joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ff16f
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14013b8d0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x140504115]
call fcn.140100a5b
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140308160]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x14013ba09
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14013b96a
mov dword [rbp + 0x160], 1
jmp 0x14013b974
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x14013ba04
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x64], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14013b9de
cmp qword [rbp + 0x198], 2
jb 0x14013b9de
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14013b9de
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14013b9de
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14013b935
jmp 0x14013ba96
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x84], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14013ba96
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x14013ba6d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14013ba6d
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14013ba6d
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14013ba09
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400ff340
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402f6420
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402f6440
xor al, al
jmp 0x1402f64c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402f6453
xor al, al
jmp 0x1402f64c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402f647d
xor al, al
jmp 0x1402f64c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402f6491
xor al, al
jmp 0x1402f64c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402f64a3
xor al, al
jmp 0x1402f64c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402f64bf
xor al, al
jmp 0x1402f64c1
mov al, 1
add rsp, 0x38
ret

Function at 0x1400ff42b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x1402dd4e0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1402dd523
jmp 0x1402dd615
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1402dd55c
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.1400fd6df
jmp 0x1402dd615
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1402dd595
lea rdx, [0x1404cc810]
mov ecx, 0x10008
call fcn.1400fd6df
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1402dd615
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1404e87a8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1402dd5f9
lea rdx, [0x1404cc838]
mov ecx, 0x10008
call fcn.1400fd6df
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1402dd615
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret
Function at 0x140100169
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1402ebf20
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x1402ebf50
mov r8d, 0x40
lea rdx, [0x1404ce340]
lea rcx, [0x1404ce3a0]
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x1401004ca
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14013b7c0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140504115]
call fcn.140100a5b
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140308160]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14013b840
mov dword [rbp + 0x120], 1
jmp 0x14013b84a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14013b884
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
jmp 0x14013b80b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1401007fe
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
jmp 0x1402dd630
push rdi
sub rsp, 0x30
mov rcx, qword [0x1404e87a8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1402dd65f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.1400fd6df
xor eax, eax
jmp 0x1402dd6fb
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402dd692
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.1400fd6df
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1402dd6fb
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1402dd6c5
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.1400fd6df
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1402dd6fb
mov rcx, qword [0x1404e87c0]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.1400fe260
mov qword [0x1404e87c0], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1404e87c0]
add rsp, 0x30
pop rdi
ret

Function at 0x14010086c
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402ebe60
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x1402ebe90
mov r8d, 0x29
lea rdx, [0x1404ce270]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x1402ebebe
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.1400fd6df
xor eax, eax
jmp 0x1402ebece
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1402e01d0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x358]
mov qword [rsp + 0x30], rax
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1402e0248
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400fd6df
mov rcx, rsp
lea rdx, [0x14037c2c0]
call fcn.1400ffd95
add rsp, 0x50
pop rdi
ret

Function at 0x1402e0270
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1402e02e0
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400fd6df
mov rcx, rsp
lea rdx, [0x14037c310]
call fcn.1400ffd95
add rsp, 0x50
pop rdi
ret

Function at 0x1402e0820
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402e084e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402e086e
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402e088e
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x1402e08c6
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1402e08e4
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1402e0902
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1402f5720
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140100d80
movzx eax, al
test eax, eax
jne 0x1402f5740
mov ecx, 7
call fcn.1400ffddb
nop
mov byte [rsp + 0x20], 0
call fcn.1400fff5c
mov byte [rsp + 0x21], al
cmp dword [0x1404ea4e0], 1
jne 0x1402f5764
mov ecx, 7
call fcn.1400ffddb
nop
jmp 0x1402f57bc
cmp dword [0x1404ea4e0], 0
jne 0x1402f57b7
mov dword [0x1404ea4e0], 1
lea rdx, [0x140306840]
lea rcx, [0x140306510]
call fcn.1400fe2c4
test eax, eax
je 0x1402f5798
mov eax, 0xff
jmp 0x1402f58c1
lea rdx, [0x140306400]
lea rcx, [section..rdata]
call fcn.1400ffef3
mov dword [0x1404ea4e0], 2
jmp 0x1402f57bc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400ffd0e
call fcn.1400ff507
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1402f5819
mov rcx, qword [rsp + 0x30]
call fcn.1400fdc7a
movzx eax, al
test eax, eax
je 0x1402f5819
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140506020]
nop
call fcn.1400ff85e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1402f584d
mov rcx, qword [rsp + 0x38]
call fcn.1400fdc7a
movzx eax, al
test eax, eax
je 0x1402f584d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14010083a
nop
call fcn.1402f5930
mov dword [rsp + 0x28], eax
call fcn.1400ff340
movzx eax, al
test eax, eax
jne 0x1402f586c
mov ecx, dword [rsp + 0x28]
call fcn.1400fc50f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1402f587b
call fcn.140100916
nop
xor edx, edx
mov cl, 1
call fcn.1400fdaf4
mov eax, dword [rsp + 0x28]
jmp 0x1402f58c1
add rsp, 0x68
ret
Function at 0x14151e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14151e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14151e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14151e0c7
add dl, dl
jne 0x14151e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14151e14e
xor eax, eax
add dl, dl
jne 0x14151e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14151e205
add dl, dl
jne 0x14151e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14151e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14151e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14151e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14151e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14151e0d6
mov eax, 1
add dl, dl
jne 0x14151e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14151e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14151e153
sub eax, ebx
mov ebx, 1
jne 0x14151e1a4
mov ecx, 1
add dl, dl
jne 0x14151e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14151e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14151e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14151e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14151e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14151e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14151e1b5
cmp eax, 0x7d00
jae 0x14151e1f3
cmp eax, 0x500
jb 0x14151e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14151e0d6
cmp eax, 0x7f
ja 0x14151e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14151e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14151e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14151e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141c67058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141c671df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c67089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c6706f
add dl, dl
jne 0x141c67096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c670f6
xor eax, eax
add dl, dl
jne 0x141c670a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c671ad
add dl, dl
jne 0x141c670b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c670c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c670d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c670dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c670ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c6707e
mov eax, 1
add dl, dl
jne 0x141c67106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c67113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c670fb
sub eax, ebx
mov ebx, 1
jne 0x141c6714c
mov ecx, 1
add dl, dl
jne 0x141c6712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c6713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c67123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c6707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c67168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c67175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c6715d
cmp eax, 0x7d00
jae 0x141c6719b
cmp eax, 0x500
jb 0x141c67196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c6707e
cmp eax, 0x7f
ja 0x141c6719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c6707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c671d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c6707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400bd4a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400bd4b0]
mov dword [rax], 1
mov rax, qword [0x1400bd4c0]
mov dword [rax], 1
mov rax, qword [0x1400bd450]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400bd490]
mov dword [0x1400d100c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400bd570]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400bd550]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [str.pq_t_]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140002e60
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x140002ec3
lea rsi, [rbp - 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rbp + 0x16c], eax
test eax, eax
jne 0x140002ecf
lea rax, [0x14009491c]
mov qword [rdi], rax
add rsp, 0x1f0
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.library_std_src_synconce.rs
call sym.core::option::unwrap_failed::h511674c62460528b
mov qword [rbp + 0x138], 0
lea rdx, [0x14009f188]
lea r9, [0x14009f190]
lea rcx, [rbp + 0x16c]
lea r8, [rbp + 0x138]
call dbg.assert_failed<i32, i32>
int3

Function at 0x1400209b0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x140021d40
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140021dd0
jmp 0x140021dbf
jae 0x140021e8b
cmp r8, 0x201
jae 0x140021dd0
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x140021e27
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140021dff
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call dbg.do_reserve_and_handle<core::mem::maybe_uninit::MaybeUninit<u16>, alloc::alloc::Global>
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140021e4d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140021ef7
mov r8d, r13d
cmp r12, r8
jne 0x140021db0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140021f2a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140021dbf
jmp 0x140021dd0
cmp r14, r8
jb 0x140021f44
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call dbg.from_wide
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x140021ee0
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x140021ecb
jmp 0x140021ee0
lea rcx, [0x14009b650]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call dbg.panic
jmp 0x140021f59
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call dbg.slice_end_index_len_fail
ud2
Function at 0x140021f90
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x140021faf
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::he2dbf906bfd27f01]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call dbg.panic_fmt
ud2