joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d6010
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401ca4f8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401ca4f8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401d6160
cmp rax, 0xffffffffffffffff
je 0x1401d6160
xor edi, edi
test rbp, rbp
jle 0x1401d610b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401c75d4
mov rbx, rax
test rax, rax
jne 0x1401d6098
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401d6101
mov edx, 0x8000
mov ecx, r14d
call fcn.1401baf44
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1401c6cd8
cmp eax, 0xffffffff
je 0x1401d60e1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401d60a8
mov edx, r15d
mov ecx, r14d
call fcn.1401baf44
jmp 0x1401d6101
cmp byte [rsi + 0x38], dil
je 0x1401d60f8
cmp dword [rsi + 0x34], 5
jne 0x1401d60f8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetDim
cmp byte [rsi + 0x30], dil
je 0x1401d6101
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401c6fe8
jmp 0x1401d6174
jns 0x1401d6174
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401ca4f8
cmp rax, 0xffffffffffffffff
jne 0x1401d612c
cmp byte [rsi + 0x30], dil
je 0x1401d6174
mov edi, dword [rsi + 0x2c]
jmp 0x1401d6174
mov ecx, r14d
call fcn.1401c5418
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401d6174
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, SafeArrayGetDim
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetDim
jmp 0x1401d6174
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401d616d
mov eax, dword [rsi + 0x2c]
jmp 0x1401d6172
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401ca4f8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1401d68d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401d68f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401d68f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18001e5a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001e5c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18001e5c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180022a08
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180022a38
xor eax, eax
jmp 0x180022afb
mov rbp, rbx
cmp word [rax], si
je 0x180022a5d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180022a44
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180022a40
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180022928
movsxd r14, eax
test eax, eax
jne 0x180022a9b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180022a31
mov rcx, r14
call fcn.180022e54
mov rdi, rax
test rax, rax
jne 0x180022ab4
xor ecx, ecx
call fcn.180020524
jmp 0x180022a90
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180022928
test eax, eax
jne 0x180022ae5
mov rcx, rdi
call fcn.180020524
jmp 0x180022aef
xor ecx, ecx
call fcn.180020524
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140014f70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c90
xor al, al
jmp 0x140012d11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012ca3
xor al, al
jmp 0x140012d11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012ccd
xor al, al
jmp 0x140012d11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012ce1
xor al, al
jmp 0x140012d11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012cf3
xor al, al
jmp 0x140012d11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d0f
xor al, al
jmp 0x140012d11
mov al, 1
add rsp, 0x38
ret
Function at 0x140029a0c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d0d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d0d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b5c
cmp rax, 0xffffffffffffffff
je 0x140029b5c
xor edi, edi
test rbp, rbp
jle 0x140029b07
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fa00
mov rbx, rax
test rax, rax
jne 0x140029a94
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029afd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aa08
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001ddb0
cmp eax, 0xffffffff
je 0x140029add
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029aa4
mov edx, r15d
mov ecx, r14d
call fcn.14001aa08
jmp 0x140029afd
cmp byte [rsi + 0x38], dil
je 0x140029af4
cmp dword [rsi + 0x34], 5
jne 0x140029af4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029afd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b79c
jmp 0x140029b70
jns 0x140029b70
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d0d4
cmp rax, 0xffffffffffffffff
jne 0x140029b28
cmp byte [rsi + 0x30], dil
je 0x140029b70
mov edi, dword [rsi + 0x2c]
jmp 0x140029b70
mov ecx, r14d
call fcn.140018ec4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b70
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b69
mov eax, dword [rsi + 0x2c]
jmp 0x140029b6e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d0d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ac88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ac88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140130000
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 0x20], r9
out 0xa5, al
add byte [rbp + 0x33], al
sal byte [rbx], 0xd2
and dword [rbp + 0x52], esp
jmp 0x140130a63
add cl, al
mov byte [rsp + rdx + 0x3b], cl
mov byte [rsp + rdx + 0x30], r13b
inc rdx
cmp rdx, 0xa
jb 0x140131061
xor edx, edx
jne 0x140130fd6
je 0x140130fd6
pushfq
jmp rcx
jmp 0x1401310d0
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
jmp fcn.1401310e8
nop word [rax + rax]
mov r10d, r8d
lea rcx, [rbx + r10*4]
mov edx, dword [rcx + r9]
mov ecx, 0x935f3d6f
jmp 0x1401310fb
Function at 0x1400cc9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test rdx, rdx
je 0x1400ccbaa
add rdx, rcx
xor eax, eax
xor r9d, r9d
jmp 0x1400cc9fa
xor r11b, 1
movzx r8d, r11b
add rax, r8
mov r8d, r9d
mov r9d, r8d
cmp rcx, rdx
je 0x1400ccbac
movzx r10d, byte [rcx]
test r10b, r10b
js 0x1400cca20
inc rcx
mov r8b, 1
cmp r10d, 0x20
jae 0x1400ccac0
jmp 0x1400cc9ee
mov r8d, r10d
and r8d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xe0
jb 0x1400cca83
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x1400cca9f
movzx r10d, byte [rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r8d
cmp r10d, 0x110000
je 0x1400ccbac
add rcx, 4
mov r8b, 1
cmp r10d, 0x20
jae 0x1400ccac0
jmp 0x1400cc9ee
add rcx, 2
shl r8d, 6
or r8d, esi
mov r10d, r8d
mov r8b, 1
cmp r10d, 0x20
jae 0x1400ccac0
jmp 0x1400cc9ee
add rcx, 3
shl r8d, 0xc
or r11d, r8d
mov r10d, r11d
mov r8b, 1
cmp r10d, 0x20
jb 0x1400cc9ee
nop word [rax + rax]
cmp r10d, 0x7f
je 0x1400cc9ee
mov r11d, r9d
and r11b, 1
je 0x1400cc9e0
cmp r10d, 0x6d
jne 0x1400cc9e0
cmp rcx, rdx
je 0x1400ccbac
movzx r10d, byte [rcx]
test r10b, r10b
js 0x1400ccb05
inc rcx
cmp r10d, 0x20
jae 0x1400ccb92
jmp 0x1400cc9ee
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x1400ccb61
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x1400ccb7a
movzx r10d, byte [rcx + 3]
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r9d
cmp r10d, 0x110000
je 0x1400ccbac
add rcx, 4
cmp r10d, 0x20
jae 0x1400ccb92
jmp 0x1400cc9ee
add rcx, 2
shl r9d, 6
or r9d, esi
mov r10d, r9d
cmp r10d, 0x20
jae 0x1400ccb92
jmp 0x1400cc9ee
add rcx, 3
shl r9d, 0xc
or r11d, r9d
mov r10d, r11d
cmp r10d, 0x20
jb 0x1400cc9ee
xor r11d, r11d
mov r9d, 0
cmp r10d, 0x7f
jne 0x1400cc9e0
jmp 0x1400cc9ee
xor eax, eax
pop rsi
ret
Function at 0x1401087d0
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov r8, qword [rax + 0x20]
movzx eax, word [r8]
cmp eax, 0x5a4d
jne 0x1401088ed
movsxd rax, dword [r8 + 0x3c]
cmp dword [r8 + rax], 0x4550
jne 0x14010891c
mov edx, ecx
mov eax, dword [r8 + rax + 0x88]
mov ecx, dword [r8 + rax]
movups xmm0, xmmword [r8 + rax + 4]
mov r9, qword [r8 + rax + 0x14]
mov dword [rbp - 0x48], ecx
movups xmmword [rbp - 0x44], xmm0
mov qword [rbp - 0x34], r9
mov rcx, qword [r8 + rax + 0x1c]
mov qword [rbp - 0x2c], rcx
mov eax, dword [r8 + rax + 0x24]
mov dword [rbp - 0x24], eax
lea rcx, [rbp - 0x20]
lea r9, [rbp - 0x48]
call fcn.140108a10
cmp qword [rbp - 0x20], 0
jne 0x14010894b
movzx eax, word [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
lea rdx, [rcx + 1]
xor r8d, r8d
jmp 0x140108891
add r8, 0xfffffffffffffffe
add rdx, 2
cmp r8, 0xffffffffffffff02
je 0x1401088c5
cmp byte [rdx], 0xf
jne 0x1401088a2
cmp byte [rdx + 1], 5
jne 0x1401088a2
cmp byte [rdx + 2], 0xc3
je 0x1401088be
cmp byte [rdx + 1], 0xf
jne 0x140108880
cmp byte [rdx + 2], 5
jne 0x140108880
cmp byte [rdx + 3], 0xc3
jne 0x140108880
sub rcx, r8
add rcx, 2
mov rdx, rcx
add rsp, 0x78
pop rsi
pop rbp
ret
lea rax, [0x14021d718]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_retrieving_syscall_address
lea r9, [0x14021d648]
lea r8, [rbp - 1]
mov edx, 0x24
call fcn.140127ac0
movzx eax, byte [0x140237181]
mov esi, 0x19
mov ecx, 0x19
mov edx, 1
call fcn.1400b3a70
test rax, rax
jne 0x140108973
mov ecx, 1
mov edx, 0x19
call fcn.1401275b0
movzx eax, byte [0x140237181]
mov esi, 0x18
mov ecx, 0x18
mov edx, 1
call fcn.1400b3a70
test rax, rax
jne 0x14010898a
mov ecx, 1
mov edx, 0x18
call fcn.1401275b0
lea rax, [0x14021d6d8]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_getting_syscall_number
lea r9, [0x14021d648]
lea r8, [rbp - 1]
mov edx, 0x20
call fcn.140127ac0
movups xmm0, xmmword [0x14021d751]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [0x14021d748]
movups xmmword [rax], xmm0
jmp 0x1401089a2
movups xmm0, xmmword [str.____INVALID_NT_SIGNATURE____INVALID_DOS_SIGNATURE]
movups xmmword [rax], xmm0
movabs rcx, 0x45525554414e4749
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rsi
lea rax, [0x14021d6a0]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_exporting_DLLsyscall_src_syscall_resolve.rs
lea r9, [0x14021d628]
lea r8, [rbp - 0x20]
mov edx, 0x17
call fcn.140127ac0
ud2
Function at 0x14010c430
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14010c4d0
jmp 0x14010c4bf
jae 0x14010c58f
cmp r8, 0x201
jae 0x14010c4d0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14010c527
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14010c4ff
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140126840
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14010c550
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14010c5fb
mov r8d, r13d
cmp r12, r8
jne 0x14010c4b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14010c62f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14010c4bf
jmp 0x14010c4d0
cmp r14, r8
jb 0x14010c649
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1401103b0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14010c5e4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400b3a80
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14010c5cf
jmp 0x14010c5e4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140127810
jmp 0x14010c65e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140127bc0
ud2
Function at 0x1401153b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14021f7f8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1401153e8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14011543f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14011544c
xor edx, edx
xor eax, eax
jmp 0x140115476
cmp eax, 0x103
je 0x140115480
test eax, eax
js 0x14011545f
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140115476
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14010ff90
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14010a8d0
mov ecx, 7
int 0x29
ud2

Function at 0x1401154d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14021f7f8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140115508
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140115566
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140115593
test eax, eax
js 0x140115572
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140115589
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14010ff90
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14010a8d0
mov ecx, 7
int 0x29
ud2
Function at 0x140123d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x140123e0a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140123e00
cmp r11, r10
ja 0x140123e86
cmp r10, rdx
ja 0x140123e98
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140123e02
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140123de0
jmp 0x140123e67
ja 0x140123e0a
mov r11, r10
cmp rax, r8
jne 0x140123da7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x140123e6b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140123e40
mov r8, r10
sub ecx, r9d
jns 0x140123e5e
jmp 0x140123e6d
cmp r10, rdx
je 0x140123e7a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140123e6d
xor al, 1
cmp r8, rdx
jne 0x140123e20
jmp 0x140123e6d
xor eax, eax
jmp 0x140123e6d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1401276d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140127c30
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140127bc0
int3

Function at 0x140125bd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140125c1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140125c1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140125c1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140125c1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140125c1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140125c20
xor al, al
add rsp, 0x28
ret
Function at 0x140001dbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e06
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e06
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e06
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e06
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e06
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e08
xor al, al
add rsp, 0x28
ret

Function at 0x140003724
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400035b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400035b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400035b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400035b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400035b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400035b7
cmp dword [rcx + 0xf8], 0
je 0x1400035b7
mov ecx, ebx
call fcn.140003658
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140003448
cmp dword [rbp + 0x20], 0
je 0x140003604
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000360c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140003550

Function at 0x14000d0c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000d0e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000d0e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18000c210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x18000c2a0
cmp r11, r10
ja 0x18000c316
cmp r10, rdx
ja 0x18000c328
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x18000c2a2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x18000c280
jmp 0x18000c304
ja 0x18000c2aa
mov r11, r10
cmp rax, r8
jne 0x18000c244
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x18000c2e0
mov rdi, r8
sub ecx, edx
jns 0x18000c2fb
jmp 0x18000c306
cmp r8, rsi
je 0x18000c337
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x18000c306
xor al, 1
cmp rdi, rsi
jne 0x18000c2c0
jmp 0x18000c306
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x18005bf70]
mov rcx, r11
mov rdx, r10
call fcn.180059650
lea r8, [0x18005bf70]
mov rcx, r10
call fcn.1800593d0
lea rcx, [0x18365460a]
lea r8, [0x18005bf58]
mov edx, 0x2b
call fcn.180059450
int3