joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c0a0
Capabilities:
Delete registry key

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rcx, 0xffffffff80000002
call fcn.14001d460
mov rbx, rax
mov qword [rbp - 8], rax
lea rax, str.SYSTEMCurrentControlSetServicesEventLogApplicationEventMessageFile
mov qword [rbp - 0x30], rax
lea rax, [0x140070f46]
mov qword [rbp - 0x28], rax
mov word [rbp - 0x20], 0
mov dword [rbp - 0x18], 1
lea rcx, [rbp - 0x48]
lea r15, [rbp - 0x30]
mov rdx, r15
call fcn.14001c850
mov qword [rbp - 0x30], 0
mov r14, qword [rbp - 0x48]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
mov r15d, eax
mov rbx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14001c14b
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.14001bd80
mov r14, r15
shl r14, 0x20
or r14, 2
test r15d, r15d
cmovne rbx, r14
je 0x14001c16f
lea rcx, [rbp - 8]
call fcn.14001d470
xor esi, esi
jmp 0x14001c1f2
mov qword [rbp - 0x10], rbx
add rsi, rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
mov word [rbp - 0x20], 0
mov dword [rbp - 0x18], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
call fcn.14001c850
mov rdi, qword [rbp - 0x48]
mov rcx, rbx
mov rdx, rdi
call sub.advapi32.dll_RegDeleteKeyW
mov esi, eax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14001c1c3
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.14001bd80
lea rcx, [rbp - 0x10]
call fcn.14001d470
mov rax, rsi
shl rax, 0x20
or rax, 2
xor r14d, r14d
xor ecx, ecx
test esi, esi
sete cl
cmovne r14, rax
lea rsi, [rcx + rcx*2]
lea rcx, [rbp - 8]
call fcn.14001d470
mov rax, rsi
mov rdx, r14
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x14001d1c0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rbp - 0x10]
mov rdx, r9
call fcn.14001d4b0
mov rdi, qword [rdi]
add rsi, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x38], 0
mov dword [rbp - 0x30], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x48]
call fcn.14001c850
movzx r9d, byte [rbp + 8]
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x10]
mov eax, dword [rbp]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001d25b
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.14001bd80
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14001d272
mov r8d, 1
mov rcx, rsi
call fcn.14001bd80
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d8a0
Capabilities:
Create service

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], 0xfffffffffffffffe
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
lea rcx, [rbp - 0x18]
mov rdx, r8
call fcn.14001e060
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001d9ef
mov dword [rbp + 0x118], edi
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
movups xmm2, xmmword [rbp + 0x10]
movups xmm3, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x80], xmm2
movaps xmmword [rbp + 0x70], xmm1
movaps xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0xc8], xmm3
movups xmm3, xmmword [rbp + 0x30]
movups xmmword [rbp + 0xd8], xmm3
movups xmm3, xmmword [rbp + 0x40]
movups xmmword [rbp + 0xe8], xmm3
movups xmm3, xmmword [rbp + 0x50]
movups xmmword [rbp + 0xf8], xmm3
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm1
movups xmmword [rbp + 0xb8], xmm2
mov qword [rbp + 0x90], rcx
mov rax, qword [rbx]
mov qword [rbp + 0x108], rax
mov rdx, qword [rbp + 0x98]
call fcn.14001d460
mov qword [rbp + 0x110], rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
call fcn.14001d460
mov rbx, rax
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0x11c], eax
mov edi, dword [rbp + 0xfc]
mov r14d, dword [rbp + 0x100]
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
call fcn.14001d460
mov r12, rax
mov r15, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x14001da1a
mov rdx, qword [rbp + 0xe0]
call fcn.14001d460
mov r13, rax
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x14001da29
mov rdx, qword [rbp + 0xf0]
call fcn.14001d460
jmp 0x14001da2b
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
movups xmm2, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x80], xmm2
movaps xmmword [rbp + 0x70], xmm1
movaps xmmword [rbp + 0x60], xmm0
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x14001daac
xor r13d, r13d
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
jne 0x14001d9e1
xor eax, eax
mov r8, rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], edi
mov eax, dword [rbp + 0x11c]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbp + 0x108]
mov rdx, qword [rbp + 0x110]
mov r9d, dword [rbp + 0x118]
call qword [sym.imp.advapi32.dll_CreateServiceW]
test rax, rax
je 0x14001da89
mov qword [rsi + 8], rax
mov dword [rsi], 8
jmp 0x14001daa0
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov dword [rsi], 7
mov qword [rsi + 8], rax
lea rcx, [rbp + 0x90]
call fcn.14001d7c0
mov rax, rsi
add rsp, 0x1a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14001fba0
Capabilities:
Stop service

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.advapi32.dll_ControlService]
test eax, eax
je 0x14001fc60
mov eax, dword [rsp + 0x24]
lea ecx, [rax - 1]
cmp ecx, 7
jae 0x14001fc7a
mov r8d, dword [rsp + 0x38]
mov ecx, 0x173
and ecx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x2c]
mov edx, 0x7ff
and edx, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x34]
xor r11d, r11d
cmp r10d, 0x42a
sete bl
jne 0x14001fc17
mov r10d, dword [rsp + 0x30]
mov r11b, bl
imul rdi, r8, 0x10624dd3
shr rdi, 0x26
imul ebx, edi, 0x3e8
sub r8d, ebx
imul r8d, r8d, 0xf4240
mov dword [rsi + 8], r11d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 0x10], 0
mov dword [rsi + 0x14], eax
mov qword [rsi + 0x18], rdi
mov dword [rsi + 0x20], r8d
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], ecx
mov dword [rsi + 0x30], edx
mov dword [rsi + 0x34], r9d
xor eax, eax
jmp 0x14001fc9f
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov dword [rsi + 8], 7
mov qword [rsi + 0x10], rax
jmp 0x14001fc9a
mov dword [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x20], eax
lea rax, str.service_status_
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0xe
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001fcb0
Capabilities:
Query service status

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdx]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, 0x24
call qword [sym.imp.advapi32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14001fda3
mov eax, dword [rsp + 0x34]
lea r9d, [rax - 1]
cmp r9d, 7
jae 0x14001fdbd
mov edx, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
mov r11d, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x44]
movsxd rdi, r9d
mov r9d, 0x173
and r9d, dword [rsp + 0x30]
lea rbx, [0x140071258]
mov r10d, 0x7ff
and r10d, dword [rsp + 0x38]
mov edi, dword [rbx + rdi*4]
xor ebx, ebx
cmp r11d, 0x42a
sete bpl
jne 0x14001fd5d
mov r11d, dword [rsp + 0x40]
mov bl, bpl
imul r14, r8, 0x10624dd3
shr r14, 0x26
imul ebp, r14d, 0x3e8
sub r8d, ebp
imul r8d, r8d, 0xf4240
mov dword [rsi + 8], ebx
mov dword [rsi + 0xc], r11d
mov dword [rsi + 0x10], edi
mov dword [rsi + 0x14], edx
mov qword [rsi + 0x18], r14
mov dword [rsi + 0x20], r8d
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], r9d
mov dword [rsi + 0x30], r10d
mov dword [rsi + 0x34], ecx
xor eax, eax
jmp 0x14001fde2
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov dword [rsi + 8], 7
mov qword [rsi + 0x10], rax
jmp 0x14001fddd
mov dword [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov dword [rsi + 0x20], eax
lea rax, str.service_status_
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0xe
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14001fe00
Capabilities:
Delete service

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rdx]
call qword [sym.imp.advapi32.dll_DeleteService]
mov ecx, 8
test eax, eax
jne 0x14001fe30
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov ecx, 7
mov dword [rsi], ecx
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140022c60
Capabilities:
Create pipe

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x40]
mov rcx, rdi
call fcn.140037e30
mov rcx, rdi
call fcn.140022f80
mov qword [rbp + 0x38], rdx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x11000
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x40], rax
mov rcx, rax
mov edx, 0x40000001
mov r8d, 8
mov r9d, 1
call sub.kernel32.dll_CreateNamedPipeA
cmp rax, 0xffffffffffffffff
je 0x140022d6b
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], 1
mov qword [rbp], rax
mov qword [rbp + 8], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, qword [rbp + 0x40]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateFileA
cmp rax, 0xffffffffffffffff
je 0x140022d7c
movaps xmm0, xmmword [rbp + 0x20]
movups xmmword [rsi + 0x60], xmm0
movaps xmm0, xmmword [rbp + 0x10]
movups xmmword [rsi + 0x50], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmm1, xmmword [rbp - 0x20]
movaps xmm2, xmmword [rbp - 0x10]
movaps xmm3, xmmword [rbp]
movups xmmword [rsi + 0x40], xmm3
movups xmmword [rsi + 0x30], xmm2
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 8], rax
mov dword [rsi], 0
jmp 0x140022d94
call sub.kernel32.dll_GetLastError
mov dword [rsi + 8], eax
mov qword [rsi], 1
jmp 0x140022d94
call sub.kernel32.dll_GetLastError
mov dword [rsi + 8], eax
mov qword [rsi], 1
lea rcx, [rbp - 0x28]
call fcn.1400222d0
mov rcx, qword [rbp + 0x40]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140022daf
mov r8d, 1
call fcn.14001bd80
mov rax, rsi
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027240
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
lea rax, [rbp - 0x20]
mov qword [rbp + 0x20], rax
lea rax, [0x1400283e0]
mov qword [rbp + 0x28], rax
lea rax, str..pipe_
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 1
mov qword [rbp + 0x10], 0
lea rax, [rbp + 0x20]
mov qword [rbp], rax
mov qword [rbp + 8], 1
lea rbx, [rbp - 0x38]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140051cc0
lea rcx, [rbp + 0x20]
mov rdx, rbx
call fcn.140052170
mov r14, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x30]
cmp rbx, 0x10
jae 0x140027300
test rbx, rbx
je 0x14002731b
xor eax, eax
xor r15d, r15d
nop
cmp byte [r14 + r15], 0
je 0x140027388
inc r15
cmp rbx, r15
jne 0x1400272e0
mov r15, rbx
test rax, rax
jne 0x140027325
jmp 0x140027392
mov byte [rbp + 0x4f], 1
xor ecx, ecx
mov rdx, r14
mov r8, rbx
call fcn.140058b50
mov r15, rdx
test rax, rax
jne 0x140027325
jmp 0x140027392
xor r15d, r15d
xor eax, eax
test rax, rax
je 0x140027392
mov rdi, qword [rbp + 0x28]
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], rdi
mov qword [rbp], rbx
mov qword [rbp + 8], r15
movzx eax, byte [0x140095b69]
mov ecx, 0x20
mov edx, 8
call fcn.14001bd70
test rax, rax
je 0x140027461
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
lea r8, fcn.14001d070
mov cl, 0x27
mov rdx, rax
call fcn.14003dab0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14002744e
mov eax, 1
test rax, rax
jne 0x140027325
mov rax, qword [rbp + 0x30]
mov qword [rbp], rax
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp - 0x10], xmm0
mov byte [rbp + 0x4f], 0
lea rcx, [rbp - 0x10]
call fcn.140051a90
mov qword [rbp + 0x38], rdx
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x11000
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x40], rax
mov rcx, rax
mov edx, 0x40000001
mov r8d, 8
mov r9d, 1
call sub.kernel32.dll_CreateNamedPipeA
cmp rax, 0xffffffffffffffff
je 0x14002741b
xorps xmm0, xmm0
movups xmmword [rsi + 0x28], xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x38], rax
mov qword [rsi + 0x40], 0
mov qword [rsi], 0
jmp 0x140027433
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, qword [rbp + 0x40]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x14002744e
mov r8d, 1
call fcn.14001bd80
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x20
call fcn.14006ca40
ud2
Function at 0x1400358e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x14003593b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14003593b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x140035956
cmp eax, 0x42
jne 0x14003593b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140035a0a
cmp byte [r8 + r11], 0x5f
jne 0x140035a0a
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x140035a7e
mov rcx, rsi
xor edx, edx
call fcn.1400346d0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1400346d0
test al, al
jne 0x140035b18
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x140035991
lea rcx, [0x14007402c]
mov edx, 1
call fcn.140058810
test al, al
jne 0x140035b18
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14003594a
xor r14d, r14d
lea rbx, [0x140074026]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400359c9
test rax, rax
je 0x1400359c9
cmp byte [rax + rcx], 0x45
je 0x140035b41
sub r14, 1
jb 0x1400359ed
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x1400359ed
mov edx, 2
mov rcx, rbx
call fcn.140058810
test al, al
jne 0x140035b18
mov rcx, rsi
call fcn.140034e00
test al, al
jne 0x140035b18
mov rax, qword [rsi]
test rax, rax
jne 0x1400359b0
jmp 0x14003594a
xor eax, eax
mov edi, 0x3e
nop word cs:[rax + rax]
mov r9b, 1
cmp r11, r10
jae 0x140035adf
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x140035a72
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x140035a5c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x140035a4b
add dl, 0xa9
jmp 0x140035a5a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140035adf
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140035adf
movzx edx, bl
add rax, rdx
jae 0x140035a20
jmp 0x140035adf
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140035adf
cmp rax, rcx
jae 0x140035adc
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x140035b20
cmp qword [rsi + 0x20], 0
je 0x140035b3a
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400358e0
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x14003594a
jmp 0x140035b18
mov r9b, 1
xor edi, edi
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x140035b2f
lea rax, [0x140073ff1]
lea rcx, [0x140073fd8]
test r9b, r9b
cmovne rcx, rax
xor r9b, 1
movzx eax, r9b
lea rdx, [rax + rax*8]
or rdx, 0x10
call fcn.140058810
test al, al
je 0x140035b2f
mov dil, 2
jmp 0x14003594a
mov dil, 1
xor r9d, r9d
mov r8, qword [rsi + 0x20]
test r8, r8
jne 0x140035aea
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14003594a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14003594a
Function at 0x1400391e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
test rdx, rdx
je 0x140039247
mov rdx, rcx
mov ebx, 0xffffffff
xor esi, esi
mov r14, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
nop word cs:[rax + rax]
test rdi, rdi
je 0x140039249
cmp rdi, rbx
mov r8d, 0xffffffff
cmovb r8, rdi
sub rdi, r8
lea r15, [rdx + r8]
xor ecx, ecx
mov r9d, 2
call r14
mov rdx, r15
cmp eax, 0xc0000000
jb 0x140039210
add eax, 0x80000000
mov esi, eax
jmp 0x140039249
xor esi, esi
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14003c750
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14003c7e0
jmp 0x14003c7cf
jae 0x14003c8a0
cmp r8, 0x201
jae 0x14003c7e0
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x14003c838
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14003c80f
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.14006bf10
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3d8], r13
mov rbx, rdi
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14003c861
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14003c908
mov r8d, r14d
cmp r15, r8
jne 0x14003c7c0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003c92b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14003c7cf
jmp 0x14003c7e0
cmp rsi, r8
jb 0x14003c945
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140040450
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14003c8f1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.14001bd80
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14003c8d9
jmp 0x14003c8f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14006cbe0
jmp 0x14003c95a
lea rax, str._z_a_
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14006d0a0
ud2
Function at 0x14003c9b0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140049160
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x14003cb26
mov qword [rbp + 0x408], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor esi, esi
cmp r8, 0x201
jae 0x14003ca60
jmp 0x14003ca4f
jae 0x14003cb38
cmp r8, 0x201
jae 0x14003ca60
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x14003cab7
sub r8, rsi
sub rbx, rsi
cmp rbx, r8
jae 0x14003ca8f
lea rcx, [rbp + 0x3e8]
mov rdx, rsi
call fcn.14006bf10
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov esi, 0xffffffff
cmovb rsi, rdi
mov qword [rbp + 0x3f8], rsi
mov rbx, rdi
mov r13, qword [rbp + 0x418]
mov r15, rsi
mov r12, rsi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x14003cae7
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14003cc0b
mov r8d, r14d
cmp r12, r8
jne 0x14003ca40
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003cc35
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14003ca4f
jmp 0x14003ca60
lea rcx, [rbp - 0x58]
call fcn.1400019e0
mov byte [rsi + 0x18], 2
jmp 0x14003cbca
cmp r15, r8
jb 0x14003cc4f
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.140040450
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x14003cb89
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x418]
mov rdx, rdi
call fcn.14001bd80
cmp byte [rbp + 0x3d8], 2
jne 0x14003cbe1
mov rsi, qword [rbp + 0x408]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400019e0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x14003cbca
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
call fcn.14001bd80
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x408]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
jne 0x14003cbb5
jmp 0x14003cbca
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x14003cb71
jmp 0x14003cb89
lea rcx, str.internal_error:_entered_unreachable_code_rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14006cbe0
jmp 0x14003cc64
lea rax, str._z_a_
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14006d0a0
ud2