joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403760e2
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
cmp spl, 0x16
sbb bl, spl
sub rsp, 0x40
movzx edi, di
mov rax, qword [0x140049010]
xor rax, rsp
movzx bx, r14b
mov qword [rsp + 0x30], rax
xadd bh, bh
cmc
mov rbx, qword [0x140049928]
btr di, bx
mov edi, ecx
jmp 0x140376120
cmp byte [rbx + 0x41cd], 0
jne 0x140376182
cmp byte [rbx + 0x41ce], 0
jmp 0x140376139
jne 0x140376182
movsx r9d, word [rbx + 0x52ae]
movzx dx, cl
cwd
lea r8, str.Tooltip__02d
movzx edx, r11w
mov edx, 0x10
mov rcx, 0x36b301d9
lea rcx, [rsp + 0x20]
call fcn.140002ab0
test dil, 1
jmp 0x140376177
je 0x140376363
jmp 0x14037624a
movss xmm1, dword [rbx + 0x3830]
not r9d
btc r9, rsi
lea r8, str.Tooltip__02d
mov cx, 0x4cec
and ch, 0xe5
movsx r9d, word [rbx + 0x52ae]
movzx rcx, cx
lea rcx, [rsp + 0x20]
jmp 0x1403761b5
movaps xmm0, xmm1
sub eax, eax
jmp 0x1403761bf
mulss xmm0, dword [0x1400424a4]
mulss xmm1, dword [0x140042498]
lea edx, [rax + 0x10]
jmp 0x1403761d7
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f48], rax
jmp 0x1403761f3
mov dword [rbx + 0x3f34], 1
jmp 0x140376202
movss dword [rbx + 0x3f40], xmm0
jmp 0x14037620f
movss dword [rbx + 0x3f44], xmm1
movss xmm0, dword [rbx + 0x388c]
jmp 0x140376224
mulss xmm0, dword [0x1400423dc]
or dword [rbx + 0x3f30], 0x41
jmp 0x140376238
movss dword [rbx + 0x3f90], xmm0
jmp 0x140376245
call fcn.140002ab0
movzx r9d, byte [rsp + 0x20]
bt r8w, ax
neg r8b
lea r8, [rsp + 0x21]
ror r10, cl
bt ecx, esi
mov r10d, 0xffffffff
mov ecx, r10d
cmp r8w, 0xc9
test r9b, r9b
jmp 0x14037627a
je 0x1403762e9
lea r11, [0x14003cbe0]
nop word [rax + rax]
cmp di, 0x1815
cmp r9b, 0x23
jmp 0x14037629b
jne 0x1403762be
cmp byte [r8], r9b
jmp 0x1403762a9
jne 0x1403762be
cmp byte [r8 + 1], r9b
cmove ecx, r10d
adc ax, 0x6b94
rcr dh, 0xee
movzx edx, cl
sar ax, cl
movzx eax, r9b
movzx r9d, byte [r8]
clc
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
cmc
test r9b, r9b
jmp 0x1403762e3
jne 0x140376292
not ecx
jmp 0x1403762f0
call fcn.140131f75
test rax, rax
jmp 0x1403762fd
je 0x140376363
cmp byte [rax + 0x8e], 0
jmp 0x14037630f
je 0x140376363
mov byte [rax + 0x95], 1
cmovbe edx, esp
bswap dx
lea r8, str.Tooltip__02d
dec dl
movzx edx, di
mov byte [rax + 0xb0], 1
mov r9b, sil
cmovns dx, ax
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52ae]
cdq
movsx edx, sp
mov edx, 0x10
movsx r9d, word [rbx + 0x52ae]
jmp 0x14037635e
call fcn.140002ab0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8w, r11w
bswap r8
movsxd r8, r10d
mov r8d, 0x20c0347
jmp 0x14037637f
call fcn.14036f680
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
jmp 0x140376391
call fcn.140039a40
mov rbx, qword [rsp + 0x50]
bswap rdi
cmp rsi, r13
add rsp, 0x40
movsxd rdi, r15d
bswap di
pop rdi
jmp 0x1403763b1
ret
Function at 0x14037de86
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bswap dx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
cdq
push rdi
cmp rcx, r8
dec dil
push r14
test di, r13w
and esi, 0x3ed9287b
rcl dil, 0x82
push r15
cmc
sub rsp, 0x20
movzx edi, r12w
mov rdi, qword [0x140049928]
jmp 0x14037decb
lea rdx, [0x14003c940]
movsx esi, r10w
mov rsi, rcx
jmp 0x14037dede
call 0x140187b4d
test rax, rax
mov rbx, 0xffffffffffffffff
jmp 0x14037def3
cmovne rsi, rax
jmp 0x14037defc
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jmp 0x14037df0b
jne 0x14037deff
add rdi, 0x5320
add ebp, esi
dec r14b
adc ebp, edi
lea r14d, [rbx + 0x18]
movsx rcx, r14w
and r14d, 0xfffffffc
add rbp, 0x10394337
btr rcx, rsi
movsxd r15, dword [rdi]
shr cx, cl
movzx ecx, r15w
mov ecx, dword [rdi + 4]
and bpl, sil
lea ebp, [r14 + r15]
test ecx, 0x3ead6dd8
cmp ebp, ecx
jmp 0x14037df57
jle 0x14037dfb3
test ecx, ecx
jmp 0x14037df64
je 0x14037df8b
mov eax, ecx
add dx, 0x35c3
cdq
sub eax, edx
cmp rdx, rsp
sar eax, 1
test r15w, 0x1acf
add eax, ecx
jmp 0x14037df86
jmp 0x14037df98
mov eax, 8
not cx
cmova cx, r11w
cmp eax, ebp
mov edx, ebp
bswap cx
jmp 0x14037dfa8
mov rcx, rdi
cmovg edx, eax
call fcn.140017440
mov dword [rdi], ebp
rcl ah, 0x5d
btc rax, 0x69
mov rax, qword [rdi + 8]
jmp 0x14037dfc6
mov dword [r15 + rax], r14d
cmp rax, r12
mov rdi, qword [rdi + 8]
cmp r14w, 0x76e5
add rdi, 4
cmp sil, 0x47
add rdi, r15
jmp 0x14037dfe7
mov qword [rsp + 0x48], rdi
je 0x14037dffb
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
cdq
add ch, dh
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
jmp 0x14037e009
call fcn.140002b30
lea r8, [rbx + 1]
cdq
movzx rcx, r15w
cwd
mov dword [rdi], eax
jmp 0x14037e020
lea rcx, [rdi + 0x10]
mov rdx, rsi
call 0x140164fed
mov rbx, qword [rsp + 0x40]
xchg r14b, r15b
sets r15b
mov rax, rdi
cmp bh, 0xe2
rol r15w, 0x89
stc
mov rbp, qword [rsp + 0x50]
xor edi, esi
btr r15, r15
adc di, 0x4fd2
mov rsi, qword [rsp + 0x58]
movzx r14w, cl
adc r14, 0x58e64cc0
add rsp, 0x20
xchg r14w, r14w
cmovne r15w, dx
pop r15
mov dil, al
pop r14
pop rdi
jmp 0x14037e07f
ret
Function at 0x140386e1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
sal r8b, 0x10
bts rax, r11
movzx r9w, dl
mov rax, qword [0x140049928]
rol r9, 0x5f
mov r9, qword [rax + 0x3e28]
bsf r8w, r13w
mov r8, qword [r9 + 0x180]
stc
test r8b, spl
cmp dword [r8 + 0x10], 1
jmp 0x140386e5c
je 0x140386f92
movups xmm0, xmmword [r9 + 0x210]
cwd
bts ax, r8w
movups xmmword [r8 + 0x3c], xmm0
bsr ecx, edi
mov rax, qword [r9 + 0x270]
mov dl, dh
bsr dx, bp
stc
movups xmm0, xmmword [r8 + 0x2c]
bts rdx, r11
sub cl, r8b
sal dl, cl
movss xmm4, dword [r8 + 0x2c]
and cl, sil
sub dh, 0x39
movss xmm3, dword [r8 + 0x30]
movss xmm2, dword [r8 + 0x34]
movss xmm1, dword [r8 + 0x38]
shld cx, r10w, 0x75
movups xmmword [r9 + 0x210], xmm0
bsf cx, sp
inc dx
adc ch, 0xfc
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
setle ch
movss dword [rsp + 0x28], xmm2
sal edx, cl
cmovp cx, sp
movss dword [rsp + 0x2c], xmm1
test bpl, al
cmove dx, di
movss dword [rax + 0x88], xmm4
ror ecx, 0x93
bsr cx, bx
cmp r12, rsp
movss dword [rax + 0x8c], xmm3
dec dx
movss dword [rax + 0x90], xmm2
shr rcx, cl
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x270]
movsx rcx, r9w
sub edx, edi
movups xmm0, xmmword [rsp + 0x20]
xadd ecx, ecx
mov ch, 0xb
neg dh
movsxd rdx, dword [rax + 0x58]
cmp dil, sil
movzx ecx, r10w
setp ch
mov rcx, qword [rax + 0x60]
add rdx, rdx
test r14b, r8b
movups xmmword [rcx + rdx*8 - 0x10], xmm0
neg cx
mov rdx, qword [r9 + 0x270]
movzx ecx, si
movsx cx, r12b
btc cx, 0x29
lea rcx, [r8 + 0x70]
cmc
test rsi, 0x1a5145c
xor r8d, r8d
test r13b, 0x4d
add rsp, 0x38
jmp 0x140386f8d
jmp fcn.140022d40
add rsp, 0x38
jmp 0x140386f9b
ret
Function at 0x140386f9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
ror r9b, 0x5e
cwde
xchg r10b, r9b
mov rax, qword [0x140049928]
mov r10, qword [rax + 0x3e28]
mov r9, qword [r10 + 0x180]
cmp r10w, 0xe41
cmp dword [r9 + 0x10], 1
jmp 0x140386fcd
je 0x1403870fa
movups xmm0, xmmword [r9 + 0x3c]
rdtsc
mov rax, qword [r10 + 0x270]
or r8b, dil
and rcx, 0x27ed3ef7
movss xmm4, dword [r9 + 0x3c]
bsf cx, dx
movss xmm3, dword [r9 + 0x40]
bsr ecx, ecx
sar ecx, cl
rcr cl, 0x82
movss xmm2, dword [r9 + 0x44]
xor rdx, r15
bswap r8w
movss xmm1, dword [r9 + 0x48]
xchg r8, rcx
movups xmmword [r10 + 0x210], xmm0
sal r8d, cl
bsr r8, rax
and dx, bx
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
inc cl
sar r8b, cl
movsx rcx, bp
movss dword [rsp + 0x28], xmm2
shl r8w, cl
rol ch, cl
movss dword [rsp + 0x2c], xmm1
bts cx, ax
movss dword [rax + 0x88], xmm4
bsf dx, r14w
sbb cx, si
bt rcx, r13
movss dword [rax + 0x8c], xmm3
shld r8w, r15w, 0x65
or cx, sp
cmovae r8, rcx
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x270]
rol r8b, cl
movzx r8d, di
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movsxd r8, esi
movzx r8d, ax
movups xmmword [rcx + rdx*8 - 0x10], xmm0
cmovae dx, r12w
movzx rdx, cx
mov r8d, dword [r9 + 0xc]
not rdx
movsx ecx, r11w
lea rcx, [r9 + 0x70]
movzx dx, r15b
setp dh
movsxd rdx, edx
mov rdx, qword [r10 + 0x270]
jmp 0x1403870e8
inc r8d
clc
add rsp, 0x38
jmp 0x1403870f5
jmp fcn.140022d40
add rsp, 0x38
jmp 0x140387103
ret
Function at 0x1400110d7
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x1400161f0
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x148]
lea rcx, [0x14002d175]
call fcn.140011717
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x28], rax
movzx eax, word [rbp + 0x120]
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x128]
mov word [rbp + 6], ax
mov edx, dword [rbp + 4]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [rbp - 0x20]
lea rdx, [0x1400223c0]
call fcn.1400115e6
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011406
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a680
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001150f
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001bdc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001bde0
xor al, al
jmp 0x14001be61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001bdf3
xor al, al
jmp 0x14001be61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001be1d
xor al, al
jmp 0x14001be61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001be31
xor al, al
jmp 0x14001be61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001be43
xor al, al
jmp 0x14001be61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001be5f
xor al, al
jmp 0x14001be61
mov al, 1
add rsp, 0x38
ret
Function at 0x140008720
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x1400087a2
jmp 0x1400087f0
mov rsi, r8
jae 0x14000884d
cmp rsi, 0x201
jb 0x1400087f0
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x1400087cd
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.14005a2e0
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x1400087fd
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x140008820
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008895
mov r8d, edi
cmp rsi, r8
jne 0x140008790
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400088ec
add rsi, rsi
cmp rsi, 0x201
jae 0x1400087a2
jmp 0x1400087f0
cmp r14, r8
jb 0x140008906
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000a180
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x1400088c2
jmp 0x1400088d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x1400088d5
add rdx, rdx
je 0x1400088d5
mov r8d, 2
mov rcx, r13
call fcn.140052240
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len_pQ
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005ab60
jmp 0x14000891b
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14005ad90
ud2
Function at 0x1400149c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x140014b8a
mov r9, rdx
mov edx, 1
test r9, r9
je 0x1400149fc
mov al, byte [rcx]
cmp al, 0x2d
je 0x140014a04
cmp al, 0x2b
jne 0x140014a15
add r9, 0xffffffffffffffff
je 0x140014a0a
add rcx, 1
jmp 0x140014a15
xor r10d, r10d
jmp 0x140014b72
cmp r9, 1
jne 0x140014a15
mov r10d, 0x100
jmp 0x140014b72
cmp r8d, 0x10
ja 0x140014a7d
cmp r9, 9
jae 0x140014a7d
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140014aeb
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x140014a53
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x140014b4a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x140014a40
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x140014a40
mov edx, 0x101
jmp 0x140014b66
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140014b14
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x140014acf
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x140014b4e
add eax, edi
jb 0x140014b61
add r10, 1
cmp r9, r10
jne 0x140014aa0
jmp 0x140014b47
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x140014a73
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x140014af0
jmp 0x140014b4a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x140014b4e
test dl, dl
jne 0x140014b4e
add eax, edi
jb 0x140014b61
add r10, 1
cmp r9, r10
jne 0x140014b20
xor r10d, r10d
xor edx, edx
jmp 0x140014b72
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x140014b66
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x14001b820]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.14005ac30
ud2
jmp 0x1400149c0
Function at 0x140019ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140019f1a
mov r11, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [rdx + r8*2]
xor eax, eax
mov rbx, rdx
movzx edi, byte [rdx + 1]
add rdx, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140019f10
cmp r10, rax
jb 0x140019fad
cmp r10, r11
ja 0x140019fba
add rax, r9
xor ebx, ebx
nop dword [rax + rax]
cmp rdi, rbx
je 0x140019f12
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140019ef0
jmp 0x140019f82
ja 0x140019f1a
mov rax, r10
cmp rdx, r8
jne 0x140019ebd
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140019f86
mov rbx, qword [rsp + 0x78]
add rdx, rbx
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop
lea rsi, [rbx + 1]
movzx edi, byte [rbx]
test dil, dil
js 0x140019f60
mov rbx, rsi
sub ecx, edi
jns 0x140019f79
jmp 0x140019f88
cmp rsi, rdx
je 0x140019f93
and edi, 0x7f
shl edi, 8
movzx ebp, byte [rbx + 1]
add rbx, 2
or edi, ebp
sub ecx, edi
js 0x140019f88
xor al, 1
cmp rbx, rdx
jne 0x140019f40
jmp 0x140019f88
xor eax, eax
jmp 0x140019f88
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__value:
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14005ab60
ud2
mov rcx, rax
mov rdx, r10
call fcn.14005ada0
ud2
mov rcx, r10
mov rdx, r11
call fcn.14005ad90
ud2
Function at 0x14001a9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov dword [rsp + 0x2c], r8d
lea eax, [r8 - 2]
cmp eax, 0x22
ja 0x140014b8a
mov r9, rdx
mov edx, 1
test r9, r9
je 0x1400149fc
mov al, byte [rcx]
cmp al, 0x2d
je 0x140014a04
cmp al, 0x2b
jne 0x140014a15
add r9, 0xffffffffffffffff
je 0x140014a0a
add rcx, 1
jmp 0x140014a15
xor r10d, r10d
jmp 0x140014b72
cmp r9, 1
jne 0x140014a15
mov r10d, 0x100
jmp 0x140014b72
cmp r8d, 0x10
ja 0x140014a7d
cmp r9, 9
jae 0x140014a7d
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140014aeb
mov r11d, 0xffffffff
xor edx, edx
xor eax, eax
jmp 0x140014a53
imul eax, r8d
add eax, edi
add rdx, 1
cmp r9, rdx
je 0x140014b4a
movzx esi, byte [rcx + rdx]
lea edi, [rsi - 0x30]
cmp edi, 9
jbe 0x140014a40
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
mov edi, esi
cmp esi, r8d
jb 0x140014a40
mov edx, 0x101
jmp 0x140014b66
xor r10d, r10d
cmp r8d, 0xa
jbe 0x140014b14
mov r11d, 0xffffffff
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, byte [rcx + r10]
mul r8d
seto dl
lea edi, [rsi - 0x30]
mov ebx, 1
cmp edi, 0xa
jb 0x140014acf
or esi, 0x20
add esi, 0xffffff9f
add esi, 0xa
cmovb esi, r11d
xor ebx, ebx
cmp esi, r8d
setb bl
mov edi, esi
test ebx, ebx
sete bl
or dl, bl
jne 0x140014b4e
add eax, edi
jb 0x140014b61
add r10, 1
cmp r9, r10
jne 0x140014aa0
jmp 0x140014b47
xor edx, edx
xor eax, eax
nop
movzx ebx, byte [rcx + rdx]
lea edi, [rbx - 0x30]
cmp edi, r8d
jae 0x140014a73
imul eax, r8d
add eax, ebx
add eax, 0xffffffd0
add rdx, 1
cmp r9, rdx
jne 0x140014af0
jmp 0x140014b4a
xor eax, eax
nop word cs:[rax + rax]
movzx edi, byte [rcx + r10]
mul r8d
seto dl
add edi, 0xffffffd0
cmp edi, r8d
setae bl
jae 0x140014b4e
test dl, dl
jne 0x140014b4e
add eax, edi
jb 0x140014b61
add r10, 1
cmp r9, r10
jne 0x140014b20
xor r10d, r10d
xor edx, edx
jmp 0x140014b72
xor bl, 1
movzx edx, bl
shl rdx, 8
add rdx, 0x101
jmp 0x140014b66
mov edx, 0x201
mov r10d, edx
and r10d, 0x300
xor eax, eax
shl rax, 0x20
or rax, r10
movzx ecx, dl
or rcx, rax
mov rax, rcx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [0x14001b820]
mov qword [rsp + 0x38], rax
lea rax, str.from_str_radix_int:_must_lie_in_the_range___2__36_____found
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.librarycore_src_nummod.rs
lea rcx, [rsp + 0x40]
call fcn.14005ac30
ud2
jmp 0x1400149c0
Function at 0x14001d610
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x140019105
cmp rdx, 4
jae 0x140019108
xor eax, eax
mov r8, rcx
jmp 0x140019264
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
lea rax, [r8 - 4]
mov r9, rax
shr r9, 2
add r9, 1
test rax, rax
je 0x140019289
mov r10, r9
and r10, 0xfffffffffffffffe
pxor xmm0, xmm0
xor r11d, r11d
movdqa xmm2, xmmword [0x140067080]
movdqa xmm3, xmmword [0x140065140]
pxor xmm1, xmm1
nop dword [rax]
movzx eax, word [rcx + r11]
movd xmm4, eax
movzx eax, word [rcx + r11 + 2]
movd xmm5, eax
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm4, xmm0
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm0, xmm5, 0xd4
pshufd xmm5, xmm0, 0xd4
pand xmm5, xmm3
paddq xmm5, xmm1
movzx eax, word [rcx + r11 + 4]
movd xmm0, eax
movzx eax, word [rcx + r11 + 6]
movd xmm1, eax
pcmpgtb xmm0, xmm2
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0xd4
pshufd xmm0, xmm0, 0xd4
pand xmm0, xmm3
paddq xmm0, xmm4
pcmpgtb xmm1, xmm2
punpcklbw xmm1, xmm1
pshuflw xmm1, xmm1, 0xd4
pshufd xmm1, xmm1, 0xd4
pand xmm1, xmm3
paddq xmm1, xmm5
add r11, 8
add r10, 0xfffffffffffffffe
jne 0x140019150
test r9b, 1
je 0x14001924a
movzx eax, word [rcx + r11]
movd xmm2, eax
movzx eax, word [rcx + r11 + 2]
movd xmm3, eax
movdqa xmm4, xmmword [0x140067080]
pcmpgtb xmm2, xmm4
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0xd4
pshufd xmm2, xmm2, 0xd4
movdqa xmm5, xmmword [0x140065140]
pand xmm2, xmm5
paddq xmm0, xmm2
pcmpgtb xmm3, xmm4
punpcklbw xmm3, xmm3
pshuflw xmm2, xmm3, 0xd4
pshufd xmm2, xmm2, 0xd4
pand xmm2, xmm5
paddq xmm1, xmm2
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rax, xmm1
cmp r8, rdx
je 0x140019288
add r8, rcx
add rcx, rdx
nop word [rax + rax]
xor edx, edx
cmp byte [r8], 0xc0
lea r9, [r8 + 1]
setge dl
add rax, rdx
mov r8, r9
cmp r9, rcx
jne 0x140019270
ret
pxor xmm0, xmm0
xor r11d, r11d
pxor xmm1, xmm1
test r9b, 1
jne 0x1400191f3
jmp 0x14001924a
sub rdx, rcx
cmp rdx, 0x20
jae 0x14001d61e
jmp 0x1400190f0
jmp fcn.140018830
Function at 0x140023f30
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140024021
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a93b0], rax
test rax, rax
je 0x140024021
lea rcx, str.PROPSYS.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140024021
lea rdx, str.PropVariantToString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a93b8], rax
test rax, rax
je 0x140024021
lea rcx, str.COMBASE.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140024021
mov rsi, rax
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a93c0], rax
test rax, rax
je 0x140024021
lea rdx, str.WindowsCreateStringReference
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a93c8], rax
test rax, rax
je 0x140024021
lea rdx, str.WindowsGetStringRawBuffer
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a9420], rax
test rax, rax
je 0x140024021
lea rdx, str.WindowsDeleteString
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a93d0], rax
add rsp, 0x20
pop rsi
ret