joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e6440
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800e6482
mov rdi, qword [rsp + 0x28]
je 0x1800e64f8
movabs rcx, 0xffffffff00000003
and rcx, rdi
mov eax, edi
and eax, 3
movabs rdx, 0x8009030e00000002
cmp rcx, rdx
cmp eax, 1
jne 0x1800e654e
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800e64e1
cmp qword [rdi + 0x10], 0x11
jb 0x1800e64cf
mov r14, qword [r14 - 8]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180246f98]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800e6570
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800e6553
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x1800e652c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800e653f
mov rcx, rax
mov qword [0x180246f98], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800e6559
mov ecx, 1
mov rdx, rbx
call fcn.18019a870
ud2
xor r14d, r14d
jmp 0x1800e6570
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180199330
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800e9ab0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xc0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800e9af2
mov rdi, qword [rsp + 0x28]
je 0x1800e9b68
movabs rcx, 0xffffffff00000003
and rcx, rdi
mov eax, edi
and eax, 3
movabs rdx, 0x8009030e00000002
cmp rcx, rdx
cmp eax, 1
jne 0x1800e9bbe
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800e9b51
cmp qword [rdi + 0x10], 0x11
jb 0x1800e9b3f
mov r14, qword [r14 - 8]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180246f98]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800e9be0
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800e9bc3
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x1800e9b9c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800e9baf
mov rcx, rax
mov qword [0x180246f98], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800e9bc9
mov ecx, 1
mov rdx, rbx
call fcn.18019a870
ud2
xor r14d, r14d
jmp 0x1800e9be0
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180199330
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180101ac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180101ae0
test al, 1
je 0x180101c56
test al, 2
jne 0x180101c70
test al, 8
jne 0x180101b2c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xd0], 0
je 0x180101b4c
lea rax, [rax + 0xd8]
jmp 0x180101b5a
test al, 0x10
je 0x180101baf
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x180101cee
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x180101baf
call fcn.1801369a0
test rax, rax
je 0x180101c4e
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.180101960
mov qword [rsi + 0x30], 4
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xd0], 0
je 0x180101ba1
lea rax, [rax + 0xd8]
jmp 0x180101bab
call fcn.1801369a0
test rax, rax
je 0x180101baf
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18013e3a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x180101c8a
jne 0x180101c3c
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180101bf9
call fcn.180098490
lea rcx, [rsi + 0x30]
call fcn.180101960
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x180101c18
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x180101b6a
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x18020eac8]
mov edx, 0x23
call fcn.18019ad80
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x18020ea88]
mov edx, 0x25
call fcn.18019ad80
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1800245e0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x18020eb10]
jmp 0x180101d1e
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x180234e18]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.18019abc0
ud2
Function at 0x180102e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180102ea0
test al, 1
je 0x180103016
test al, 2
jne 0x180103030
test al, 8
jne 0x180102eec
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xd0], 0
je 0x180102f0c
lea rax, [rax + 0xd8]
jmp 0x180102f1a
test al, 0x10
je 0x180102f6f
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1801030ae
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x180102f6f
call fcn.1801369a0
test rax, rax
je 0x18010300e
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.180101960
mov qword [rsi + 0x30], 4
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xd0], 0
je 0x180102f61
lea rax, [rax + 0xd8]
jmp 0x180102f6b
call fcn.1801369a0
test rax, rax
je 0x180102f6f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18013d3f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x18010304a
jne 0x180102ffc
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180102fb9
call fcn.1800983f0
lea rcx, [rsi + 0x30]
call fcn.180101960
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x180102fd8
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x180102f2a
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x18020eac8]
mov edx, 0x23
call fcn.18019ad80
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x18020ea88]
mov edx, 0x25
call fcn.18019ad80
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1800245e0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x18020eb10]
jmp 0x1801030de
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x180234e18]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.18019abc0
ud2
Function at 0x18010fea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x18010fefb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x18010fefb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x18010ff16
cmp eax, 0x42
jne 0x18010fefb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x18010ffc6
cmp byte [r9 + r11], 0x5f
jne 0x18010ffc6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x18011002e
mov rcx, rsi
xor edx, edx
call fcn.18010b370
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.18010b370
test al, al
jne 0x1801100c1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18010ff52
lea rdx, [0x180207f2b]
mov r8d, 1
call fcn.180025a60
test al, al
jne 0x1801100c1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x18010ff0a
xor r14d, r14d
lea rbx, [0x1802082e0]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x18010ff84
cmp byte [rax + rcx], 0x45
je 0x1801100ea
sub r14, 1
jb 0x18010ffa9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18010ffa9
mov r8d, 2
mov rdx, rbx
call fcn.180025a60
test al, al
jne 0x1801100c1
mov rcx, rsi
call fcn.18010cca0
test al, al
jne 0x1801100c1
mov rax, qword [rsi]
test rax, rax
jne 0x18010ff70
jmp 0x18010ff0a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x180110088
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x180110022
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x18011000c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x18010fffb
add dl, 0xa9
jmp 0x18011000a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x180110088
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x180110088
movzx edx, bl
add rax, rdx
jae 0x18010ffd0
jmp 0x180110088
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x180110088
cmp rax, rcx
jae 0x180110085
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1801100c9
cmp qword [rsi + 0x20], 0
je 0x1801100e3
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.18010fea0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x18010ff0c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1801100d8
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x1802082a0]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.180025a60
test al, al
je 0x1801100d8
mov dil, 2
jmp 0x18010ff0a
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x180110093
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x18010ff0a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x18010ff0a
Function at 0x1801123c0
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x180112427
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x18011246e
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x180112463
xor r9d, r9d
lea r10, [0x180238470]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x180112450
jmp 0x180112466
xor r8d, r8d
mov dword [rsp + 0x98], r8d
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1801124f5
js 0x180112604
mov rbx, qword [rcx]
lea r14, [rsi*8]
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x1801124b4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801125ee
mov rcx, rax
mov qword [0x180246f98], rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801125ee
mov rdi, rax
lea r8, [rbx + rsi*8]
sub r8, rbx
add r8, 0xfffffffffffffff8
mov r14, r8
shr r14, 3
and r8, 0xfffffffffffffff8
add r8, 8
mov rcx, rax
mov rdx, rbx
call fcn.180199330
inc r14d
jmp 0x1801124fd
xor r14d, r14d
mov edi, 8
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x18011258a
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
test rsi, rsi
je 0x18011256f
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x1801125b7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18011260b
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18011260b
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor r14d, r14d
test rsi, rsi
jne 0x18011255d
jmp 0x18011256f
shr rsi, 0x39
not esi
and esi, 8
mov rcx, rsi
mov rdx, r14
call fcn.18019a870
ud2
call fcn.18001e850
ud2
mov ecx, 8
mov edx, 0x20
call fcn.18019a870
ud2
Function at 0x18011bf00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x18020a930]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x18011bf73
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x18011bfaa
test eax, eax
js 0x18011bf84
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x18011bf9d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x18020a998]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.18011a880
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.18011a920
mov ecx, 7
int 0x29
ud2
Function at 0x18011f720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x18011f750
test ecx, ecx
jne 0x18011f7a0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x18011f75c
test ecx, ecx
jne 0x18011f7a0
mov rcx, rdi
call fcn.18011f600
movzx eax, al
test bpl, bpl
jne 0x18011f7a7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x18011f793.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x18011f918]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x18011f793.2
xor eax, eax
test bpl, bpl
je 0x18011f76c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x18011f8f9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x18011f7da
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x18011f859
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x18011f820
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x18011f83b
inc rax
dec rdi
cmp rax, 1
jne 0x18011f800
jmp 0x18011f859
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x18011f83b
cmp ebx, 0x5c
je 0x18011f83b
inc rax
dec rdi
cmp rax, 1
jne 0x18011f820
jmp 0x18011f859
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x18011f907
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x18011f883
mov al, 9
cmp rdx, 2
je 0x18011f887
cmp rdx, 1
jne 0x18011f897
cmp byte [r8], 0x2e
jne 0x18011f897
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x18011f897
mov al, 0xa
jmp 0x18011f897
cmp byte [r8], 0x2e
jne 0x18011f897
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x18011f793.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x18011f793.2
mov ecx, 2
jmp case.0x18011f793.2
lea r8, str.library_std_srcpath.rs
call fcn.18019ac80
ud2
lea r8, str.library_std_srcpath.rs
call fcn.18019ac80
ud2
Function at 0x18011fd10
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.18011c9b0
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x18011fe95
mov qword [rbp + 0x3c8], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3f0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f8], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x18011fdd0
jmp 0x18011fdbf
jae 0x18011fea7
cmp r8, 0x201
jae 0x18011fdd0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x18011fe28
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x18011fdff
lea rcx, [rbp + 0x3f0]
mov rdx, r12
call fcn.1801a1430
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f8]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x400], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x418]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x18011fe57
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x18011ff6c
mov r8d, r14d
cmp r15, r8
jne 0x18011fdb0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x18011ff9c
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x18011fdbf
jmp 0x18011fdd0
lea rcx, [rbp - 0x50]
call fcn.180119f20
mov byte [rsi + 0x18], 2
jmp 0x18011ff36
cmp rsi, r8
jb 0x18011ffb6
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.18011e3b0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3e0], xmm1
movaps xmmword [rbp + 0x3d0], xmm0
test rdi, rdi
mov rsi, qword [rbp + 0x3c8]
je 0x18011fefd
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, qword [rbp + 0x418]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [rbp + 0x3e8], 2
jne 0x18011ff4b
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3d0]
call fcn.180119f20
cmp qword [rbp + 0x408], 0
je 0x18011ff36
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, qword [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmm1, xmmword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x408], 0
jne 0x18011ff20
jmp 0x18011ff36
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3d0], rax
mov byte [rbp + 0x3e8], 2
test rdi, rdi
mov rsi, qword [rbp + 0x3c8]
jne 0x18011fee7
jmp 0x18011fefd
lea rcx, str.internal_error:_entered_unreachable_code_rustc_8c74a5d27c644a0f7a22bb2fa8dd3ff8257bc220library_std_src_threadmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.18019ad80
jmp 0x18011ffcb
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.18019ad00
ud2
Function at 0x180122e30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x18020a930]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x180122e9c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x180122eab
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x180122ee3
cmp eax, 0x103
je 0x180122eed
test eax, eax
js 0x180122ec8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x180122ee3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x18020a998]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.18011a880
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.18011a920
mov ecx, 7
int 0x29
ud2