joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180042580
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180065b68], ebp
je 0x1800425d7
cmp rbx, 0x20
jae 0x1800425c0
xor ecx, ecx
jmp 0x1800425c2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180065b68], ebp
jne 0x1800425b6
cmp qword [0x180065b70], r15
je 0x1800426d1
test rdi, rdi
jne 0x1800425f7
mov ecx, esi
call fcn.1800420d0
mov ebp, eax
jmp 0x1800426d6
mov ecx, dword [0x180065e8c]
mov ebx, r15d
test ecx, ecx
je 0x18004261f
mov r8, qword [0x180065e80]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180042629
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180042610
mov ebp, 4
jmp 0x1800426d6
cmp ebx, 0xffffffff
je 0x18004261f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800426c8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180041df0
mov edx, esi
mov ecx, ebx
call fcn.180041fa0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800426d6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800426b2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800426a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180042680
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180065b70]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800426d6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800426d6
mov ebp, 2
xchg dword [0x180065b68], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180047470
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x1800474b2
cmp edx, 1
jne 0x1800474dc
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180047410]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180065bf4], 0
je 0x1800474dc
call fcn.180042700
mov rcx, qword [0x180065ca8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x180065ca8], rax
mov dword [0x180065bf4], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180da5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180da51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180da5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da506f
add dl, dl
jne 0x180da5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da50f6
xor eax, eax
add dl, dl
jne 0x180da50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180da51ad
add dl, dl
jne 0x180da50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180da50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180da507e
mov eax, 1
add dl, dl
jne 0x180da5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180da5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da50fb
sub eax, ebx
mov ebx, 1
jne 0x180da514c
mov ecx, 1
add dl, dl
jne 0x180da512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180da513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180da5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180da5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180da515d
cmp eax, 0x7d00
jae 0x180da519b
cmp eax, 0x500
jb 0x180da5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da507e
cmp eax, 0x7f
ja 0x180da519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180da507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180da51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180da507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000f010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000f090
cmp r10, r11
jb 0x14000f107
cmp r10, rdx
ja 0x14000f119
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14000f092
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000f070
jmp 0x14000f0f4
ja 0x14000f09a
mov r11, r10
cmp rax, r8
jne 0x14000f03e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000f0d0
mov rdi, r8
sub ecx, edx
jns 0x14000f0eb
jmp 0x14000f0f6
cmp r8, rsi
je 0x14000f128
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000f0f6
xor al, 1
cmp rdi, rsi
jne 0x14000f0b0
jmp 0x14000f0f6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140045ce0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140045900
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140045d50
int3
Function at 0x140016933
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov r14, qword [0x14005e120]
test r14, r14
jne 0x140016a6a
lea rcx, [0x14004ca9d]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14001699d
mov rbx, rax
lea rdx, [0x14004cabe]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14001699d
mov rdi, rax
lea rdx, [0x14004cacc]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14001699d
mov r15, rax
xor ebx, ebx
jmp 0x140016a22
lea rcx, [0x14004ca58]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140016a7e
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140016a7e
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140016a7e
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140016a7e
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140016a7e
mov r15, qword [rsp + 0x20]
mov ecx, 0x18
call fcn.140014e73
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x14005e120], r14
je 0x140016a6a
mov rdi, rax
cmp qword [r14], 0
je 0x140016a5a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.14000aea0
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
call fcn.1400457e0
int3
Function at 0x140017684
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140019b4a
test rax, rax
je 0x1400176bc
mov edx, 4
mov rcx, rax
call fcn.14000aea0
jmp 0x1400176f5
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.140016c20
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140016c62
Function at 0x140019b4a
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test r12, r12
je 0x140019bda
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x140019b77
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x140019b77
and ebx, 0x7fffffff
je 0x140019bda
mov al, byte [0x14005e250]
mov edx, 4
xor ecx, ecx
call fcn.14002fd70
test rax, rax
je 0x140019bed
mov dword [rax], ebx
jmp 0x140019bdc
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.140045720
int3

Function at 0x1400201d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400201f5
cmp rax, rcx
je 0x1400201fb
cmp rdx, 4
jae 0x140020202
xor eax, eax
xor r8d, r8d
jmp 0x1400202a0
pop rbp
jmp fcn.14000bbf0
xor eax, eax
jmp 0x1400202b7
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140049660]
movdqa xmm3, xmmword [0x140049670]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140020230
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400202b7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400202a0
pop rbp
ret
Function at 0x1400269c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140052708]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140026a31
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140026a5e
test eax, eax
js 0x140026a3d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140026a54
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140052770]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140026100
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400261c0
mov ecx, 7
int 0x29
ud2

Function at 0x140028ab0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x14002af10
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14002b340
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x14002af66
lea rcx, [rbp - 0x58]
call case.0x14000c20a.268
mov qword [rsi], rdi
jmp 0x14002b1a8
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], edx
add al, 0
add byte [rdx], al
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], ebx
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x48], al
add byte [rdx], al
add byte [rax], al
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x14002aff0
jmp 0x14002afdf
jae 0x14002b0b6
cmp r8, 0x201
jae 0x14002aff0
mov r15d, 0x200
lea r12, [rbp - 0x60]
mov r13, r8
jmp 0x14002b048
sub r8, r14
sub rbx, r14
cmp r8, rbx
jbe 0x14002b01f
lea rcx, [rbp + 0x408]
mov rdx, r14
call fcn.1400471f0
mov rdi, qword [rbp + 0x408]
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x418], r14
mov rbx, rdi
mov ebx, edi
mov r15, r14
mov r12, qword [rbp + 0x3e8]
mov r13, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x400]
mov rdx, r12
mov r8d, r13d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14002b077
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14002b136
mov r8d, esi
cmp r13, r8
jne 0x14002afd0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002b1bd
add r13, r13
mov eax, 0xffffffff
invalid
invalid
dec dword [rcx + 0x39]
invalid
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14002afdf
jmp 0x14002aff0
cmp r15, r8
jb 0x14002b1d7
lea rcx, [rbp + 0x3a0]
mov rdx, r12
call fcn.140029560
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
cmp qword [rbp + 0x408], 0
je 0x14002b105
mov rcx, qword [rbp + 0x410]
mov edx, 2
call fcn.14000aea0
movabs rsi, 0x8000000000000000
cmp qword [rbp + 0x3c0], rsi
mov rax, qword [rbp + 0x3f8]
je 0x14002b17e
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
jmp 0x14002b18d
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c8], rax
add byte [rax], al
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_std_src_threadmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
add eax, 0xba00027c
sub byte [rax], al
add byte [rax], al
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.140045900
Function at 0x14002c010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x14002df10
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
test cl, cl
je 0x14002df24
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14002dff0
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14002df30

Function at 0x14002df30
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14002b340
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14002df8d
invalid
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x28], eax

Function at 0x14002f880
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14005e250]
mov edx, 0x10
xor ecx, ecx
call fcn.14002fd70
test rax, rax
je 0x14002f960
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14002fa00]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14002f952
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x14002f917
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x14002f92f
mov rdx, qword [rax + 0x10]
call fcn.14000aea0
mov edx, 8
mov rcx, qword [rbp - 0x20]
call fcn.14000aea0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.140045720
ud2
Function at 0x14003aa70
Capabilities:
Get local ipv4 addresses

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x38], rcx
lea rbp, [rsp + 0x44]
mov dword [rbp], 0x3c00
and dword [rsp + 0x34], 0
mov esi, 4
xor ebx, ebx
lea rdi, str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code
lea r14, [rsp + 0x48]
mov r13, qword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
dec esi
je 0x14003ab51
mov edx, dword [rsp + 0x44]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov r15, rax
mov r12, rax
test rax, rax
jne 0x14003ab0d
mov r8d, 0x32
mov rcx, r14
mov rdx, rdi
call fcn.140033791
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x14003abb5
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, r12
call r13
mov dword [rsp + 0x34], eax
mov rbx, r12
cmp eax, 0x6f
je 0x14003aab3
test eax, eax
jne 0x14003ab4e
mov rax, qword [rsp + 0x38]
mov qword [rax + 8], r12
mov qword [rax + 0x10], r15
movabs rcx, 0x8000000000000000
mov qword [rax], rcx
jmp 0x14003aba0
mov rbx, r12
lea rax, [rsp + 0x34]
lea rcx, [rsp + 0x78]
mov qword [rcx], rax
lea rax, [0x140054310]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea r8, [0x14000d040]
mov qword [rcx + 8], r8
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400376fa
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r15
jmp 0x14003aba0
Function at 0x14003cdce
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x34]
and dword [rax], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r9
xor edi, edi
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003ce25
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140044915
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
mov edi, 1
mov qword [rsi], rdi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14003ce36
Capabilities:
Get hostname

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 5
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
mov rcx, rsi
mov edx, eax
add rsp, 0x20
pop rsi
jmp 0x140033acd

Function at 0x1400451c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14004520a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004520a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004520a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004520a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004520a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004520c
xor al, al
add rsp, 0x28
ret
Function at 0x140009320
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
vmovups ymm0, ymmword [r8]
lea rsi, [rsp + 0x140]
mov qword [rsp + 0x28], rcx
mov rcx, rsi
vmovups ymmword [rsp + 0x30], ymm0
and byte [rsp + 0x30], 0xf8
movzx eax, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
vzeroupper
call fcn.140002b30
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.140002a10
lea rdi, [rsp + 0xb0]
mov rdx, rsi
mov r8, rbx
mov rcx, rdi
call fcn.140002a30
mov rcx, rbx
mov rdx, rbx
mov r8, rsi
call fcn.140005410
mov rcx, rbx
mov rdx, rbx
call fcn.140002d50
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.140003a20
lea rcx, [rsp + 0x80]
call fcn.140002a10
lea r12, [rsp + 0x110]
mov rcx, r12
call fcn.1400029f0
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140002b10
lea rsi, [rsp + 0xe0]
mov rcx, rsi
call fcn.140002a10
mov r13d, 0xfe
xor edi, edi
nop word [rax + rax]
mov eax, r13d
shr eax, 3
mov ecx, r13d
mov ebp, edi
lea r15, [rsp + 0x50]
lea r14, [rsp + 0x80]
movzx eax, byte [rsp + rax + 0x30]
and cl, 7
mov rdx, r15
shrx edi, eax, ecx
mov rcx, r14
and edi, 1
xor ebp, edi
mov r8d, ebp
call fcn.140002aa0
mov rcx, r12
mov rdx, rsi
mov r8d, ebp
call fcn.140002aa0
lea rbp, [rsp + 0xb0]
mov rdx, r15
mov r8, rsi
mov rcx, rbp
call fcn.140005410
mov rcx, rbx
mov rdx, r14
mov r8, r12
call fcn.140005410
mov rcx, r14
mov rdx, r14
mov r8, r12
call fcn.140002a30
mov rcx, r12
mov rdx, r15
mov r8, rsi
call fcn.140002a30
mov rcx, rsi
mov rdx, rbp
mov r8, r14
call fcn.140003a20
mov rcx, r12
mov rdx, r12
mov r8, rbx
call fcn.140003a20
mov rcx, rbp
mov rdx, rbx
call fcn.140003500
mov rcx, rbx
mov rdx, r14
call fcn.140003500
mov rcx, r15
mov rdx, rsi
mov r8, r12
call fcn.140002a30
mov rcx, r12
mov rdx, rsi
mov r8, r12
call fcn.140005410
mov rcx, r14
mov rdx, rbx
mov r8, rbp
call fcn.140003a20
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.140005410
mov rcx, r12
mov rdx, r12
call fcn.140003500
mov rcx, rsi
mov rdx, rbx
call fcn.140004550
mov rcx, r15
mov rdx, r15
call fcn.140003500
mov rcx, rbp
mov rdx, rbp
mov r8, rsi
call fcn.140002a30
lea rdx, [rsp + 0x140]
mov rcx, rsi
mov r8, r12
call fcn.140003a20
mov rcx, r12
mov rdx, rbx
mov r8, rbp
call fcn.140003a20
add r13d, 0xffffffff
jb 0x140009400
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov r8d, edi
mov rcx, rsi
call fcn.140002aa0
lea rbx, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov r8d, edi
mov rcx, rbx
call fcn.140002aa0
mov rcx, rbx
mov rdx, rbx
call fcn.140002d50
mov rcx, rsi
mov rdx, rsi
mov r8, rbx
call fcn.140003a20
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.1400042d0
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret