Function at 0x1400024c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xb0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x76]
lea rcx, [rsp + 0x31]
call fcn.1400025c0
mov rcx, rax
call fcn.140003110
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025b5
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x32]
call fcn.140002660
mov rcx, rax
call fcn.1400030f0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x34], 0
je 0x1400025a9
mov byte [rsp + 0x30], 1
jmp 0x1400025ae
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
jmp 0x1400025b7
xor al, al
add rsp, 0xb0
pop rdi
ret

Function at 0x1400029e0
Capabilities:
Get uefi variable

Disassembly:
push rdi
sub rsp, 0x90
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
cmp dword [rsp + 0x24], 2
je 0x140002a32
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x4b]
lea rcx, [rsp + 0x20]
call fcn.140002af0
mov rcx, rax
call fcn.140003090
mov rcx, rax
call fcn.140003770
xor al, al
jmp 0x140002ae5
lea rax, str.SE_SYSTEM_ENVIRONMENT_NAME
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400028e0
movzx eax, al
test eax, eax
jne 0x140002a56
xor al, al
jmp 0x140002ae5
xor r9d, r9d
xor r8d, r8d
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x1400041a7]
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
test eax, eax
jne 0x140002ab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x140002ab3
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x21]
call fcn.140002b90
mov rcx, rax
call fcn.140003070
mov rcx, rax
call fcn.140003770
mov al, 1
jmp 0x140002ae5
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x6a]
lea rcx, [rsp + 0x22]
call fcn.140002c30
mov rcx, rax
call fcn.140003090
mov rcx, rax
call fcn.140003770
xor al, al
add rsp, 0x90
pop rdi
ret

Function at 0x140003770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x50]
call fcn.1400036f0
mov dword [rsp + 0x34], eax
mov rax, qword [0x140007018]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x48
ret
Function at 0x140003a10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
mov ecx, 0x20c
call fcn.1400035b0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140003a40
xor eax, eax
jmp 0x140003b3c
mov r8d, 0x104
mov rdx, qword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 4
jbe 0x140003ad4
mov rcx, qword [rsp + 0x28]
call fcn.140003730
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x20], eax
jmp 0x140003a7c
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jbe 0x140003abe
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x140003aa7
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x2f
jne 0x140003abc
mov eax, dword [rsp + 0x20]
inc eax
mov eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x28]
mov word [rdx + rax*2], cx
jmp 0x140003abe
jmp 0x140003a72
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140003930
mov qword [rsp + 0x30], rax
jmp 0x140003b28
mov rdx, qword [rsp + 0x28]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, 4
jbe 0x140003aff
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140003930
mov qword [rsp + 0x30], rax
jmp 0x140003b28
mov rdx, qword [rsp + 0x28]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 4
jbe 0x140003b28
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140003930
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400035e0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140003bb0
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x58
mov r8d, 4
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140003b50
mov r8d, 0x16
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140003b50
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [0x140007018]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx eax, word [rsp + 0x38]
movsx ecx, word [rsp + 0x3a]
imul eax, ecx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
mov dl, 0x20
mov rcx, qword [0x140007018]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx eax, word [rsp + 0x38]
movsx ecx, word [rsp + 0x3a]
imul eax, ecx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
movzx edx, word [rsp + 0x40]
mov rcx, qword [0x140007018]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, dword [rsp + 0x30]
mov rcx, qword [0x140007018]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
add rsp, 0x58
ret
Function at 0x140003ce0
Capabilities:
Manipulate console buffer

Disassembly:
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov edx, dword [rax]
mov rcx, qword [0x140007018]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 1
jne 0x140003e5a
movsd xmm0, qword [rsp + 0x58]
mulsd xmm0, qword [0x140005ff8]
cvttsd2si rax, xmm0
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
cvtsi2sd xmm0, rax
movsd xmm1, qword [rsp + 0x58]
mulsd xmm1, xmm0
movaps xmm0, xmm1
cvttsd2si rax, xmm0
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
cmp dword [rsp + 0x28], eax
jbe 0x140003d66
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
add eax, 0x64
mov ecx, eax
call fcn.1400035b0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140003da1
lea rcx, str._Progressbar::update__Failed_to_allocate_ProgressBuffer__n
call fcn.140003770
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003e5a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0x5b
mov dword [rsp + 0x20], 0
jmp 0x140003dc7
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
cmp dword [rsp + 0x20], eax
jae 0x140003de8
mov eax, dword [rsp + 0x20]
inc eax
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0x20
jmp 0x140003dbd
mov dword [rsp + 0x24], 0
jmp 0x140003dfc
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jae 0x140003e19
mov eax, dword [rsp + 0x24]
inc eax
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0x3d
jmp 0x140003df2
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0x5d
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
inc eax
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x38]
call fcn.140003770
mov rcx, qword [rsp + 0x38]
call fcn.1400035e0
mov qword [rsp + 0x38], rax
add rsp, 0x48
ret
Function at 0x14000174f
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
cmp bl, bl
invalid
push rax
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
add byte [rax], al
Function at 0x140014340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400143d0
cmp r11, r10
ja 0x140014446
cmp r10, rdx
ja 0x14001445a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400143d2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400143b0
jmp 0x140014434
ja 0x1400143da
mov r11, r10
cmp rax, r8
jne 0x140014374
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140014410
mov rdi, r8
sub ecx, edx
jns 0x14001442b
jmp 0x140014436
cmp r8, rsi
je 0x14001446b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140014436
xor al, 1
cmp rdi, rsi
jne 0x1400143f0
jmp 0x140014436
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400a5800
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400a5530
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400a55b0
ud2

Function at 0x14001c198
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14001c1be
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14001c1a8
mov qword [rcx], rax
ret

Function at 0x14001c2a6
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14002e0f0
test rbx, rbx
je 0x14001c2df
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14001c198
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14001c190
Function at 0x1400447eb
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.14004456b
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400448c9
test eax, eax
je 0x1400448e5
cmp eax, 0x90317
je 0x14004495e
cmp eax, 0x90321
jne 0x140044966
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14004478b
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x140044974
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140044962
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.140044988
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.14003989e
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14004478b
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x140044974
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140044974
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x140044c5b
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
lea r9, str.C:Users_roc.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.14004456b
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140044d3f
test eax, eax
je 0x140044d5e
cmp eax, 0x90317
je 0x140044de0
cmp eax, 0x90321
jne 0x140044de8
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140044bfb
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x140044df6
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x140044de4
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.140044988
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.14003989e
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140044bfb
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x140044df6
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140044df6
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret