joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bc30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400ebbd0
test rax, rax
je 0x14000bc91
mov rbx, rax
mov r14, rdx
mov rcx, rax
call qword [rdx]
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14000bd11
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call fcn.14000f6f0
jmp 0x14000bd11
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0xb8], xmm1
movups xmmword [rsp + 0xa8], xmm0
lea r8, [0x14014ea50]
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xa8]
mov r9d, 8
call fcn.1400eb9b0
mov rax, qword [rsp + 0x70]
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x60], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400e94c0
Function at 0x14000bfa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000bfe2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000bfea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000bffb
jmp 0x14000c012
xor r10d, r10d
jmp 0x14000c09d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000c012
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000c029
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000c049
add r11, r8
jmp 0x14000c17b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000c112
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000c0c0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000c130
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000c142
jmp 0x14000c15d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000c15d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000c177
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006b2c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
cmp rax, qword [rdx + 0x20]
jne 0x14006b2f2
test rax, rax
je 0x14006b2f9
lea r8, [rax - 0x21]
cmp r8, 0xffffffffffffffe0
jb 0x14006b403
cmp rax, 8
jae 0x14006b300
xor r9d, r9d
xor r8d, r8d
jmp 0x14006b3e0
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp rax, 0x10
jae 0x14006b36c
xor r9d, r9d
xor r8d, r8d
mov r10, r8
mov r8d, eax
and r8d, 0x38
movzx r9d, r9b
movd xmm0, r9d
nop
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp r8, r10
jne 0x14006b320
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, r8
jne 0x14006b3e0
jmp 0x14006b3f8
mov r8d, eax
and r8d, 0x30
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
cmp r8, 0x10
je 0x14006b397
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x10]
pxor xmm2, xmm1
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r9d, xmm0
cmp rax, r8
je 0x14006b3f8
test al, 8
jne 0x14006b30c
nop word cs:[rax + rax]
movzx r10d, byte [rdx + r8]
xor r10b, byte [rcx + r8]
lea r11, [r8 + 1]
or r9b, r10b
mov r8, r11
cmp rax, r11
jne 0x14006b3e0
test r9b, r9b
sete al
add rsp, 0x28
ret
lea r8, [0x140178410]
mov ecx, 0x20
mov edx, 0x20
call fcn.14014b020
int3
Function at 0x1400a32e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x1400a33c0
mov rsi, r8
test r8, r8
je 0x1400a33eb
mov rdi, rdx
mov r14, rsi
shl r14, 6
cmp rsi, 4
jae 0x1400a3323
xor eax, eax
jmp 0x1400a3360
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x1400a3330
cmp rax, rsi
je 0x1400a3377
nop dword [rax]
mov rdx, qword [rbx + rax*8]
not rdx
mov qword [rdi + rax*8], rdx
lea rdx, [rax + 1]
mov rax, rdx
cmp rsi, rdx
jne 0x1400a3360
or byte [rdi], 1
sub r14, qword [rcx + 0x20]
je 0x1400a33b6
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.14012b530
dec r14
jne 0x1400a33a0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x38], 0
lea rax, [0x140183248]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x38]
xor ecx, ecx
call fcn.140148ca0
lea r8, [0x140182a80]
xor ecx, ecx
xor edx, edx
call fcn.14014b020
int3
Function at 0x1400a55a0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, r9
mov rsi, rcx
mov rdi, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x298]
mov r15, qword [rsp + 0x290]
movzx eax, byte [0x140214be4]
cmp al, 2
jne 0x1400a5733
lea rax, [0x140182580]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [0x1401825b0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x1401825c0]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1401825d0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x1401825e0]
movups xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea r12, [rsp + 0x28]
mov rcx, r12
call fcn.14009dd70
mov rcx, r12
mov rdx, r14
mov r8, r15
call fcn.14009dd70
mov rcx, r12
mov rdx, rbx
mov r8, rdi
call fcn.14009dd70
lea rcx, [rsp + 0x158]
mov r8d, 0xd8
mov rdx, r12
call fcn.140145bd0
mov rax, qword [rsp + 0x158]
mov r9, qword [rax + 0x20]
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmm3, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x130], xmm3
movaps xmmword [rsp + 0x120], xmm2
movaps xmmword [rsp + 0x110], xmm1
movaps xmmword [rsp + 0x100], xmm0
cmp r9, 0x81
jae 0x1400a5750
lea r8, [rsp + 0x1a8]
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.14009dab0
mov rax, rsi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140214be4]
mov r12, r8
mov r13, rdx
call fcn.140148c10
mov rdx, r13
mov r8, r12
jmp 0x1400a55df
lea r8, [0x140182380]
mov edx, 0x80
mov rcx, r9
call fcn.14014b3e0
int3
Function at 0x1400a8700
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r8, 0xd
jne 0x1400a87ae
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12d, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
cmp r8, 0x10
jb 0x1400a8859
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
lea rcx, [rcx + 0x10]
sub r8, 0x10
jmp 0x1400a87ae
cmp r8, 0
je 0x1400a891f
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r8
shld r14, r13, 8
shl r13, 8
movzx r15, byte [rcx - 1]
xor r13, r15
dec rcx
dec r8
jne 0x1400a886f
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
Function at 0x1400b2ce0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r8, qword [rcx + 8]
mov al, 1
test r8, r8
je 0x1400b2dee
mov rcx, qword [rcx]
movzx r9d, byte [rcx]
mov r10, qword [rdx]
movzx r10d, byte [r10]
not r10b
test r9b, r10b
jne 0x1400b2dee
mov r10, qword [rdx + 0x10]
test r10, r10
je 0x1400b2df8
mov rdx, qword [rdx + 8]
xor byte [rdx], r9b
mov r11d, 1
cmp r10, 1
je 0x1400b2de8
lea rbx, [r8 - 1]
lea rdi, [r10 - 2]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [rdx + 1]
inc rsi
cmp rsi, 0x10
jbe 0x1400b2dbe
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x1400b2d79
add rdi, rdx
add rdi, 2
lea rbx, [rcx + 1]
cmp rbx, rdi
jb 0x1400b2dbe
mov r11d, esi
and r11d, 0xf
mov r14d, 0x10
cmovne r14, r11
mov rdi, rsi
sub rdi, r14
lea rbx, [r9 + rdi]
neg r14
lea r11, [rsi + r14]
inc r11
xor esi, esi
movups xmm0, xmmword [rcx + rsi + 1]
movups xmm1, xmmword [r9 + rsi]
xorps xmm1, xmm0
movups xmmword [r9 + rsi], xmm1
add rsi, 0x10
cmp rdi, rsi
jne 0x1400b2da0
mov r9, rbx
add rdx, r10
nop word cs:[rax + rax]
cmp r8, r11
je 0x1400b2dee
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, rdx
jne 0x1400b2dd0
cmp r11, r8
setne al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.7_src_rsapaddingpss.rs
xor ecx, ecx
xor edx, edx
call fcn.14014b020
int3
Function at 0x1400c8950
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rcx
test r8, r8
je 0x1400c8a67
js 0x1400c8a8b
mov rbx, rdx
movzx eax, byte [0x140214be1]
mov edx, 1
mov rcx, rsi
call fcn.14000f6e0
test rax, rax
je 0x1400c8a90
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbx]
xor r9d, r9d
movabs r10, 0xa0761d6478bd642f
movabs r11, 0xe7037ed1a0b428db
mov r14d, 0x3e
movabs r15, 0x40ec3ac8f17ac85e
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov rbp, rsi
jmp 0x1400c89f7
mov rbx, r13
dec rbp
movzx eax, byte [rdx + r12]
mov byte [rcx + r9], al
inc r9
test rbp, rbp
je 0x1400c8a5d
lea r13, [rbx + r10]
mov rax, r13
xor rax, r11
mul r13
mov r8, rdx
xor r8, rax
mov rax, r8
mul r14
lea rax, [r8 + r8]
shl r8, 6
sub r8, rax
cmp r8, 0xf
ja 0x1400c89e0
add rbx, r15
nop word cs:[rax + rax]
add r13, r10
mov rax, rbx
xor rax, r11
mul rbx
xor rdx, rax
mov r8, rdx
shl r8, 6
sub r8, rdx
sub r8, rdx
add rbx, r10
cmp r8, 0x10
jb 0x1400c8a30
mov rax, rdx
mul r14
jmp 0x1400c89e0
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
jmp 0x1400c8a6c
mov ecx, 1
mov qword [rdi], rsi
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140117470
mov ecx, 1
mov rdx, rsi
call fcn.14014ad70
int3
Function at 0x1400f83a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x400], 2
mov qword [rbp + 0x408], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400f8440
jmp 0x1400f842f
jae 0x1400f84ff
cmp r8, 0x201
jae 0x1400f8440
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1400f8497
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400f846f
lea rcx, [rbp + 0x3f8]
mov rdx, rbx
call fcn.140149d70
mov rsi, qword [rbp + 0x3f8]
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x408], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3e8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400f84c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400f8579
mov r8d, r13d
cmp r12, r8
jne 0x1400f8420
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400f85ad
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400f842f
jmp 0x1400f8440
cmp r14, r8
jb 0x1400f85c7
lea rcx, [rbp + 0x3c8]
mov rdx, r15
call fcn.1400fd3b0
movups xmm0, xmmword [rbp + 0x3c8]
movups xmm1, xmmword [rbp + 0x3d8]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmmword [rbp + 0x3a0], xmm0
mov rsi, qword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
je 0x1400f8562
mov rcx, qword [rbp + 0x400]
add rdx, rdx
mov r8d, 2
call fcn.14000f6f0
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3f0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
jne 0x1400f854d
jmp 0x1400f8562
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14014af80
jmp 0x1400f85dc
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14014b3e0
ud2
Function at 0x140104a00
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14010d280
mov rax, qword [rsp + 0x38]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x140104a34
mov rax, qword [rsp + 0x40]
jmp 0x140104ac4
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov r8b, 1
call fcn.14010e830
mov rsi, qword [rsp + 0x20]
cmp rsi, rdi
jne 0x140104a66
mov rax, qword [rsp + 0x28]
jmp 0x140104ac4
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140104a97
test rsi, rsi
je 0x140104a93
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14000f6f0
xor eax, eax
jmp 0x140104ac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rsi, rsi
je 0x140104ac4
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
mov rsi, rax
call fcn.14000f6f0
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140104ec0
Capabilities:
Copy file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x48]
call fcn.14010d280
mov rax, qword [rbp - 0x48]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x140104f03
mov rax, qword [rbp - 0x40]
jmp 0x140104f2c
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.14010e830
mov rax, qword [rbp - 0x30]
cmp rax, rbx
jne 0x140104f46
mov rax, qword [rbp - 0x28]
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov qword [rbp], rax
mov r8, qword [rbp + 0x60]
mov rax, qword [rbp - 0x28]
mov qword [rbp + 8], rax
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.14010d280
mov rax, qword [rbp - 0x48]
cmp rax, rbx
jne 0x140104f71
mov rax, qword [rbp - 0x40]
jmp 0x140104f9a
movups xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.14010e830
mov rdi, qword [rbp - 0x30]
cmp rdi, rbx
jne 0x140104fc5
mov rax, qword [rbp - 0x28]
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0
mov dword [rsp + 0x28], 0
Function at 0x1401459e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140145a08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140145a08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14014a120
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401174c0
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14014a1ba
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14014a1ed
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x14014a211
jmp 0x14014a222
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x14014a222
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14000f6f0
mov rax, qword [r14]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], ax
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x14014a222
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14000f6f0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x417a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417bcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004365a0
xorps xmm15, xmm15
mov r14, qword [0x006e7570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417aa5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417ab4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417ad3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417ae3
cmp rbx, 0x1000
jae 0x417aab
jmp 0x417b4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417af5
xor edx, edx
jmp 0x417b44
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004365a0
xorps xmm15, xmm15
mov r14, qword [0x006e7570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417ad9
jmp 0x417ac8
call fcn.0046cbc0
xorps xmm15, xmm15
mov r14, qword [0x006e7570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043aa80
lea rax, [0x0055af5f]
mov ebx, 0x18
nop dword [rax]
call fcn.0043b300
mov rax, qword [rsp + 0x38]
call fcn.0043b040
lea rax, [0x0055b4e9]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b300
mov rax, qword [rsp + 0x30]
call fcn.0043b040
call fcn.0043acc0
call fcn.0043aae0
lea rax, [0x0055dda5]
mov ebx, 0x21
call fcn.00438fe0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417a40