joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469ea0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x0095a2a0]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x469f3b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x46a160
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x0095a2a0]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x46a1f7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x46a5c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46a5f4
mov rcx, 0x28
jmp 0x46a5ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x0095a2a0], rcx
pop rbp
ret
Function at 0x4849e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484aaa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0095a2a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484a8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bf0e0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x484a7e
mov edi, 1
lea rsi, [0x004bf0e0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0083e468]
lea rsi, [0x0083dc70]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a82e0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8a1f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4a830d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4a8591
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4a85bd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0083fae0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004befe0]
lea rbx, [0x0083e340]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4a85e2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4a8617
lea rdi, [0x004bf060]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4a8303
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4a85fb
jmp 0x4a85d0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4a8bc0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a8bd7
inc rax
cmp rax, 4
jge 0x4a8bef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a8bd4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a8c00
inc rax
cmp rax, 4
jge 0x4a8c0e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a8c37
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a8c1b
jmp 0x4a8bfd
Function at 0x140004050
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov word [rsp + 0x10], r8w
movsxd r9, edx
movzx r8d, r10w
test edx, edx
jle 0x14000408f
lea edx, [r10 + 1]
cmp dx, r8w
mov eax, r10d
cmovne ax, r8w
movzx r8d, ax
mov al, byte [rcx]
add al, 0x20
xor al, byte [rsp + r8*2 + 0x10]
add r8w, dx
mov byte [rcx], al
add rcx, rdx
sub r9, rdx
jne 0x140004068
ret
Function at 0x140011994
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140011784
Function at 0x14001b330
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140b12670]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14001b38e
cmp word [rdx], r12w
jne 0x14001b38e
or byte [rax + r8*8 + 0x38], cl
jmp 0x14001b394
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14001b4ef
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14001b4ca
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14001b3cd
mov rcx, r9
jmp 0x14001b3f0
cmp r9, rdx
jae 0x14001b407
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14001b3b1
jmp 0x14001b4ef
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001b4c4
cmp dword [rsp + 0x80], edi
je 0x14001b4c4
mov rdx, r14
lea r11, [0x140b12670]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14001b49d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14001b470
mov word [rbx], r12w
jmp 0x14001b4eb
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14001b479
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14001b4eb
cmp word [rsp + 0x70], r12w
jne 0x14001b4aa
cmp rbx, rsi
je 0x14001b46a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14001b250
cmp word [rsp + 0x70], r12w
je 0x14001b4ef
mov word [rbx], r13w
jmp 0x14001b4eb
lea r11, [0x140b12670]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14001b4e7
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14001b4ef
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001e640
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b250
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b250
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14001e790
cmp rax, 0xffffffffffffffff
je 0x14001e790
xor edi, edi
test rbp, rbp
jle 0x14001e73b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140016c58
mov rbx, rax
test rax, rax
jne 0x14001e6c8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14001e731
mov edx, 0x8000
mov ecx, r14d
call fcn.14001271c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140015054
cmp eax, 0xffffffff
je 0x14001e711
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14001e6d8
mov edx, r15d
mov ecx, r14d
call fcn.14001271c
jmp 0x14001e731
cmp byte [rsi + 0x38], dil
je 0x14001e728
cmp dword [rsi + 0x34], 5
jne 0x14001e728
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14001e731
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140012ddc
jmp 0x14001e7a4
jns 0x14001e7a4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b250
cmp rax, 0xffffffffffffffff
jne 0x14001e75c
cmp byte [rsi + 0x30], dil
je 0x14001e7a4
mov edi, dword [rsi + 0x2c]
jmp 0x14001e7a4
mov ecx, r14d
call fcn.1400199e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001e7a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14001e7a4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14001e79d
mov eax, dword [rsi + 0x2c]
jmp 0x14001e7a2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b250
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14000d600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x14000d640
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x14000d635
cmp edi, 0x2d
jne 0x14000d640
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x14000d7d4
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14000d7df
movzx r11d, r11b
cmp rbx, rsi
jae 0x14000d6dd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14000d69c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x14000d6dd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x14000d6dd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x14000d680
cmp r11d, 0xccccccc
jne 0x14000d6c8
cmp sil, 7
jbe 0x14000d680
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.14005ed80
jmp 0x14000d7c1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14000d6fa
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14000d70a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x140082190]
subpd xmm1, xmmword [0x1400821a0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14000d77c
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400821b0]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x14000d758
jnp 0x14000d7aa
test r10d, r10d
jns 0x14000d808
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x14000d750
mov eax, eax
mov r9, qword [str.PO_b_]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x14000d7c9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x1400821c0]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x1400821d0]
jae 0x14000d808
test r8b, r8b
jne 0x14000d7b7
xorpd xmm0, xmmword [0x1400821e0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x14000d7af
jmp 0x14000d7b7
mov qword [rsp + 0x28], 5
jmp 0x14000d7e8
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14005ee20
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14000d7c1
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14005ee20
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14000d7be
Function at 0x14001c500
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14001c572
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x14001c538
add rdi, rbx
sub rsi, rbx
je 0x14001c572
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14001c530
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14001c530
and ebp, 0x7fffffff
jmp 0x14001c574
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140039cd0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140039d70
jmp 0x140039d5f
jae 0x140039e2f
cmp r8, 0x201
jae 0x140039d70
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140039dc7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140039d9f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140060080
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140039df0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140039e9b
mov r8d, r13d
cmp r12, r8
jne 0x140039d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140039ecf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140039d5f
jmp 0x140039d70
cmp r14, r8
jb 0x140039ee9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14003c8c0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140039e84
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14001ae50
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140039e6f
jmp 0x140039e84
lea rcx, str.internal_error:_entered_unreachable_code_b_
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140061840
jmp 0x140039efe
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140061bf0
ud2
Function at 0x140040340
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14005d610
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x1400457f0]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call case.0x140045340.237
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x140040530
test r15, r15
je 0x1400404fc
cmp r15, 0x1000
ja 0x140040552
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x1400404d0
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140040460
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x1400404f0
add r12, rax
cmp r12, r15
je 0x1400404c0
jbe 0x140040410
jmp 0x14004053e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x1400403be
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140033c80
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140033c80
jmp 0x1400404fc
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.140061c60
jmp 0x140040566
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.140061bf0
ud2
Function at 0x140043bb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14008d9d8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140043be8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140043c3f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x140043c4c
xor edx, edx
xor eax, eax
jmp 0x140043c76
cmp eax, 0x103
je 0x140043c80
test eax, eax
js 0x140043c5f
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140043c76
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14003c5f0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140034310
mov ecx, 7
int 0x29
ud2

Function at 0x140043cd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14008d9d8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140043d08
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140043d66
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140043d93
test eax, eax
js 0x140043d72
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140043d89
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14003c5f0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140034310
mov ecx, 7
int 0x29
ud2