joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4e50
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14014fbb1]
mov ecx, 0x10
mov edx, 8
call fcn.140078bb0
test rax, rax
je 0x1400b4f2f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b4fc0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400b4f21
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400b4ef8
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140078bc0
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.140078bc0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400fce30
ud2

Function at 0x1400b9f20
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1400b9f75
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400ba011
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1400b9f89
cmp eax, 0x2739
jne 0x1400b9fda
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1400b9fd4
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1400b9fef
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1400ba011
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400ba011
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ba680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
movzx ebp, byte [rdx + 0x38]
cmp bpl, 1
ja 0x1400ba6dd
movzx ebx, byte [rdi + 0x3a]
mov rcx, rdi
call fcn.1400ba560
test bpl, bpl
jne 0x1400ba6e1
lea rcx, [rdi + 0x10]
xor r8d, r8d
cmp byte [rdi + 0x10], 6
cmove rcx, r8
je case.0x1400ba6d1.2
movzx edx, byte [rcx]
mov r8d, 6
lea r9, [0x1400ba854]
movsxd rdx, dword [r9 + rdx*4]
add rdx, r9
jmp rdx
mov r8, qword [rcx + 0x10]
add r8, 4
jmp case.0x1400ba6d1.2
xor eax, eax
xor ebx, ebx
xor r8d, r8d
movzx r10d, bl
movzx ebx, al
lea rcx, [r10 + rbx]
add rcx, r8
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1400ba838
mov r11, qword [rdi]
lea rax, [r11 + rcx]
cmp rdx, rcx
jne 0x1400ba718
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400ba799
movzx r9d, byte [rdi + 0x10]
add r8, rbx
add r8, r10
sub r8, rdx
inc r8
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400ba760
nop dword [rax]
cmp byte [rdi], 0x5c
je 0x1400ba77b
inc r8
dec rdi
cmp r8, 1
jne 0x1400ba740
jmp 0x1400ba799
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400ba77b
cmp ebx, 0x5c
je 0x1400ba77b
inc r8
dec rdi
cmp r8, 1
jne 0x1400ba760
jmp 0x1400ba799
neg r8
add rcx, r8
inc rcx
cmp rdx, rcx
jb 0x1400ba846
add r11, rcx
mov r10d, 1
mov rax, r11
sub rdx, rcx
je 0x1400ba7c2
mov cl, 9
cmp rdx, 2
je 0x1400ba7c6
cmp rdx, 1
jne 0x1400ba7d5
cmp byte [rax], 0x2e
jne 0x1400ba7d5
xor ecx, ecx
cmp r9b, 3
setae cl
lea ecx, [rcx + rcx*2]
add ecx, 7
jmp 0x1400ba7d5
mov cl, 0xa
jmp 0x1400ba7d5
cmp byte [rax], 0x2e
jne 0x1400ba7d5
cmp byte [rax + 1], 0x2e
sete cl
xor cl, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], cl
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea r8, [rcx + 1]
test rcx, rcx
cmove r8, rcx
add r8, rdx
add r8, 8
jmp case.0x1400ba6d1.2
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea r8, [rcx + 1]
test rcx, rcx
cmove r8, rcx
add r8, rdx
add r8, 2
jmp case.0x1400ba6d1.2
mov r8d, 2
jmp case.0x1400ba6d1.2
lea r8, str.library_std_srcpath.rs
call fcn.1400fd440
ud2
lea r8, str.library_std_srcpath.rs
call fcn.1400fd440
ud2

Function at 0x1400be0d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x1400be106
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400be116
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x1400bfa00
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x1400bfae4
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx]
lea rax, [0x1400bfb00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1400bfab9
mov rbx, qword [sym.imp.kernel32.dll_SleepEx]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call rbx
cmp dword [rsp + 0x30], 0
je 0x1400bfa80
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x1400bfac1
mov eax, dword [rsp + 0x38]
add rsi, rax
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
xor eax, eax
jmp 0x1400bfadc
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov rsi, rcx
shl rsi, 0x20
or rsi, 2
call fcn.1400ca740
mov ecx, eax
xor eax, eax
cmp cl, 0xb
cmovne rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x14010bef0]
mov rcx, rsi
call fcn.1400fd440
ud2

Function at 0x1400c0160
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400c0281
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400c0198
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400c0244
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400c0263
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1400c01ee
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x1400c0221
jmp 0x1400c0216
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
movabs rcx, 0x3e500000000
cmp rax, rcx
je 0x1400c021c
movabs rcx, 0x6d00000000
cmp rax, rcx
jne 0x1400c0238
mov byte [rsi + 1], 0
jmp 0x1400c022c
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1400c022e
mov r8d, 0x10
mov rcx, rbx
call fcn.1400f9190
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x1400c01a5
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400f9190
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x1400c01a5
mov qword [rsp + 0x30], 0
lea rax, str.library_std_src_syswindowspipe.rs
mov qword [rsp + 0x20], rax
lea r8, [0x14010bf08]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rdi
call fcn.1400fc070
ud2
Function at 0x1400c5e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x10], xmm6
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.1400cadf0
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
test rcx, rcx
je 0x1400c5e83
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.1400ca660
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400c5e7f
movdqu xmm6, xmmword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c5ef8
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x1400c5ee6
mov rax, qword [rbp - 0x20]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400c5edf
test rcx, rcx
je 0x1400c5edf
lea rcx, [rax - 1]
mov qword [rbp - 0x10], rcx
mov rcx, qword [rax - 1]
mov rax, qword [rax + 7]
mov qword [rbp], rcx
mov qword [rbp - 8], rax
call qword [rax]
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c5ecb
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp]
call fcn.140078bc0
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 0x10]
call fcn.140078bc0
mov qword [rsi], 0
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov qword [rsi], 0
movq rdx, xmm6
test rdx, rdx
je 0x1400c5ee6
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140078bc0
jmp 0x1400c5ee6
Function at 0x1400cb710
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov rax, qword [rdx]
mov qword [rbp + 0x3c0], rax
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400cb7b0
jmp 0x1400cb79f
jae 0x1400cb876
cmp r8, 0x201
jae 0x1400cb7b0
mov r15d, 0x200
lea rdi, [rbp - 0x60]
mov r12, r8
jmp 0x1400cb808
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400cb7df
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.1400f9b80
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r14, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3d8], r13
mov rbx, r14
mov r15, r13
mov rdi, qword [rbp + 0x3e8]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x3c0]
mov rdx, rdi
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400cb837
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400cb8de
mov r8d, esi
cmp r12, r8
jne 0x1400cb790
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400cb901
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400cb79f
jmp 0x1400cb7b0
cmp r15, r8
jb 0x1400cb91b
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
call fcn.1400b7140
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r14, r14
je 0x1400cb8c7
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r14
call fcn.140078bc0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r14, r14
jne 0x1400cb8af
jmp 0x1400cb8c7
lea rcx, [0x14010d130]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400fd010
jmp 0x1400cb930
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400fd4c0
ud2
Function at 0x1400cbe40
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov qword [rbp + 0x3b8], rcx
mov qword [rbp + 0x3a0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a8], xmm0
mov r14d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor eax, eax
mov qword [rbp + 0x3c0], rax
xor ebx, ebx
xor r15d, r15d
cmp r14, 0x201
jae 0x1400cbed0
jmp 0x1400cbebf
jae 0x1400cbf9c
cmp r14, 0x201
jae 0x1400cbed0
mov esi, 0x200
lea r13, [rbp - 0x60]
mov r12, r14
jmp 0x1400cbf39
sub r14, r15
sub rbx, r15
cmp rbx, r14
mov rbx, qword [rbp + 0x3c0]
jae 0x1400cbf09
lea rcx, [rbp + 0x3a0]
mov rdx, r15
mov r8, r14
call fcn.1400f9b80
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x3c8], rax
mov rbx, qword [rbp + 0x3a8]
mov eax, 0xffffffff
cmp rbx, rax
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rbp + 0x3b0], r15
mov rax, rbx
mov qword [rbp + 0x3c0], rbx
mov rsi, r15
mov r13, qword [rbp + 0x3c8]
mov r12, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
jne 0x1400cbf5d
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400cbfcf
mov r14d, edi
cmp r12, r14
jne 0x1400cbeb0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400cc05c
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r14, r12
cmp r14, 0x201
jb 0x1400cbebf
jmp 0x1400cbed0
cmp rsi, r14
jb 0x1400cc076
test edi, edi
je 0x1400cbffd
lea rsi, [r14 + r14]
movzx eax, byte [0x14014fbb1]
mov edx, 2
mov rcx, rsi
call fcn.140078bb0
test rax, rax
je 0x1400cc08a
mov rdi, rax
jmp 0x1400cc004
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3b8]
mov qword [rsi + 8], rax
mov qword [rsi], 0
mov rdx, qword [rbp + 0x3c0]
test rdx, rdx
jne 0x1400cc030
jmp 0x1400cc045
mov edi, 2
xor esi, esi
mov rcx, rdi
mov rdx, r13
mov r8, rsi
call fcn.1400f7010
mov rsi, qword [rbp + 0x3b8]
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
mov rdx, qword [rbp + 0x3c0]
test rdx, rdx
je 0x1400cc045
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3c8]
call fcn.140078bc0
mov rax, rsi
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14010d130]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400fd010
jmp 0x1400cc097
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r14
mov rdx, rsi
call fcn.1400fd4c0
jmp 0x1400cc097
mov ecx, 2
mov rdx, rsi
call fcn.1400fce30
ud2
Function at 0x1400cc0e0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3c0], rdx
mov qword [rbp + 0x400], rcx
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400cc170
jmp 0x1400cc15f
jae 0x1400cc230
cmp r8, 0x201
jae 0x1400cc170
mov esi, 0x200
lea rdi, [rbp - 0x58]
mov r12, r8
jmp 0x1400cc1c8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400cc19f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.1400f9b80
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x408], rax
mov r14, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3f8], r13
mov rbx, r14
mov rsi, r13
mov rdi, qword [rbp + 0x408]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rdi
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
jne 0x1400cc1f1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400cc317
mov r8d, r15d
cmp r12, r8
jne 0x1400cc150
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400cc33e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400cc15f
jmp 0x1400cc170
cmp rsi, r8
jb 0x1400cc358
mov rax, qword [rbp + 0x3c0]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1400b7140
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x3c8]
call fcn.1400bb320
cmp byte [rsi], 0
jne 0x1400cc287
lea rdx, [0x14010d238]
lea rcx, [rbp + 0x3c8]
mov r8d, 3
call fcn.1400bbe20
mov rdx, qword [rbp + 0x3c8]
mov r8, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x3a8]
call fcn.1400c5e00
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x1400cc2bf
mov rcx, qword [rbp + 0x3c8]
mov r8d, 1
call fcn.140078bc0
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r14, r14
je 0x1400cc300
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x408]
mov rdx, r14
call fcn.140078bc0
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r14, r14
jne 0x1400cc2e8
jmp 0x1400cc300
lea rcx, [0x14010d130]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400fd010
jmp 0x1400cc36d
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400fd4c0
ud2
Function at 0x1400cc400
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3c0], rdx
mov qword [rbp + 0x400], rcx
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400cc490
jmp 0x1400cc47f
jae 0x1400cc550
cmp r8, 0x201
jae 0x1400cc490
mov esi, 0x200
lea rdi, [rbp - 0x58]
mov r12, r8
jmp 0x1400cc4e8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400cc4bf
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.1400f9b80
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x408], rax
mov r14, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rbp + 0x3f8], r13
mov rbx, r14
mov rsi, r13
mov rdi, qword [rbp + 0x408]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rdi
mov edx, r12d
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov r15d, eax
test eax, eax
jne 0x1400cc511
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400cc637
mov r8d, r15d
cmp r12, r8
jne 0x1400cc470
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400cc65e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400cc47f
jmp 0x1400cc490
cmp rsi, r8
jb 0x1400cc678
mov rax, qword [rbp + 0x3c0]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1400b7140
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x3c8]
call fcn.1400bb320
cmp byte [rsi], 0
jne 0x1400cc5a7
lea rdx, [0x14010d238]
lea rcx, [rbp + 0x3c8]
mov r8d, 3
call fcn.1400bbe20
mov rdx, qword [rbp + 0x3c8]
mov r8, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x3a8]
call fcn.1400c5e00
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x1400cc5df
mov rcx, qword [rbp + 0x3c8]
mov r8d, 1
call fcn.140078bc0
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r14, r14
je 0x1400cc620
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x408]
mov rdx, r14
call fcn.140078bc0
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x400]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r14, r14
jne 0x1400cc608
jmp 0x1400cc620
lea rcx, [0x14010d130]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400fd010
jmp 0x1400cc68d
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400fd4c0
ud2
Function at 0x1400cd1f0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400cd280
jmp 0x1400cd26f
jae 0x1400cd340
cmp r8, 0x201
jae 0x1400cd280
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400cd2d8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400cd2af
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400f9b80
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400cd301
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400cd3a8
mov r8d, r14d
cmp r15, r8
jne 0x1400cd260
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400cd3cb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400cd26f
jmp 0x1400cd280
cmp rsi, r8
jb 0x1400cd3e5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400b7140
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400cd391
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140078bc0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400cd379
jmp 0x1400cd391
lea rcx, [0x14010d130]
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400fd010
jmp 0x1400cd3fa
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400fd4c0
ud2

Function at 0x1400cf770
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400cf7a8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400cf7c0
nop
add rsp, 0x38
ret