joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400149d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400b9b60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400b9b40]
test rbx, rbx
je 0x140014a2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140014a23
test rsi, rsi
je 0x140014a23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140014a08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140014c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014c50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014c60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014d80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400b4ba0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140014da0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140014da8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140014da0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140014dfd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140014df4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140014da0
add rax, 0x28
cmp rax, r9
jne 0x140014de0
xor eax, eax
ret

Function at 0x140014e00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b4ba0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140014e1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140014e28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140014e1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140014ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b4ba0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140014edf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140014ee8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14001b020
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
mov qword [rsp + 0x20], rax
movabs rax, 0x7520676e696e6165
mov qword [rsp + 0x28], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x30], rax
movabs rax, 0x20726f6620737965
mov qword [rsp + 0x38], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x87], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14001b12a
lea rcx, [rsp + 0x20]
mov eax, 0x28
jmp 0x14001b102
add rax, 1
cmp rax, 0x6b
je 0x14001b11f
cmp byte [rcx + rax], 0
jne 0x14001b0f8
cmp eax, 0x6a
movsxd rdx, eax
je 0x14001b11f
add eax, 1
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea rcx, [rsp + 0x20]
mov eax, 0x28
mov edx, 0x27
jmp 0x14001b113

Function at 0x14001b4a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x1400ba650], 1
je 0x14001b518
lea rdi, [0x1400ba650]
mov rcx, rdi
call fcn.14001ada0
lea rbp, [rax + 8]
mov rbx, rax
mov rcx, rbp
call fcn.14001a720
mov esi, dword [0x1400ba650]
test esi, esi
jne 0x14001b528
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x140020678], eax
je 0x14001fef6
mov dword [0x1400ba650], 1
mov rcx, rbp
call fcn.14001aa10
test rbx, rbx
je 0x14001b518
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14001b140
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp esi, 1
je 0x14001b4f8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, esi
mov r8, rdi
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.14001a1f0
jmp 0x14001b4f8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
Function at 0x1400263f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140026426
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14002642e
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140026433
xor r10d, r10d
jmp 0x1400264e1
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140026456
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002646d
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002648d
add r11, r8
jmp 0x1400265be
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140026562
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop word cs:[rax + rax]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140026510
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140026574
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x14002657a
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400265a0
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400265ba
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140029020
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
cmp qword [rcx + 0x18], 0
je 0x140029085
mov rsi, r8
mov rdi, rdx
movabs rax, 0x517cc1b727220a95
cmp r8, 8
jb 0x14002908c
lea rdx, [rsi - 8]
mov r11, rdx
shr r11, 3
inc r11
mov r10d, r11d
and r10d, 3
cmp rdx, 0x18
jae 0x140029099
xor edx, edx
mov r9, rsi
mov r8, rdi
jmp 0x1400290ed
xor ecx, ecx
jmp 0x14002920d
xor edx, edx
mov r8, rdi
mov r9, rsi
jmp 0x14002911b
and r11, 0xfffffffffffffffc
xor edx, edx
mov r9, rsi
mov r8, rdi
nop word cs:[rax + rax]
rol rdx, 5
xor rdx, qword [r8]
imul rdx, rax
rol rdx, 5
xor rdx, qword [r8 + 8]
imul rdx, rax
rol rdx, 5
xor rdx, qword [r8 + 0x10]
imul rdx, rax
rol rdx, 5
xor rdx, qword [r8 + 0x18]
imul rdx, rax
add r9, 0xffffffffffffffe0
add r8, 0x20
add r11, 0xfffffffffffffffc
jne 0x1400290b0
test r10, r10
je 0x14002911b
shl r10, 3
xor r11d, r11d
nop dword [rax]
rol rdx, 5
xor rdx, qword [r8 + r11]
imul rdx, rax
add r11, 8
cmp r10, r11
jne 0x140029100
sub r9, r11
add r8, r11
cmp r9, 3
ja 0x140029239
cmp r9, 2
jae 0x140029259
test r9, r9
je 0x140029143
movzx r8d, byte [r8]
rol rdx, 5
xor rdx, r8
imul rdx, rax
rol rdx, 5
xor rdx, 0xff
imul rdx, rax
mov rbx, qword [rcx]
mov r14, qword [rcx + 8]
mov r15, r14
and r15, rdx
shr rdx, 0x39
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
pcmpeqd xmm7, xmm7
xor r12d, r12d
movdqu xmm8, xmmword [rbx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm6
pmovmskb r13d, xmm0
test r13d, r13d
jne 0x1400291cf
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x14002927e
add r15, r12
add r15, 0x10
add r12, 0x10
and r15, r14
jmp 0x14002917c
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test ax, ax
je 0x140029195
tzcnt eax, r13d
add rax, r15
and rax, r14
neg rax
lea rbp, [rax + rax*2]
shl rbp, 4
cmp qword [rbx + rbp - 0x20], rsi
jne 0x1400291c0
add rbp, rbx
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400291c0
lea rcx, [rbp - 0x30]
test rbp, rbp
cmove rcx, rbp
lea rax, [rcx + 0x18]
test rcx, rcx
cmove rax, rcx
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r10d, dword [r8]
rol rdx, 5
xor rdx, r10
imul rdx, rax
add r9, 0xfffffffffffffffc
add r8, 4
cmp r9, 2
jb 0x14002912f
movzx r10d, word [r8]
rol rdx, 5
xor rdx, r10
imul rdx, rax
add r9, 0xfffffffffffffffe
add r8, 2
test r9, r9
jne 0x140029134
jmp 0x140029143
xor ebp, ebp
jmp 0x140029202
Function at 0x14002b030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movdqa xmmword [rsp + 0x100], xmm8
movdqa xmmword [rsp + 0xf0], xmm7
movdqa xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x80]
call fcn.140061cc0
mov rax, qword [rsp + 0x80]
add byte [rax], al
add byte [rcx], dh
ror byte [rax - 0x47], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x248c3948], al
mov byte [rax], al
add byte [rax], al
invalid
Function at 0x14004a310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r14, rdx
mov rsi, rcx
lea rdx, str.App_Window
lea rcx, [rsp + 0x90]
mov r8d, 0xa
call fcn.140048fc0
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x14004a352
mov rax, qword [rax + 8]
jmp 0x14004a354
xor eax, eax
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x88], rax
mov r13d, dword [r14 + 0x10]
mov ebp, dword [r14 + 0x14]
mov eax, dword [r14 + 0x38]
mov dword [rsp + 0x74], eax
mov eax, dword [r14 + 0x3c]
mov dword [rsp + 0x70], eax
mov eax, dword [r14 + 0x40]
mov dword [rsp + 0x6c], eax
mov eax, dword [r14 + 0x44]
mov dword [rsp + 0x68], eax
mov rbx, qword [r14]
mov r12, qword [r14 + 8]
mov r15d, dword [r14 + 0x48]
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x80], rax
mov rdi, qword [r14 + 0x18]
mov r14, qword [r14 + 0x20]
movzx eax, byte [0x1400df209]
mov ecx, 0x18
mov edx, 8
call fcn.140002d70
test rax, rax
je 0x14004a48a
test rbx, rbx
cmove r12, rbx
test r13d, r13d
cmove ebp, r13d
movsxd rcx, r15d
mov qword [rax], 0
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r14
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r12
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov rdi, qword [rsp + 0x88]
mov rdx, rdi
mov r8, qword [rsp + 0x78]
mov r9d, ebp
call sub.USER32.dll_CreateWindowExW
test rax, rax
je 0x14004a499
mov qword [rsi], rax
mov dword [rsi + 8], r15d
mov byte [rsi + 0xc], 0
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x14004a473
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140002d90
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x18
call fcn.1400aa830
lea rcx, str.assertion_failed:_handle___0
lea r8, str.sU_v_
mov edx, 0x1d
call fcn.1400aabf0
invalid
invalid
add ah, cl

Function at 0x14004a4c0
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r15, rcx
movabs rax, 0x402000000008
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call sub.COMCTL32.dll_InitCommonControlsEx
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14004ab48
mov ecx, 0x4b
mov edx, 1
xor r8d, r8d
mov r9d, 3
call sub.USER32.dll_SystemParametersInfoW
mov r8d, 2
mov ecx, 0x200b
xor edx, edx
mov r9d, 3
call sub.USER32.dll_SystemParametersInfoW
movzx ecx, byte [r15 + 0x18]
call sub.USER32.dll_SetProcessDefaultLayout
test eax, eax
jne 0x14004a5b3
mov rax, qword [0x1400df0e0]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 2
setne cl
mov eax, 0xff
cmovbe eax, ecx
cmp al, 0xff
je 0x14004a565
movzx eax, al
test eax, eax
jne 0x14004a5b3
lea rax, str.hV_v_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1400ac338]
mov qword [rsp + 0x60], rax
and al, 0x60
mov qword [rsp + 0x50], 0
Function at 0x14004c370
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, rdx
mov r15, qword [rcx]
mov rcx, r15
call sub.USER32.dll_GetWindowTextLengthW
mov edi, eax
inc edi
movsxd rsi, edi
mov qword [rsp + 0x60], rsi
jne 0x14004c3b6
mov r14d, 2
xor esi, esi
mov edx, 2
mov rcx, r15
xor r8d, r8d
call sub.USER32.dll_GetWindowTextW
jmp 0x14004c3ea
js 0x14004c5b7
lea r12, [rsi + rsi]
mov edx, 2
mov rcx, r12
call fcn.140004e30
test rax, rax
je 0x14004c5bc
mov r14, rax
mov rcx, r15
mov rdx, rax
mov r8d, edi
call sub.USER32.dll_GetWindowTextW
dec rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov rax, rsi
shr rax, 1
mov r8d, esi
and r8d, 1
add r8, rax
jne 0x14004c5a6
lea rsi, [r14 + rsi*2]
xor ebx, ebx
movabs r13, 0x100000000
lea r15, [rsp + 0x40]
mov r12, r14
jmp 0x14004c455
movzx edx, ax
shl rdx, 0x10
shr rdx, 0x10
xor ebx, ebx
mov rcx, r15
call fcn.140023ac0
test bx, bx
je 0x14004c460
mov eax, ebp
jmp 0x14004c46e
cmp r12, rsi
je 0x14004c4e3
movzx eax, word [r12]
add r12, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x14004c440
movzx ecx, ax
mov edx, 0xfffd
cmp ecx, 0xdbff
ja 0x14004c44b
cmp r12, rsi
je 0x14004c4bb
movzx ecx, word [r12]
add r12, 2
mov r8d, ecx
add r8d, 0x2000
movzx r8d, r8w
mov bx, 1
cmp r8d, 0xfc00
jae 0x14004c4c2
mov ebp, ecx
jmp 0x14004c44d
xor ebx, ebx
mov r12, rsi
jmp 0x14004c44d
movzx edx, cx
and eax, 0x3ff
and edx, 0x3ff
shl rax, 0x1a
shl rdx, 0x10
or rdx, rax
add rdx, r13
jmp 0x14004c447
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
lea rax, str._n__n:_InteriorNulNotNulTerminatedp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x20], 2
lea r9, str._r_nfailed_to_create_GDI_DCfailed_to_select_font_gdi_object
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.140022e60
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsi]
test rdx, rdx
je 0x14004c540
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.140002d90
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
test r15, r15
mov rsi, qword [rsp + 0x60]
je 0x14004c56c
mov r8d, 1
mov rcx, r12
mov rdx, r15
call fcn.140002d90
test edi, edi
je 0x14004c594
add rsi, rsi
mov r8d, 2
mov rcx, r14
mov rdx, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140002d90
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1400a56f0
jmp 0x14004c420
call fcn.14008c600
mov ecx, 2
mov rdx, r12
call fcn.1400aa830
int3
Function at 0x14005a760
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx]
test rdx, rdx
je 0x14005a7d2
mov r15, qword [rdi + 0x10]
test r15, r15
je 0x14005a824
cmp rbx, r15
mov r9, r15
cmovb r9, rbx
mov rax, qword [rdi + 8]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov r8, r14
call qword [0x1400e5010]
cmp qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
je 0x14005a834
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
jne 0x14005a855
jmp 0x14005a8f3
mov r15, qword [rdi + 0x18]
test r15, r15
je 0x14005a8d7
cmp rbx, r15
cmovae rbx, r15
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov r8, r14
mov r9, rbx
call qword [0x1400e5010]
cmp qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
je 0x14005a8df
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14005a8f3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
test rbx, rbx
jne 0x14005a855
jmp 0x14005a8f3
sub r15, rax
jb 0x14005a902
mov qword [rdi + 0x10], r15
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rbx, rbx
je 0x14005a8f3
mov ecx, dword [rdi + 0x20]
mov eax, dword [rdi + 0x18]
mov edx, dword [rdi + 0x1c]
xor r8d, r8d
lea r9, [0x1400bcfd0]
nop dword [rax + rax]
mov r11d, ecx
or r11d, 3
mov r10d, r11d
and r10d, 0xfffffffe
imul r10d, r11d
shr r10d, 8
xor r10b, byte [r14 + r8]
mov r11d, eax
xor r11b, r10b
movzx r11d, r11b
shr eax, 8
xor eax, dword [r9 + r11*4]
movzx r11d, al
add r11d, edx
imul edx, r11d, 0x8088405
inc edx
mov r11d, edx
shr r11d, 0x18
movzx r15d, cl
xor r15d, r11d
shr ecx, 8
xor ecx, dword [r9 + r15*4]
mov byte [r14 + r8], r10b
inc r8
cmp rbx, r8
jne 0x14005a870
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x18], eax
mov dword [rdi + 0x1c], edx
jmp 0x14005a8f3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14005a8f3
sub r15, rax
jb 0x14005a902
mov qword [rdi + 0x18], r15
mov qword [rsi + 8], rax
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
lea rax, [0x1400bca70]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rdx, str._rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_std_srciomod.rsfailed_to_fill_whole_buffer
lea rcx, [rsp + 0x20]
call fcn.1400aab20
int3
Function at 0x140070000
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x1400700a0
jmp 0x14007008f
jae 0x140070160
cmp r8, 0x201
jae 0x1400700a0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400700f8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x1400700cf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400a9e70
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140070121
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400701c8
mov r8d, r14d
cmp r15, r8
jne 0x140070080
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400701f5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14007008f
jmp 0x1400700a0
cmp rsi, r8
jb 0x14007020f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140075af0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x1400701b1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140002d90
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140070199
jmp 0x1400701b1
lea rcx, str.internal_error:_entered_unreachable_code8
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.1400aabf0
jmp 0x140070224
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400ab080
ud2
Function at 0x140071960
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140071970
mov rcx, rdx
mov rdx, r8
jmp fcn.140071980
mov rcx, rdx
mov rdx, r8
jmp fcn.14007e050

Function at 0x140078a40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
mov dword [rsp + 0x34], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x58], rdx
lea rdx, [0x140081d80]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x140078ae0
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rsp + 0x34], 0
je 0x140078ab0
movsxd rax, dword [rsp + 0x38]
test rax, rax
je 0x140078afb
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140078b05
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140078b08
mov eax, dword [rsp + 0x3c]
mov qword [rsi + 8], rax
xor eax, eax
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret