joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d81a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400d81d0
mov byte [rdi + 0x18], 1
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r14, [rdi + 0x10]
mov qword [rsp + 0x20], r14
lea r9, [0x140128280]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x140128350]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
js 0x1400d8306
cmp qword [r14], rbp
je 0x1400d82ca
lea ecx, [rbp + 0x18]
call fcn.1400de2bc
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400d8276
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400d8279
mov ecx, 0x8007000e
call fcn.14011bdf0
int3
mov rbx, rbp
mov qword [rsp + 0x80], rbx
test rbx, rbx
jne 0x1400d8291
mov ecx, 0x8007000e
call fcn.14011bdf0
nop
mov rcx, qword [r14]
mov r10, qword [rcx]
lea rax, [rdi + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [r10 + 0x18]
mov esi, eax
mov rcx, rbx
call fcn.1400c2e40
test esi, esi
js 0x1400d8306
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d8302
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x1400d833a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d8315
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [r14]
test rcx, rcx
je 0x1400d8323
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rdi + 0x18], 0
je 0x1400d832f
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rdi + 8], rbp
mov qword [r14], rbp
mov byte [rdi + 0x18], 0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e2668
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400e24d0
Function at 0x1401060c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r8d, r8d
mov r11, rdx
mov r9, rcx
sub r11, rcx
cmp rcx, rdx
cmova r11, r8
test r11, r11
je 0x14010611f
mov r10, rcx
mov qword [rsp], rbx
mov ebx, 0x9e3779b9
neg r10
nop dword [rax + rax]
movsx rcx, byte [r9]
mov rdx, r8
mov rax, r8
shr rax, 2
shl rdx, 6
lea r9, [r9 + 1]
add rax, rdx
add rax, rbx
add rcx, rax
lea rax, [r10 + r9]
xor r8, rcx
cmp rax, r11
jne 0x1401060f0
mov rbx, qword [rsp]
movabs rax, 0x200009c482fb3f8b
mul r8
shr rdx, 0x1c
imul eax, edx, 0x7fffd8ee
sub r8d, eax
lea eax, [r8 + 0x2710]
add rsp, 8
ret
Function at 0x140001820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x140003870
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xcb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc30], 0xfffffffffffffffe
mov qword [rbp + 0xc20], r9
mov qword [rbp + 0x760], r8
cmp r8, 0x20
jne 0x140003af9
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x14012c3e8]
movzx eax, byte [r14]
cmp al, 0xff
je 0x1400038c8
cmp al, 1
je 0x140003920
jmp 0x14000397f
mov byte [rbp + 0xc2f], 0
lea rcx, [rbp + 0x3a0]
mov edx, 1
call fcn.140011c10
mov byte [rbp + 0xc2f], 0
lea rcx, [rbp + 0x760]
mov edx, 7
xor r8d, r8d
call fcn.140011c40
mov ebx, dword [rbp + 0x3a8]
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x14000397b
call fcn.140002030
and eax, 2
shr eax, 1
shr ebx, 0x19
and ebx, eax
mov byte [r14], bl
je 0x14000397f
mov byte [rbp + 0xc2f], 0
lea rcx, [rbp + 0xb20]
mov rdx, rdi
call fcn.140011cf0
lea rcx, [rbp + 0x490]
lea rdi, [rbp + 0xb20]
mov rdx, rdi
call fcn.140001820
lea rbx, [rbp + 0x3a0]
mov r8d, 0xf0
mov rcx, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x760]
mov r8d, 0x1e0
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140003995
mov byte [r14], 0
mov byte [rbp + 0xc2f], 0
lea rcx, [rbp + 0x760]
mov rdx, rdi
call fcn.140012280
lea rdi, [rbp + 0x3a0]
lea rdx, [rbp + 0x760]
mov r8d, 0x3c0
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + 0xc2f], 0
lea rcx, [rbp - 0x40]
mov rdx, rdi
call fcn.140008800
mov rax, qword [rbp + 0xc20]
mov rbx, qword [rax + 0x10]
cmp rbx, 0xe
jbe 0x140003b2f
mov r15, qword [rax]
lea r8, [r15 + 3]
lea rax, [rbx - 0xf]
lea r9, [r15 + 0xf]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x760]
lea rdx, [rbp - 0x40]
call fcn.140008230
cmp qword [rbp + 0x760], 0
je 0x140003a47
mov rax, qword [rbp + 0x770]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp + 0x760]
movups xmmword [rsi], xmm0
movzx eax, byte [r14]
mov rax, qword [rbp + 0xc20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140003ae6
mov r8d, 1
mov rcx, r15
call fcn.1400017e0
jmp 0x140003ae6
mov rax, qword [rbp + 0xc20]
mov rax, qword [rax + 8]
mov qword [rbp + 0xc10], rax
mov dword [rbp + 0xb20], ebx
mov qword [rbp + 0xc18], r15
mov qword [rbp + 0xb28], r15
mov dword [rbp + 0x3a0], 0
mov qword [rbp + 0x3a8], 0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0xb20]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
mov rax, qword [rbp + 0x3a8]
mov ecx, dword [rbp + 0x3a0]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rcx
mov rdx, qword [rbp + 0xc10]
test rdx, rdx
je 0x140003ae2
mov r8d, 1
mov rcx, qword [rbp + 0xc18]
call fcn.1400017e0
movzx eax, byte [r14]
mov rax, rsi
add rsp, 0xcb8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x40], 0
mov byte [rbp + 0xc2f], 0
lea rax, str.C:Users_vurt.cargo_registry_srcindex.crates.io_6f17d22bba15001fgeneric_array_0.14.7_srclib.rs
mov qword [rsp + 0x20], rax
lea r8, [0x1400ffaf0]
lea rdx, [rbp + 0x760]
lea r9, [rbp - 0x40]
xor ecx, ecx
call fcn.1400fca90
jmp 0x140003b43
lea r8, [0x1400ffaf8]
mov ecx, 0xf
mov rdx, rbx
call fcn.1400fe4a0
ud2
Function at 0x140005920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x140005961
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x140005956
cmp edi, 0x2d
jne 0x140005961
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x140005afa
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x140005b05
movzx r10d, r10b
cmp rbx, r11
jae 0x140005a00
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x1400059bc
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x140005a00
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x140005a00
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccb
jle 0x1400059a0
cmp r10d, 0xccccccc
jne 0x1400059e8
cmp r11b, 7
jbe 0x1400059a0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1400fce10
jmp 0x140005ae7
mov ecx, dword [rsp + 0x80]
test al, al
je 0x140005a1c
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x140005a2c
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1400ffc90]
subpd xmm1, xmmword [0x1400ffca0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x140005a98
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400ffcb0]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x140005a78
jnp 0x140005ad0
test ecx, ecx
jns 0x140005b2b
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x140005a70
mov eax, eax
mov r9, qword [0x14012c3c8]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x140005aef
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x140005b2b
test r8b, r8b
jne 0x140005add
xorpd xmm0, xmmword [0x1400ffcc0]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140005ad5
jmp 0x140005add
mov qword [rsp + 0x28], 5
jmp 0x140005b0e
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1400fceb0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140005ae7
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1400fceb0
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140005ae4
Function at 0x14000aa20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
movd xmm1, r9d
shufps xmm1, xmm0, 0xe4
shufps xmm0, xmm1, 0x24
xorps xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
ret
Function at 0x14000ec30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1090
call fcn.1400fc080
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1008], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x60]
mov r8d, 0x1020
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov edx, 0x800
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14000ecb5
xorps xmm0, xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xfa0], xmm0
mov rcx, rdi
mov dl, 1
call fcn.14000e550
mov r8d, 0x1020
mov rcx, rsi
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rsi
add rsp, 0x1090
pop rdi
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x1000], rax
lea rax, [rbp + 0x1000]
mov qword [rbp + 0xff0], rax
lea rax, [0x140019660]
mov qword [rbp + 0xff8], rax
lea rax, [0x14010f088]
mov qword [rbp + 0xfc0], rax
mov qword [rbp + 0xfc8], 1
mov qword [rbp + 0xfe0], 0
lea rax, [rbp + 0xff0]
mov qword [rbp + 0xfd0], rax
mov qword [rbp + 0xfd8], 1
lea rdx, str.C:Users_vurt.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rand_0.4.6_srcos.rscouldnt_generate_random_bytes:
lea rcx, [rbp + 0xfc0]
call fcn.1400fe010
ud2

Function at 0x14000eeb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rcx, rdx
mov edi, 0xffffffff
test rsi, rsi
je 0x14000ef59
cmp rsi, rdi
mov edx, 0xffffffff
cmovb rdx, rsi
sub rsi, rdx
lea rbx, [rcx + rdx]
call sub.ADVAPI32.dll_SystemFunction036
mov rcx, rbx
test al, al
jne 0x14000eed0
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x18], rax
lea rax, [0x140019660]
mov qword [rbp - 0x10], rax
lea rax, [0x14010f088]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 1
mov qword [rbp - 0x28], 0
lea rax, [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rdx, str.C:Users_vurt.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rand_0.4.6_srcos.rscouldnt_generate_random_bytes:
lea rcx, [rbp - 0x48]
call fcn.1400fe010
ud2
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011ce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140017680
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140017710
jmp 0x1400176ff
jae 0x1400177d0
cmp r8, 0x201
jae 0x140017710
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140017768
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14001773f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400fd440
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140017791
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140017838
mov r8d, r14d
cmp r15, r8
jne 0x1400176f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001785b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400176ff
jmp 0x140017710
cmp rsi, r8
jb 0x140017875
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14001bc70
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140017821
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400017e0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140017809
jmp 0x140017821
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400fe0b0
jmp 0x14001788a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400fe4a0
ud2
Function at 0x140018780
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140018790
mov rcx, rdx
mov rdx, r8
jmp fcn.1400187a0
mov rcx, rdx
mov rdx, r8
jmp fcn.140022960

Function at 0x140022960
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140025b50
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x140022a17
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140024950
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x140022a17
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400229eb
test rsi, rsi
je 0x1400229e7
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400017e0
xor esi, esi
jmp 0x140022a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x140022a14
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400017e0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140023370
Capabilities:
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, r8d
mov r8, rdx
mov rdx, rcx

Function at 0x140023b40
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140112538]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140023b84
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140023be3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140023bf2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140023c2a
cmp eax, 0x103
je 0x140023c34
test eax, eax
js 0x140023c0f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140023c2a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x140112598]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140014d00
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.14001b980
mov rcx, rax
call fcn.140015340
mov ecx, 7
int 0x29
ud2
Function at 0x140023c90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140112538]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140023cd4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140023d3a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140023d71
test eax, eax
js 0x140023d4b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140023d64
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x140112598]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140014d00
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.14001b980
mov rcx, rax
call fcn.140015340
mov ecx, 7
int 0x29
ud2
Function at 0x140032850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400328ca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400328c0
cmp r11, r10
ja 0x140032963
cmp r10, rdx
ja 0x140032977
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400328c2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400328a0
jmp 0x140032937
ja 0x1400328ca
mov r11, r10
cmp rax, r8
jne 0x140032872
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14003293b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140032910
mov r8, r10
sub ecx, r9d
jns 0x14003292e
jmp 0x14003293d
cmp r10, rdx
je 0x140032949
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14003293d
xor al, 1
cmp r8, rdx
jne 0x1400328f0
jmp 0x14003293d
xor eax, eax
jmp 0x14003293d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400fe0b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400fe510
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400fe4a0
ud2