joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140dbe41d
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140764ad9
Function at 0x10000b650
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
bt eax, 0x1f
jb 0x10000b699
cmp al, 6
jb 0x10000b699
lea rcx, [0x100002b18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x10000b699
lea rdx, [0x100002b38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10000b699
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call rax
add rsp, 0x28
ret

Function at 0x10000df10
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x10000e067
lea rdx, [0x1000016a0]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x10000e033
lea r8d, [rbx + 0x1c]
lea rcx, [rsp + 0x20]
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x10000dfd4
mov dword [rsp + 0x24], 4
jmp 0x10000dfa7
mov eax, esi
inc esi
cmp eax, 5
jge 0x10000dfc4
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x10000dfc8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10000df95
mov eax, dword [rsp + 0x24]
cmp eax, 1
je 0x10000e012
mov ebx, 0x80004005
jmp 0x10000e028
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ebx, eax
sub edx, 0x41c
je 0x10000e009
sub edx, 8
je 0x10000e005
sub edx, 2
je 0x10000e005
cmp edx, 0xf
je 0x10000e005
lea rcx, [0x1000031c0]
mov edx, eax
call fcn.10000a84c
jmp 0x10000e00e
xor ebx, ebx
jmp 0x10000e012
mov ebx, 0x652
test ebx, ebx
jne 0x10000e028
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, 1
je 0x10000e028
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000e05c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov ebx, eax
sub ecx, 0x424
je 0x10000e05a
cmp ecx, 0xc
je 0x10000e05a
lea rcx, [0x1000031f0]
mov edx, eax
call fcn.10000a84c
jmp 0x10000e05c
xor ebx, ebx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000e07d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100003218]
mov edx, eax
mov ebx, eax
call fcn.10000a84c
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100017289
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1000172a7
je 0x1000172b2
call 0x100017301
mov bl, reloc.msi.dll_MsiProvideQualifiedComponentExW
lahf
pop rsi
jne 0x100017292
call 0x1000172aa
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x100017292
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1000172e0
je 0x10001731e
invalid
je 0x10001732f
jne 0x100017292
lea rax, [0x1000171b8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], MsiOpenDatabaseW
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, MsiGetPropertyW
call rax
mov rcx, 0x4615
lea r9, [0x100012f19]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1000173d0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x100017429
je 0x10001742f
call 0x100017420
fild qword [rdi - 0x7c]
jmp 0x134f53ba2
jne 0x1000173f2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1000173b2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x100017301
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1000172a7
je 0x1000172b2
call 0x100017301
mov bl, reloc.msi.dll_MsiProvideQualifiedComponentExW
lahf
pop rsi
jne 0x100017292
call 0x1000172aa
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x100017292
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1000172e0
je 0x10001731e
invalid
je 0x10001732f
jne 0x100017292
lea rax, [0x1000171b8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], MsiOpenDatabaseW
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, MsiGetPropertyW
call rax
mov rcx, 0x4615
lea r9, [0x100012f19]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1000173d0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x100017429
je 0x10001742f
call 0x100017420
fild qword [rdi - 0x7c]
jmp 0x134f53ba2
jne 0x1000173f2
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1000173b2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x100017748
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100017795
cmp rcx, 0xffffffffffffffff
je 0x100017795
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10001778d
cmp dword [rcx + 0x3c], edx
jl 0x10001778d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10001778d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100017795
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140014850
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015ba0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015bc0
xor al, al
jmp 0x140015c41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015bd3
xor al, al
jmp 0x140015c41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015bfd
xor al, al
jmp 0x140015c41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015c11
xor al, al
jmp 0x140015c41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015c23
xor al, al
jmp 0x140015c41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015c3f
xor al, al
jmp 0x140015c41
mov al, 1
add rsp, 0x38
ret
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call fcn.100158000
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10000c1e0
add rsp, 0x28
jmp 0x10000bae0
Function at 0x140003b50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003be0
jmp 0x140003bcf
jae 0x140003ca0
cmp r8, 0x201
jae 0x140003be0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003c38
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140003c0f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001a6b0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003c61
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003d08
mov r8d, r14d
cmp r15, r8
jne 0x140003bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003d2b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003bcf
jmp 0x140003be0
cmp rsi, r8
jb 0x140003d45
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140005890
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140003cf1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400011b0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140003cd9
jmp 0x140003cf1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_d5c2e9c342b358556da91d61ed4133f6f50fc0c3library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001b060
jmp 0x140003d5a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001b4b0
ud2
Function at 0x140006290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400062c0
test ecx, ecx
jne 0x140006310
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1400062cc
test ecx, ecx
jne 0x140006310
mov rcx, rdi
call fcn.140006170
movzx eax, al
test bpl, bpl
jne 0x140006317
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140006303.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140006488]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140006303.2
xor eax, eax
test bpl, bpl
je 0x1400062dc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140006469
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14000634a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400063c9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140006390
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1400063ab
inc rax
dec rdi
cmp rax, 1
jne 0x140006370
jmp 0x1400063c9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400063ab
cmp ebx, 0x5c
je 0x1400063ab
inc rax
dec rdi
cmp rax, 1
jne 0x140006390
jmp 0x1400063c9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140006477
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x1400063f3
mov al, 9
cmp rdx, 2
je 0x1400063f7
cmp rdx, 1
jne 0x140006407
cmp byte [r8], 0x2e
jne 0x140006407
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140006407
mov al, 0xa
jmp 0x140006407
cmp byte [r8], 0x2e
jne 0x140006407
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140006303.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140006303.2
mov ecx, 2
jmp case.0x140006303.2
lea r8, str.library_std_srcpath.rs
call fcn.14001b430
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001b430
ud2
Function at 0x14000a900
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001d960]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000a944
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000a9aa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000a9e1
test eax, eax
js 0x14000a9bb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000a9d4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400054c0
mov rcx, rax
call fcn.140001980
mov ecx, 7
int 0x29
ud2

Function at 0x1400184e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001855a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140018550
cmp r10, r11
jb 0x1400185f3
cmp r10, rdx
ja 0x140018607
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140018552
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140018530
jmp 0x1400185c7
ja 0x14001855a
mov r11, r10
cmp rax, r8
jne 0x140018502
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400185cb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400185a0
mov r8, r10
sub ecx, r9d
jns 0x1400185be
jmp 0x1400185cd
cmp r10, rdx
je 0x1400185d9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400185cd
xor al, 1
cmp r8, rdx
jne 0x140018580
jmp 0x1400185cd
xor eax, eax
jmp 0x1400185cd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001b060
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001b530
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001b4b0
ud2
Function at 0x14001a03c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a086
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a086
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a086
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a086
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a086
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a088
xor al, al
add rsp, 0x28
ret
Function at 0x140003920
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003954
cmp word [rcx], 0x5a4d
jne 0x140003954
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003954
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003954
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003860
test eax, eax
jne 0x140003970
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400038d0
test rax, rax
je 0x140003965
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000411f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004020
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003fc0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004484
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000eab8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000eab4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400044d2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400044ca
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400045b9
inc ebx
add rax, 0x28
jmp 0x1400044aa
mov rcx, r12
call fcn.140004cb1
mov rbp, rax
test rax, rax
jne 0x1400044f1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004420
movsxd rbx, ebx
mov rax, qword [0x14000eab8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004d5f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000eab8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004553
mov rax, qword [0x14000eab8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004420
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400045b3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400045b3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000eab8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400045b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004420
inc dword [0x14000eab4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret