joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400336d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400493f0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x140033856
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x140033790
jmp 0x14003377f
jae 0x140033868
cmp r8, 0x201
jae 0x140033790
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x1400337e8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400337bf
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.14005a920
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140033817
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14003393b
mov r8d, esi
cmp r12, r8
jne 0x140033770
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140033965
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14003377f
jmp 0x140033790
lea rcx, [rbp - 0x58]
call fcn.14002d550
mov byte [rsi + 0x18], 2
jmp 0x1400338fa
cmp r15, r8
jb 0x14003397f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.140036a30
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x1400338b9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.14000e5f0
cmp byte [rbp + 0x3d8], 2
jne 0x140033911
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.14002d550
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x1400338fa
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.14000e5f0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x1400338e5
jmp 0x1400338fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x1400338a1
jmp 0x1400338b9
lea rcx, str.internal_error:_entered_unreachable_codeH
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005b470
jmp 0x140033994
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14005b960
ud2
Function at 0x140033d30
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140033d40
mov rcx, rdx
mov rdx, r8
jmp fcn.140033d50
mov rcx, rdx
mov rdx, r8
jmp fcn.14003e270

Function at 0x140039540
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, qword [rcx + 0x30]
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140039560
xor esi, esi
jmp 0x1400395cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x1400395c4
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140039585
cmp eax, 0x102
je 0x14003955c
jmp 0x14003959f
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14003955c
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.14002d550
shl rsi, 0x20
or rsi, 2
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14003a6b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.140058810
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140042000]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.140041ac0
cmp qword [rbp + 0xfe8], 0
jne 0x14003a887
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x14003a853
cmp r12, 0x1000
ja 0x14003a8a9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x14003a827
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14003a7d0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14003a82d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x14003a810
jbe 0x14003a780
jmp 0x14003a895
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x14003a735
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.14002d550
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.14002d550
jmp 0x14003a853
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14005b9e0
jmp 0x14003a8bd
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14005b960
ud2
Function at 0x14003e270
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400493f0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x14003e327
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140040910
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x14003e327
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14003e2fb
test rsi, rsi
je 0x14003e2f7
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14000e5f0
xor esi, esi
jmp 0x14003e327
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14003e324
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14000e5f0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003ee20
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x18]
call fcn.1400493f0
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
test rax, rax
je case.0x140037da7.119
fld dword [rax]
add byte [rax], al
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140040910
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
test rax, rax
Function at 0x14003f3a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140982280]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14003f3e4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14003f443
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14003f452
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14003f48a
cmp eax, 0x103
je 0x14003f494
test eax, eax
js 0x14003f46f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14003f48a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1409822e8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140036660
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14002db60
mov ecx, 7
int 0x29
ud2

Function at 0x14003f500
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140982280]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14003f544
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14003f5aa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14003f5e1
test eax, eax
js 0x14003f5bb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14003f5d4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1409822e8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140036660
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14002db60
mov ecx, 7
int 0x29
ud2
Function at 0x1400410c0
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x24], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 0x10], rax
nop

Function at 0x140041ac0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
sub esp, 0x78

Function at 0x1400424c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140042615
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400424f8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400425d8
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400425f7
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140042559
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x14004258b
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x14004258f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x140042593
cmp eax, 0x6d
jne 0x1400425be
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x140042598
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400425c4
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.14002d550
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400425ce
cmp rax, 1
je 0x140042542
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x14004254c
mov r8d, 0x10
mov rcx, rbx
call fcn.14005a9e0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140042505
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14005a9e0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140042505
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14005a8d0
ud2
Function at 0x140047370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400493f0
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x40]

Function at 0x1400482e0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140048318
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.140048330
nop
add rsp, 0x38
ret

Function at 0x140048330
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x140048373
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, case.0x140033dbb.114
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14005b3c0
ud2

Function at 0x1400489d0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14099d1c1]
mov ecx, 0x10
mov edx, 8
or byte [rax], al
add byte [rax], al
Function at 0x1400574a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14005751a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140057510
cmp r11, r10
ja 0x1400575b3
cmp r10, rdx
ja 0x1400575c7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140057512
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400574f0
jmp 0x140057587
ja 0x14005751a
mov r11, r10
cmp rax, r8
jne 0x1400574c2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14005758b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140057560
mov r8, r10
sub ecx, r9d
jns 0x14005757e
jmp 0x14005758d
cmp r10, rdx
je 0x140057599
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14005758d
xor al, 1
cmp r8, rdx
jne 0x140057540
jmp 0x14005758d
xor eax, eax
jmp 0x14005758d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140985679]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14005b470
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14005b9e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14005b960
ud2

Function at 0x140058d14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140058d5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140058d5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140058d5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140058d5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140058d5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140058d60
xor al, al
add rsp, 0x28
ret
Function at 0x14005a356
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14005a3b4
mov rdi, rax
lea rdx, [0x14097f526]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a3b4
mov rsi, rax
lea rdx, [0x14097f534]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a3b4
xor edi, edi
jmp 0x14005a436
lea rcx, [0x14097f4c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14005a48d
mov rsi, rax
lea rdx, [0x14097f4ca]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a48d
mov rbx, rax
lea rdx, [0x14097f4dd]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a48d
mov rdi, rax
lea rdx, [0x14097f4f1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a48d
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14005a48d
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rax
push 0x18
pop rcx
call fcn.140016349
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rcx], xmm0
xor eax, eax
lock cmpxchg qword [0x14099d1c8], rcx
je 0x14005a481
mov rsi, rax
mov qword [rbp - 0x18], rcx
call fcn.14002b233
lea rcx, [rbp - 0x18]
call fcn.140003627
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_null.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
lea r8, [0x14097f620]
push 0x5b
pop rdx
call fcn.14005a338
ud2
Function at 0x416a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00611770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416ae5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416af4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416b13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416b23
cmp rbx, 0x1000
jae 0x416aeb
jmp 0x416b8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416b35
xor edx, edx
jmp 0x416b84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00611770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416b19
jmp 0x416b08
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00611770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004d3823]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004d3cd9]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d62e5]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS