joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400118b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, qword [0x140020bd0]
mov rdi, qword [0x140020bf0]
lea rsi, [0x1400202a0]
movq xmm0, rsi
mov rcx, qword [rbx]
movq xmm6, rdi
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140011906
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140011930
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140020be0]
cmp byte [rax], 0
jne 0x140011940
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400118fd
mov edx, 0x414
lea r12, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x28], 3
mov rcx, r12
mov ebx, 0x14
mov word [rsp + 0x40], dx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400119f4
test al, 0x10
je 0x140011912
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140011912
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x1400119a0
jmp 0x140011912

Function at 0x140015960
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001c860
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001c860
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x140016612
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140036228]
test eax, eax
je 0x1400166aa
lea rax, [0x140036200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140036230]
mov qword [rbp - 8], rax
jmp 0x14001668e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140016682
cmp qword [rbp - 0x10], 0
je 0x140016682
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140016648
lea rax, [0x140036200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400166ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400167b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400167d8
mov eax, 0
jmp 0x140016826
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140016801
mov eax, 0
jmp 0x140016826
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140016821
mov eax, 0
jmp 0x140016826
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14001682c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400168aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400168a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400168a1
mov rax, qword [rbp - 8]
jmp 0x1400168bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140016874
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400078e4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400076e0
Function at 0x14000cc3c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000cc6c
xor eax, eax
jmp 0x14000cd2f
mov rbp, rbx
cmp word [rax], si
je 0x14000cc91
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000cc78
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000cc74
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000cb5c
movsxd r14, eax
test eax, eax
jne 0x14000cccf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000cc65
mov rcx, r14
call fcn.1400093f0
mov rdi, rax
test rax, rax
jne 0x14000cce8
xor ecx, ecx
call fcn.140008778
jmp 0x14000ccc4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000cb5c
test eax, eax
jne 0x14000cd19
mov rcx, rdi
call fcn.140008778
jmp 0x14000cd23
xor ecx, ecx
call fcn.140008778
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001104c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140011062
mov al, 1
jmp 0x1400110c2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140011073
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400110c0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d55c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400110c0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400110c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400110c0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400110c2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140012100
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000bc2c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001218a
cmp byte [rbp - 0x21], r15b
je 0x140012185
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400121c0
call fcn.1400089c8
test eax, eax
jne 0x1400121ac
cmp byte [rbp - 0x21], r15b
je 0x1400121a4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400121c0
cmp byte [rbp - 0x21], r15b
je 0x1400121bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000b20c
test eax, eax
jne 0x140012260
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000bc2c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400121ff
cmp byte [rbp - 0x21], r15b
je 0x140012234
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012234
call fcn.1400089c8
test eax, eax
jne 0x140012220
cmp byte [rbp - 0x21], r15b
je 0x140012219
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012234
cmp byte [rbp - 0x21], r15b
je 0x140012231
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000b20c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140012260
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140012263
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140012271
mov rcx, rdi
call fcn.140008778
cmp byte [rbp + 0x3f], r15b
je 0x140012280
mov rcx, qword [rbp + 0x27]
call fcn.140008778
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003a000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r9b, byte [rcx + 0x100]
mov al, byte [rcx + 0x101]
inc r9b
movzx r9d, r9b
xor r10d, r10d
cmp r8, r10
je 0x14003a05d
lea r11d, [r9 + r10]
mov byte [rcx + 0x100], r11b
movzx r11d, r11b
mov bl, byte [rcx + r11]
add al, bl
mov byte [rcx + 0x101], al
movzx esi, al
mov dil, byte [rcx + rsi]
mov byte [rcx + r11], dil
mov byte [rcx + rsi], bl
add bl, byte [rcx + r11]
movzx r11d, bl
mov r11b, byte [rcx + r11]
xor byte [rdx + r10], r11b
inc r10
jmp 0x14003a01a
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003a061
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp + 0x10]
mov rcx, rdi
call fcn.1400bf2b0
mov al, byte [rdi + 0x18]
mov byte [rbp + 0x47], al
cmp al, 2
jne 0x14003a0b2
lea rdx, str.Could_not_get_current_directory127.0.0.10.0.0.0:08.8.8.8:53Mozilla_5.0__Windows_NT_.0__WOW64__AppleWebKit___KHTML__like_Gecko__Chrome_104.0._Safari__Edg_104.0.
push 0x1f
pop r8
mov rcx, rsi
call fcn.140006e0e
lea rcx, [rbp + 0x10]
call fcn.14000b48f
jmp 0x14003a12b
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
lea rcx, [rbp - 0x28]
mov qword [rbp + 0x30], rdx
mov qword [rcx], rdx
mov qword [rcx + 8], rax
lea rax, [rbp - 0x18]
mov qword [rax], rcx
lea rcx, [fcn.1400cd2c0]
lea r8, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea rdx, [rbp - 0x58]
mov qword [rdx + 0x10], r8
push 1
pop r8
mov qword [rdx + 0x18], r8
and qword [rdx], 0
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp + 0x38], rcx
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], r8
lea rcx, [rbp - 8]
call fcn.14000f4d9
mov rax, qword [rbp + 8]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 8]
movups xmmword [rsi], xmm0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.140040690
nop
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003aa50
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
push rsi
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov rsi, rcx
call fcn.14007bc1b
push 5
pop rdx
push reloc.WS2_32.dll_ioctlsocket
pop r8
mov qword [rbp + 0x88], rax
mov rcx, rax
call fcn.14000f37c
mov dword [rbp + 0x84], eax
push 0x64
pop rdx
mov rcx, qword [rbp + 0x88]
mov r8d, 0x29a
call fcn.14000f37c
mov dword [rbp + 0x80], eax
push reloc.WS2_32.dll_ioctlsocket
pop rdx
push 0x63
pop r8
mov rcx, qword [rbp + 0x88]
call fcn.14000f37c
mov dword [rbp + 0x7c], eax
push 0x64
pop rdx
push WSAGetLastError
pop r8
mov rcx, qword [rbp + 0x88]
call fcn.14000f37c
mov dword [rbp + 0x78], eax
mov rcx, qword [rbp + 0x88]
mov edx, 0x1388
mov r8d, 0x1450
call fcn.14000f37c
mov dword [rbp + 0x74], eax
push 0x64
pop rdx
push WSAGetLastError
pop r8
mov rcx, qword [rbp + 0x88]
call fcn.14000f37c
mov dword [rbp + 0x70], eax
push 0x64
pop rdx
mov rcx, qword [rbp + 0x88]
mov r8d, 0x29a
call fcn.14000f37c
mov dword [rbp + 0x6c], eax
push reloc.WS2_32.dll_ioctlsocket
pop rdx
push 0x63
pop r8
mov rcx, qword [rbp + 0x88]
call fcn.14000f37c
mov dword [rbp + 0x68], eax
mov rcx, qword [rbp + 0x88]
mov edx, 0x1388
mov r8d, 0x1450
call fcn.14000f37c
lea rcx, [rbp + 0x64]
mov dword [rcx], eax
lea rdx, [rbp + 0x84]
lea rax, [rbp - 0x60]
mov qword [rax], rdx
lea r8, [0x14004cfa0]
mov qword [rax + 8], r8
lea rdx, [rbp + 0x80]
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
lea rdx, [rbp + 0x7c]
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], r8
lea rdx, [rbp + 0x78]
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], r8
lea rdx, [rbp + 0x74]
mov qword [rax + 0x40], rdx
mov qword [rax + 0x48], r8
lea rdx, [rbp + 0x70]
mov qword [rax + 0x50], rdx
mov qword [rax + 0x58], r8
lea rdx, [rbp + 0x6c]
mov qword [rax + 0x60], rdx
mov qword [rax + 0x68], r8
lea rdx, [rbp + 0x68]
mov qword [rax + 0x70], rdx
mov qword [rax + 0x78], r8
lea r9, [0x140133fc8]
lea rdx, [rbp + 0x30]
mov qword [rdx + 0x10], r9
push 9
pop r9
mov qword [rdx + 0x18], r9
and qword [rdx], 0
mov qword [rax + 0x80], rcx
mov qword [rax + 0x88], r8
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], r9
mov rcx, rsi
call fcn.14000f4d9
mov rcx, qword [rbp + 0x88]
call fcn.14007acf1
nop
add rsp, 0x118
pop rsi
pop rbp
ret
Function at 0x14003be4f
Capabilities:
Delete directory
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.1400c97b0
cmp dword [r14], 2
je 0x14003bf86
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
mov edx, eax
shr edx, 0xa
shr ecx, 0x1d
and ecx, edx
test cl, 1
jne 0x14003bef7
and eax, 0x10
je 0x14003bef7
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1400be2a0
mov r15, qword [r14]
mov rax, qword [r14 + 8]
test rax, rax
je 0x14003bf67
lea rdx, [rsp + 0x20]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], r15
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
lea rdi, [rsp + 0x68]
mov rcx, rdi
mov r8b, 1
call fcn.1400c6cf0
mov r15, qword [rdi]
mov rdi, qword [rdi + 8]
test rdi, rdi
je 0x14003bf67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14003bf4f
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1400be2a0
mov r15, qword [r14]
mov rax, qword [r14 + 8]
test rax, rax
je 0x14003bf67
lea rdx, [rsp + 0x20]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], r15
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
lea rdi, [rsp + 0x68]
mov rcx, rdi
mov r8b, 1
call fcn.1400c6cf0
mov r15, qword [rdi]
mov rdi, qword [rdi + 8]
test rdi, rdi
je 0x14003bf67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14003bf8d
test r15, r15
je 0x14003bf6f
mov edx, 2
mov rcx, rdi
call fcn.140040300
jmp 0x14003bf6f
mov rbx, r15
test r15, r15
jne 0x14003bfae
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x28]
jmp 0x14003bfb1
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test r15, r15
je 0x14003bfae
mov edx, 2
mov rcx, rdi
call fcn.140040300
mov rcx, rbx
call fcn.14012b095
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14003bf75
Function at 0x14003bfbe
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
lea rbx, [rbp - 0x18]
mov rcx, rbx
call fcn.1400be2a0
mov r12, qword [rbx]
mov rax, qword [rbx + 8]
test rax, rax
je 0x14003c129
lea rdx, [rbp - 0x18]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], r12
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
lea rbx, [rbp - 0x30]
mov rcx, rbx
mov r8b, 1
call fcn.1400c6cf0
mov r12, qword [rbx]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14003c129
mov r8, qword [rbp + 0x70]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x18]
mov rdx, r15
call fcn.1400be2a0
mov r13, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x14003c12e
lea rdx, [rbp - 0x18]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], r13
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
lea rcx, [rbp - 0x30]
mov r8b, 1
call fcn.1400c6cf0
mov r13, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
test r15, r15
je 0x14003c12e
lea r9, [rbp - 0x18]
and qword [r9], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [0x1400dc910]
mov rcx, rbx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x14003c164
test r13, r13
je 0x14003c0da
push 2
pop rdx
mov rcx, r15
call fcn.140040300
mov r15b, byte [rbp + 0x78]
test r12, r12
je 0x14003c0ee
push 2
pop rdx
mov rcx, rbx
call fcn.140040300
test r15b, r15b
je 0x14003c116
lea rbx, [rbp - 0x18]
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.14003be4f
cmp byte [rbx], 0
je 0x14003c11d
mov rax, qword [rbp - 0x10]
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14003c125
mov word [rsi], 0x100
jmp 0x14003c150
mov al, byte [rbp - 0x17]
mov byte [rsi + 1], al
xor eax, eax
mov byte [rsi], al
jmp 0x14003c150
mov rdi, r12
jmp 0x14003c141
mov rdi, r13
test r12, r12
je 0x14003c141
push 2
pop rdx
mov rcx, rbx
call fcn.140040300
mov rcx, rdi
call fcn.14012b095
mov qword [rsi + 8], rax
mov byte [rsi], 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test r13, r13
je 0x14003c131
push 2
pop rdx
mov rcx, r15
call fcn.140040300
jmp 0x14003c131
Function at 0x14004a7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14004a840
cmp r10, r11
jb 0x14004a8b6
cmp r10, rdx
ja 0x14004a8ca
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14004a842
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14004a820
jmp 0x14004a8a4
ja 0x14004a84a
mov r11, r10
cmp rax, r8
jne 0x14004a7e4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14004a880
mov rdi, r8
sub ecx, edx
jns 0x14004a89b
jmp 0x14004a8a6
cmp r8, rsi
je 0x14004a8db
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14004a8a6
xor al, 1
cmp rdi, rsi
jne 0x14004a860
jmp 0x14004a8a6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14012bbd0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14012b9b0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14012b9c0
ud2
Function at 0x14004d7f5
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x14013eeb0]
mov ebx, 0xff
lea rsi, str.C:UsersAdministrator.WIN7_2021OVWRCZ.cargo_registry_srcmirrors.ustc.edu.cn_12df342d903acd47crc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x14004d925
mov r14d, 4
sub r14, 1
jb 0x14004d81a
cmp r9, 0xf
jbe 0x14004d952
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.14004de39
mov r9, rdx
mov ecx, ebp
jmp 0x14004d82a
xor edx, edx
cmp r9, rdx
je 0x14004d943
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x14004d927
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:UsersAdministrator.WIN7_2021OVWRCZ.cargo_registry_srcmirrors.ustc.edu.cn_12df342d903acd47crc32fast_1.3.2_src_baseline.rs
mov ecx, send
mov rdx, r9
call fcn.14012b920
ud2
Function at 0x140050f9f
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test rdi, rdi
je 0x140051014
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call r13
cmp eax, 0xc0000000
jb 0x140050fc9
mov ebp, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x140050fc9
add ebp, 0x80000000
mov eax, ebp
jmp 0x140051016
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400576b0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp - 4]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x140057754
mov rdi, rax
lea rbx, [rbp - 0x20]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd rax, dword [rbp - 4]
lea r12, [rdi + rax*8]
lea r14, [rbp - 0x38]
mov r13, rdi
cmp r13, r12
je 0x14005773b
mov r15, qword [r13]
mov rcx, r15
call fcn.1401210f8
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140051ed4
mov rcx, rbx
mov rdx, r14
call fcn.140057a1b
add r13, 8
jmp 0x14005770b
mov rcx, rdi
call fcn.14011d05d
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
jmp 0x140057765
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret