joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d400
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001d42d
mov rax, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rdx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorkind
lea rsi, [rbp - 0x28]
mov r8d, 0x11
mov rcx, rsi
call fcn.140029e20
cmp qword [rbp - 0x28], 0
mov rbx, qword [rbp - 0x20]
je 0x14001d46f
test rbx, rbx
je 0x14001d4c0
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001d4c0
mov r8d, 1
mov rcx, rbx
call fcn.140003600
jmp 0x14001d4c0
movups xmm0, xmmword [rsi + 0x10]
movaps xmmword [rbp - 0x50], xmm0
test rbx, rbx
je 0x14001d4c0
mov qword [rbp - 0x28], rbx
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x20], xmm0
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.140042bf0
mov r14b, byte [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001d4b7
mov r8d, 1
mov rcx, rbx
call fcn.140003600
test r14b, r14b
je 0x14001d54c
lea rdx, [0x14004c909]
lea rcx, [rbp - 0x28]
mov r8d, 0x11
call fcn.140029e20
cmp qword [rbp - 0x28], 0
mov rbx, qword [rbp - 0x20]
je 0x14001d4ff
test rbx, rbx
je 0x14001d555
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001d555
mov r8d, 1
mov rcx, rbx
call fcn.140003600
jmp 0x14001d555
movups xmm0, xmmword [rsi + 0x10]
movaps xmmword [rbp - 0x50], xmm0
test rbx, rbx
je 0x14001d555
mov qword [rbp - 0x28], rbx
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x20], xmm0
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.140042bf0
mov sil, byte [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001d547
mov r8d, 1
mov rcx, rbx
call fcn.140003600
test sil, sil
jne 0x14001d555
test rdi, rdi
jne 0x14001d41f
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp 0x140022bd0
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140022bd0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001d42d
mov rax, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rdx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorkind
lea rsi, [rbp - 0x28]
mov r8d, 0x11
mov rcx, rsi
call fcn.140029e20
cmp qword [rbp - 0x28], 0
mov rbx, qword [rbp - 0x20]
je 0x14001d46f
test rbx, rbx
je 0x14001d4c0
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001d4c0
mov r8d, 1
mov rcx, rbx
call fcn.140003600
jmp 0x14001d4c0
movups xmm0, xmmword [rsi + 0x10]
movaps xmmword [rbp - 0x50], xmm0
test rbx, rbx
je 0x14001d4c0
mov qword [rbp - 0x28], rbx
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x20], xmm0
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.140042bf0
mov r14b, byte [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001d4b7
mov r8d, 1
mov rcx, rbx
call fcn.140003600
test r14b, r14b
je 0x14001d54c
lea rdx, [0x14004c909]
lea rcx, [rbp - 0x28]
mov r8d, 0x11
call fcn.140029e20
cmp qword [rbp - 0x28], 0
mov rbx, qword [rbp - 0x20]
je 0x14001d4ff
test rbx, rbx
je 0x14001d555
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001d555
mov r8d, 1
mov rcx, rbx
call fcn.140003600
jmp 0x14001d555
movups xmm0, xmmword [rsi + 0x10]
movaps xmmword [rbp - 0x50], xmm0
test rbx, rbx
je 0x14001d555
mov qword [rbp - 0x28], rbx
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x20], xmm0
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.140042bf0
mov sil, byte [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001d547
mov r8d, 1
mov rcx, rbx
call fcn.140003600
test sil, sil
jne 0x14001d555
test rdi, rdi
jne 0x14001d41f
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp 0x140022bd0
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140029430
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140029461
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140029488
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x1400294bd
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x140063320]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x60], 1
movups xmmword [rax + 0x68], xmm0
lea rax, [rax + 0x68]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14002aa50]
mov qword [rbp - 0x28], rax
lea rax, str.couldnt_generate_random_bytes:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140049ad0
ud2
mov eax, dword [0x140063320]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x60], 0
je 0x140032848
mov eax, dword [0x140063320]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x68]
ret
jmp 0x140029430
Function at 0x140029be0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140029c62
jmp 0x140029cb0
mov rsi, r8
jae 0x140029d0d
cmp rsi, 0x201
jb 0x140029cb0
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x140029c8d
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.140048e10
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x140029cbd
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x140029ce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140029d55
mov r8d, edi
cmp rsi, r8
jne 0x140029c50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140029dac
add rsi, rsi
cmp rsi, 0x201
jae 0x140029c62
jmp 0x140029cb0
cmp r14, r8
jb 0x140029dc6
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14002cec0
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x140029d82
jmp 0x140029d95
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x140029d95
add rdx, rdx
je 0x140029d95
mov r8d, 2
mov rcx, r13
call fcn.140003600
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_code_rustc_e092d0b6b43f2de967af0887873151bb1c0b18d3library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140049960
jmp 0x140029ddb
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140049bc0
ud2
Function at 0x140032810
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x140029461
mov rax, qword [rcx]
movups xmm0, xmmword [rcx + 8]
mov qword [rcx], 0
cmp rax, 1
je 0x140029488
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x1400294bd
movaps xmm0, xmmword [rbp - 0x20]
mov eax, dword [0x140063320]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x60], 1
movups xmmword [rax + 0x68], xmm0
lea rax, [rax + 0x68]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14002aa50]
mov qword [rbp - 0x28], rax
lea rax, str.couldnt_generate_random_bytes:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140049ad0
ud2
mov eax, dword [0x140063320]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x60], 0
je 0x140032848
mov eax, dword [0x140063320]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x68]
ret
jmp 0x140029430

Function at 0x140033ec0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], r8
mov ecx, 0x10
mov edx, 8
call fcn.1400035f0
mov rsi, rax
test rax, rax
je 0x140033fa0
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140034030]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140033f92
mov rcx, qword [rsi]
mov qword [rbp - 0x10], rsi
mov rax, qword [rsi + 8]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rax
call qword [rax]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140033f69
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x18]
call fcn.140003600
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x10]
call fcn.140003600
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rsi
mov ecx, 0x10
mov edx, 8
call fcn.140049940
ud2
Function at 0x14003e0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x14003e29a
mov r9, rdx
mov edx, 1
test r9, r9
je 0x14003e10c
mov al, byte [rcx]
cmp al, 0x2d
je 0x14003e114
cmp al, 0x2b
jne 0x14003e125
add r9, 0xffffffffffffffff
je 0x14003e11a
add rcx, 1
jmp 0x14003e125
xor r10d, r10d
jmp 0x14003e282
cmp r9, 1
jne 0x14003e125
mov r10d, 0x100
jmp 0x14003e282
cmp r8d, 0x10
ja 0x14003e18d
cmp r9, 9
jae 0x14003e18d
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14003e1fb
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x14003e163
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x14003e25a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x14003e150
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x14003e150
mov edx, 0x101
jmp 0x14003e276
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14003e224
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x14003e1df
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x14003e25e
add eax, edi
jb 0x14003e271
add r10, 1
cmp r9, r10
jne 0x14003e1b0
jmp 0x14003e257
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x14003e183
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x14003e200
jmp 0x14003e25a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x14003e25e
test dl, dl
jne 0x14003e25e
add eax, edi
jb 0x14003e271
add r10, 1
cmp r9, r10
jne 0x14003e230
xor r10d, r10d
xor edx, edx
jmp 0x14003e282
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x14003e276
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x140043740]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.140049ad0
ud2
jmp 0x14003e0d0
Function at 0x1400427d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14004284a
mov r11, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [rdx + r8*2]
xor eax, eax
mov rbx, rdx
movzx edi, byte [rdx + 1]
add rdx, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140042840
cmp r10, rax
jb 0x1400428dd
cmp r10, r11
ja 0x1400428ea
add rax, r9
xor ebx, ebx
nop dword [rax + rax]
cmp rdi, rbx
je 0x140042842
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140042820
jmp 0x1400428b2
ja 0x14004284a
mov rax, r10
cmp rdx, r8
jne 0x1400427ed
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400428b6
mov rbx, qword [rsp + 0x78]
add rdx, rbx
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop
lea rsi, [rbx + 1]
movzx edi, byte [rbx]
test dil, dil
js 0x140042890
mov rbx, rsi
sub ecx, edi
jns 0x1400428a9
jmp 0x1400428b8
cmp rsi, rdx
je 0x1400428c3
and edi, 0x7f
shl edi, 8
movzx ebp, byte [rbx + 1]
add rbx, 2
or edi, ebp
sub ecx, edi
js 0x1400428b8
xor al, 1
cmp rbx, rdx
jne 0x140042870
jmp 0x1400428b8
xor eax, eax
jmp 0x1400428b8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__value:
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140049960
ud2
mov rcx, rax
mov rdx, r10
call fcn.140049bd0
ud2
mov rcx, r10
mov rdx, r11
call fcn.140049bc0
ud2
Function at 0x140042ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x14003e29a
mov r9, rdx
mov edx, 1
test r9, r9
je 0x14003e10c
mov al, byte [rcx]
cmp al, 0x2d
je 0x14003e114
cmp al, 0x2b
jne 0x14003e125
add r9, 0xffffffffffffffff
je 0x14003e11a
add rcx, 1
jmp 0x14003e125
xor r10d, r10d
jmp 0x14003e282
cmp r9, 1
jne 0x14003e125
mov r10d, 0x100
jmp 0x14003e282
cmp r8d, 0x10
ja 0x14003e18d
cmp r9, 9
jae 0x14003e18d
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14003e1fb
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x14003e163
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x14003e25a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x14003e150
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x14003e150
mov edx, 0x101
jmp 0x14003e276
xor r10d, r10d
cmp r8d, 0xa
jbe 0x14003e224
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x14003e1df
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x14003e25e
add eax, edi
jb 0x14003e271
add r10, 1
cmp r9, r10
jne 0x14003e1b0
jmp 0x14003e257
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x14003e183
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x14003e200
jmp 0x14003e25a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x14003e25e
test dl, dl
jne 0x14003e25e
add eax, edi
jb 0x14003e271
add r10, 1
cmp r9, r10
jne 0x14003e230
xor r10d, r10d
xor edx, edx
jmp 0x14003e282
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x14003e276
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x140043740]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.140049ad0
ud2
jmp 0x14003e0d0
Function at 0x140001cf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d44
xor al, al
add rsp, 0x28
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call fcn.14018a000
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400067b0
add rsp, 0x28
jmp 0x14000631c
Function at 0x140006e40
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov esi, r9d
mov rbp, rdx
mov rdi, rcx
call fcn.14000b988
cmp dword [rax + 0x10], 2
jne 0x140006e74
lea rcx, [0x14002e808]
call fcn.1400028b4
lea rcx, str.SeDebugPrivilege
call fcn.14001c34c
mov ebx, eax
call fcn.14000b988
cmp dword [rax + 0x10], 2
jne 0x140006ea6
cmp dword [rax + 4], 5
jne 0x140006e9d
cmp dword [rax + 8], 1
jae 0x140006e9f
cmp dword [rax + 4], 5
jbe 0x140006ea6
mov eax, 1
jmp 0x140006ea8
xor eax, eax
test ebx, ebx
mov r10d, 0x1f
je 0x140006f57
test eax, eax
jne 0x140006f57
lea rax, [0x14002e150]
mov rcx, r10
and dword [rsp + 0x40], 0
mov r9d, dword [rax]
mov dword [rsp + 0x44], InitCommonControls
xor r8d, r8d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], InitCommonControls
mov dword [rsp + 0x50], reloc.COMCTL32.dll_InitCommonControls
mov dword [rsp + 0x54], 0x12
mov dword [rsp + 0x58], 0x13
mov dword [rsp + 0x5c], 0x14
mov dword [rsp + 0x60], 0x15
mov dword [rsp + 0x64], 0x16
mov dword [rsp + 0x68], 0x17
mov dword [rsp + 0x6c], 0x1a
lea rdx, [rsp + 0x40]
cmp dword [rdx], r9d
je 0x140006f45
add r8d, 1
add rdx, 4
cmp r8d, 0xc
jb 0x140006f30
jmp 0x140006f49
and dword [rax + 0xc], 0
add rax, 0x30
sub rcx, 1
jne 0x140006ec8
and dword [rsp + 0x30], 0
lea r8, [0x14002e150]
mov r9d, r10d
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x28], esi
and dword [rsp + 0x20], 0
call fcn.14000fdfc
and qword [rdi + 0xa90], 0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140008370
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
mov rsi, rcx
xor edx, edx
mov rcx, rax
call fcn.14000b3ac
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14000840a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov ebx, eax
lea edx, [rbx + 0xa]
call fcn.14000cf94
mov rdx, qword [rsi]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsi]
mov byte [rbx + rcx], 0
mov rax, qword [rsi]
lea ecx, [rbx + 1]
mov byte [rcx + rax], 0
mov rax, qword [rsi]
lea ecx, [rbx + 2]
mov byte [rcx + rax], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x10], 0
lea rdx, [rsi + 0x18]
mov rcx, rsi
call fcn.140008570
mov eax, 1
jmp 0x14000840c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret