joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448580
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x4485c8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x4485c8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x4485d8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x01f1d730]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4486b1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00432680
xorps xmm15, xmm15
mov r14, qword [0x01f1d730]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x4486b1
cmp qword [rcx + 8], rax
ja 0x4485d3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x44fd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44feb7
movzx edx, byte [rax]
test edx, edx
jne 0x44fd74
nop dword [rax]
test r8b, r8b
jne 0x44fd74
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44fd87
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44fe77
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44fe65
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44fe57
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44fddd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44fe20
mov eax, 1
cmp rax, rbx
ja 0x44fe0b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00462980
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44fe4f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44fe13
mov rcx, r11
mov eax, r12d
jmp 0x44fde2
mov rcx, rbx
call fcn.004628c0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004628c0
mov eax, r8d
mov rcx, rbx
call fcn.00462980
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44fead
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44fe70
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44fd8d
mov eax, edx
mov rcx, rbx
call fcn.004628c0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004628c0
nop
int3

Function at 0x455a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455b35
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00453700
nop
test bl, bl
je 0x455b2f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00455b80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004604c0
xorps xmm15, xmm15
mov r14, qword [0x01f1d730]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004605e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455a80
Function at 0x458aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458b4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458ba0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004604c0
xorps xmm15, xmm15
mov r14, qword [0x01f1d730]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004605e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458aa0
Function at 0x4623e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409ae0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004605e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d20
cmp byte [0x01f1d52b], 0
je 0x4623f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f620
jmp 0x403d20

Function at 0x462400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01f1d800]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x01f1d52b], 0
je 0x462435
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x01f1db20]
aesenc xmm0, xmmword [0x01f1db30]
aesenc xmm0, xmmword [0x01f1db40]
movq rax, xmm0
ret
jmp 0x409d00

Function at 0x462440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01f1d800]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x01f1d52b], 0
je 0x462476
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01f1db20]
aesenc xmm0, xmmword [0x01f1db30]
aesenc xmm0, xmmword [0x01f1db40]
movq rax, xmm0
ret
jmp 0x409d60

Function at 0x464200
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464234
mov rcx, 0x28
jmp 0x46423f
shl rcx, 3
add rcx, 0x1480
mov qword [0x01f1d730], rcx
pop rbp
ret
Function at 0x46dce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ddaa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x01f1d730]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46dd8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00491d40]
xor ebx, ebx
mov rcx, rdx
call fcn.00449100
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0046e2c0
inc rbx
cmp rcx, rbx
jae 0x46dd7e
mov edi, 1
lea rsi, [0x00491d40]
call fcn.004491e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c8f98]
lea rsi, [0x004c88f8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004605e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046dce0
Function at 0x14001b710
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001b732
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14001b741
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x20], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b764
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001b766
xor ecx, ecx
mov qword [rsp + 0x28], rbx
movsxd rax, ecx
test ecx, ecx
je 0x14001b7a0
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rdi, rbx
add r14, rbx
mov r8, rdi
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001b847
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001b7db
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, r8
cmp r8, 0xfff
jbe 0x14001b821
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x14001b860
cmp rdi, rax
ja 0x14001b7f0
mov r8, rbx
test rbx, rbx
je 0x14001b847
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rbp, r8
mov rbx, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rdi
jmp 0x14001b84a
jnp 0x14005eb8f
push rsi
sub al, 0x3d
cld
loop 0x14005eb53
invalid
sub esp, esp
invalid
invalid
Function at 0x14000ae10
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14000aea0
jmp 0x14000ae8f
jae 0x14000af60
cmp r8, 0x201
jae 0x14000aea0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000aef8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14000aecf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14002e850
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000af21
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000afc8
mov r8d, r14d
cmp r15, r8
jne 0x14000ae80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000afeb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000ae8f
jmp 0x14000aea0
cmp rsi, r8
jb 0x14000b005
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000e320
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14000afb1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140003c10
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14000af99
jmp 0x14000afb1
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002f340
jmp 0x14000b01a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002f790
ud2
Function at 0x14000b170
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14001f470
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x14000b2f6
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14000b230
jmp 0x14000b21f
jae 0x14000b308
cmp r8, 0x201
jae 0x14000b230
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x14000b288
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14000b25f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.14002e850
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000b2b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000b3db
mov r8d, esi
cmp r12, r8
jne 0x14000b210
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000b405
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000b21f
jmp 0x14000b230
lea rcx, [rbp - 0x58]
call fcn.1400050c0
mov byte [rsi + 0x18], 2
jmp 0x14000b39a
cmp r15, r8
jb 0x14000b41f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.14000e320
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x14000b359
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140003c10
cmp byte [rbp + 0x3d8], 2
jne 0x14000b3b1
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400050c0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x14000b39a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140003c10
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x14000b385
jmp 0x14000b39a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x14000b341
jmp 0x14000b359
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002f340
jmp 0x14000b434
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14002f790
ud2
Function at 0x14000b4f0
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], r9
lea rsi, [rbp - 8]
mov rcx, rsi
call fcn.14001f470
mov rcx, qword [rbp - 8]
mov rax, qword [rbp]
test rcx, rcx
je 0x14000b5a2
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 8]
mov rdx, rbx
mov r8, rdi
call fcn.14001f470
mov r14, qword [rbp - 8]
mov rbx, qword [rbp]
test r14, r14
je 0x14000b5a7
mov r15, qword [rbp + 0x30]
mov rcx, r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x14000b5dd
xor edi, edi
test rbx, rbx
je 0x14000b597
add rbx, rbx
mov r8d, 2
mov rcx, r14
mov rdx, rbx
call fcn.140003c10
mov rdx, qword [rbp + 0x38]
test rdx, rdx
jne 0x14000b5b7
jmp 0x14000b5c8
mov rdi, rax
jmp 0x14000b5c8
mov rdi, rbx
mov rdx, qword [rbp + 0x38]
test rdx, rdx
mov r15, qword [rbp + 0x30]
je 0x14000b5c8
add rdx, rdx
mov r8d, 2
mov rcx, r15
call fcn.140003c10
test rdi, rdi
jne 0x14000b5f4
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
jne 0x14000b583
jmp 0x14000b597
mov qword [rbp + 0x28], rdi
lea rax, [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, [0x140010750]
mov qword [rbp], rax
lea rcx, [rbp - 0x28]
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x18], rax
lea rax, [0x14000c720]
mov qword [rbp + 0x20], rax
lea rax, [0x1400319e0]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 3
lea rdx, [0x140031a10]
lea rcx, [rbp - 0x58]
call fcn.14002f290
ud2
Function at 0x140011af0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002daa0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140018320]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call case.0x14000fad8.248
cmp qword [rbp + 0xfe8], 0
jne 0x140011cc7
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x140011c93
cmp r12, 0x1000
ja 0x140011ce9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140011c67
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140011c10
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x140011c6d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140011c50
jbe 0x140011bc0
jmp 0x140011cd5
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140011b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.1400050c0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.1400050c0
jmp 0x140011c93
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14002f810
jmp 0x140011cfd
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14002f790
ud2
Function at 0x1400187e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140018935
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140018818
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400188f8
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140018917
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018879
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1400188ab
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x1400188af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x1400188b3
cmp eax, 0x6d
jne 0x1400188de
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x1400188b8
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400188e4
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400050c0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400188ee
cmp rax, 1
je 0x140018862
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x14001886c
mov r8d, 0x10
mov rcx, rbx
call fcn.14002e910
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140018825
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14002e910
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140018825
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14002e800
ud2
Function at 0x14001d650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14001f470
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x40]

Function at 0x14001e5c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14001e603
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14000c720]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14002f290
ud2

Function at 0x14001ec60
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
in al, dx
push rax