joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b900
Capabilities:
Parse url

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
mov qword [rbp + 0xc8], r9
mov rcx, qword [rbp + 0xb0]
call fcn.0040abd0
nop
lea rcx, [rbp + 0x38]
mov edx, 0x68
xor r8, r8
call fcn.00406e20
mov rcx, rbp
call fcn.0050b730
nop
mov dword [rbp + 0x38], 0x68
mov rcx, qword [rbp + 0xb0]
call fcn.0040c470
mov rcx, rax
xor rdx, rdx
xor r8, r8
lea r9, [rbp + 0x38]
call sub.wininet.dll_InternetCrackUrlW
test eax, eax
setne al
mov byte [rbp + 0x37], al
mov rcx, qword [rbp + 0xb8]
mov rdx, qword [rbp + 0x50]
call fcn.0040c4f0
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x80]
call fcn.0040c4f0
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0x90]
call fcn.0040c4f0
nop
mov rcx, rbp
call fcn.0050b860
nop
lea rcx, [rbp + 0xb0]
call fcn.0040aa40
movzx rax, byte [rbp + 0x37]
lea rsp, [rbp + 0xa0]
pop rbp
ret

Function at 0x50e5e0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov edx, 0x58
xor r8, r8
call fcn.00406e20
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x140003c10
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 8], 0
lea r9, [rbp - 8]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rbp - 8]
test eax, eax
je 0x140003c5b
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140003c88
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000d830
mov rcx, qword [rbp - 8]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret

Function at 0x14000bac0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14000bb60
jmp 0x14000bb4f
jae 0x14000bc20
cmp r8, 0x201
jae 0x14000bb60
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000bbb8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000bb8f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14002dc30
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000bbe1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000bc88
mov r8d, r14d
cmp r15, r8
jne 0x14000bb40
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000bcb5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000bb4f
jmp 0x14000bb60
cmp rsi, r8
jb 0x14000bccf
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000d830
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14000bc71
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140003bc0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14000bc59
jmp 0x14000bc71
lea rcx, [0x140030a58]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002e5e0
jmp 0x14000bce4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002ea30
ud2
Function at 0x14000bd40
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.14001eae0
mov rax, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x14000bd96
lea rcx, [rbp - 0x50]
call fcn.140005e10
mov qword [rsi], rdi
jmp 0x14000bf81
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x418], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3f8], 2
mov qword [rbp + 0x400], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor ebx, ebx
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x14000be20
jmp 0x14000be0f
jae 0x14000bee6
cmp r8, 0x201
jae 0x14000be20
mov r15d, 0x200
lea r14, [rbp - 0x58]
mov r12, r8
jmp 0x14000be78
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x14000be4f
lea rcx, [rbp + 0x3f0]
mov rdx, r13
call fcn.14002dc30
mov rbx, qword [rbp + 0x3f0]
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x410], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rbp + 0x400], r13
mov rdi, rbx
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000bea7
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000bfbb
mov r8d, esi
cmp r12, r8
jne 0x14000be00
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000bff6
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000be0f
jmp 0x14000be20
cmp r15, r8
jb 0x14000c010
lea rcx, [rbp + 0x3a8]
mov rdx, r14
call fcn.14000d830
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3e0], xmm1
movaps xmmword [rbp + 0x3d0], xmm0
movabs rdi, 0x8000000000000000
test rbx, rbx
mov rsi, qword [rbp + 0x3c8]
je 0x14000bf48
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rbx
call fcn.140003bc0
cmp qword [rbp + 0x3d0], rdi
jne 0x14000bf98
mov qword [rsi], rdi
lea rcx, [rbp + 0x3d8]
call fcn.140005e10
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x14000bf81
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140003bc0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmm1, xmmword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x14000bf6c
jmp 0x14000bf81
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3d8], rax
movabs rdi, 0x8000000000000000
mov qword [rbp + 0x3d0], rdi
test rbx, rbx
mov rsi, qword [rbp + 0x3c8]
jne 0x14000bf30
jmp 0x14000bf48
lea rcx, [0x140030a58]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002e5e0
jmp 0x14000c025
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14002ea30
ud2
Function at 0x1400111d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002cff0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140017820]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.140017310
cmp qword [rbp + 0xfe8], 0
jne 0x1400113a7
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x140011373
cmp r12, 0x1000
ja 0x1400113c9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140011347
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x1400112f0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14001134d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140011330
jbe 0x1400112a0
jmp 0x1400113b5
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140011255
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.140005e10
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.140005e10
jmp 0x140011373
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14002eab0
jmp 0x1400113dd
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14002ea30
ud2
Function at 0x140014c80
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140032960]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140014cc4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140014d23
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140014d32
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140014d6a
cmp eax, 0x103
je 0x140014d74
test eax, eax
js 0x140014d4f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140014d6a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1400329c0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000d600
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140006410
mov ecx, 7
int 0x29
ud2

Function at 0x140014de0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140032960]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140014e24
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140014e8a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140014ec1
test eax, eax
js 0x140014e9b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140014eb4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1400329c0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000d600
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140006410
mov ecx, 7
int 0x29
ud2
Function at 0x140017ce0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140017e33
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x140017d17
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140017df8
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140017e16
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x140017d79
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x140017dab
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x140017daf
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x140017db3
cmp eax, 0x6d
jne 0x140017dde
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x140017db8
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x140017de4
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140005e10
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140017dee
cmp rax, 1
je 0x140017d62
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x140017d6c
mov r8d, 0x10
mov rcx, rbx
call fcn.14002dcf0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140017d24
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14002dcf0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x140017d24
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14002dba0
int3
Function at 0x14001cba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14001eae0

Function at 0x14001db00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14001db43
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14000c700]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14002e510
ud2

Function at 0x14001e1a0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
invalid
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14003e181]
mov ecx, 0x10
mov edx, 8
call fcn.140003bb0
dec dword [rax - 0x7b]
ror byte [rdi], 0x84
invalid
add byte [rax], al
invalid
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov dword [rbp - 0x10], edi
Function at 0x14002be50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002beca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002bec0
cmp r11, r10
ja 0x14002bf61
cmp r10, rdx
ja 0x14002bf73
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002bec2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002bea0
jmp 0x14002bf37
ja 0x14002beca
mov r11, r10
cmp rax, r8
jne 0x14002be72
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002bf3b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002bf10
mov r8, r10
sub ecx, r9d
jns 0x14002bf2e
jmp 0x14002bf3d
cmp r10, rdx
je 0x14002bf49
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002bf3d
xor al, 1
cmp r8, rdx
jne 0x14002bef0
jmp 0x14002bf3d
xor eax, eax
jmp 0x14002bf3d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14003578b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14002e5e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002eab0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002ea30
int3

Function at 0x14002d520
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14002d56a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002d56a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002d56a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002d56a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002d56a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002d56c
xor al, al
add rsp, 0x28
ret
Function at 0x414500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4146a6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430400
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41456b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414580
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x4145a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4145b9
cmp rbx, 0x1000
jae 0x414575
nop dword [rax]
jmp 0x414629
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4145cd
xor edx, edx
jmp 0x414620
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430400
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x4145af
jmp 0x414594
call fcn.0045e0a0
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434800
lea rax, [0x004953c9]
mov ebx, 0x18
call fcn.00435100
mov rax, qword [rsp + 0x38]
call fcn.00434e00
lea rax, [0x00495489]
mov ebx, 0x19
call fcn.00435100
mov rax, qword [rsp + 0x30]
nop
call fcn.00434e00
call fcn.00434a60
call fcn.00434880
lea rax, [0x00497a6c]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00432ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414500
Function at 0x4146e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41490a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430480
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414759
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41476c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414790
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4147a4
cmp rbx, 0x1000
jae 0x414763
jmp 0x414825
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4147b6
xor esi, esi
jmp 0x414816
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430480
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41479a
nop
jmp 0x414782
call fcn.0045e0a0
xorps xmm15, xmm15
mov r14, qword [0x005776e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4148a5
call fcn.00434800
lea rax, [0x004959cf]
mov ebx, 0x19
call fcn.00435100
mov rax, qword [rsp + 0x68]
call fcn.00434e00
lea rax, [0x00495489]
mov ebx, 0x19
call fcn.00435100
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00434e00
call fcn.00434a60
call fcn.00434880
lea rax, [0x00491c39]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00432ec0
cmp eax, 0x5af
je 0x414848
call fcn.00434800
lea rax, [0x004959cf]
mov ebx, 0x19
nop dword [rax]
call fcn.00435100
mov rax, qword [rsp + 0x38]
call fcn.00434e00
lea rax, [0x00495489]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435100
mov eax, dword [rsp + 0x34]
call fcn.00434e00
call fcn.00434a60
call fcn.00434880
lea rax, [0x004973e2]
mov ebx, 0x1f
call fcn.00432ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004146e0