joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cbeb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd08
movaps xmmword [rsp + 0xcf0], xmm7
movaps xmmword [rsp + 0xce0], xmm6
mov qword [rsp + 0x168], r8
mov rdi, rdx
mov qword [rsp + 0xb0], rcx
mov rdx, qword [rdx + 0x418]
add rdx, 0x10
lea rsi, [rsp + 0x400]
mov rcx, rsi
call fcn.140036c9e
cmp qword [rsi], 0
jne 0x140080fa9
mov rsi, qword [rsp + 0x408]
mov dl, byte [rsp + 0x410]
cmp dword [rsi + 0xe8], 0
je 0x14007cd23
mov byte [rsp + 0x68], dl
lea r14, [rsi + 0x10]
lea r15, [rsi + 0x1c0]
lea r12, [rsi + 0xe8]
call fcn.1400af440
lea r13, [rsp + 0x2b0]
mov qword [r13], rax
mov dword [r13 + 8], edx
mov rbp, qword [rsi + 0xa8]
mov eax, dword [rsi + 0xb0]
mov dword [rsp + 0x30], eax
lea rbx, [rsp + 0x400]
mov r8d, dword [rsi + 0xec]
mov r9d, dword [rsi + 0xf0]
mov rcx, qword [rsi + 0x1c8]
mov rdx, qword [rsi + 0x1d0]
call fcn.14000f513
mov r8d, dword [rax + 0x48]
cmp r8d, 0x3b9aca00
je 0x140080f56
mov rdx, qword [rax + 0x40]
mov rcx, r13
call fcn.1400dce20
cmp rax, rbp
jb 0x14007cd1f
jne 0x14007ccf1
cmp edx, dword [rsp + 0x30]
jbe 0x14007cd1f
mov rcx, rbx
mov rdx, r12
mov r8, r15
call fcn.14001071d
cmp qword [rsp + 0x400], 0
je 0x14007cd1f
mov rcx, r14
mov rdx, rbx
mov r8b, 1
call fcn.14001b650
cmp dword [r12], 0
jne 0x14007cca6
mov dl, byte [rsp + 0x68]
mov rcx, rsi
call fcn.1400e9362
mov ecx, 0x121
lea rax, [rsp + 0x2b0]
lea rdx, [rax + rcx]
mov qword [rsp + 0x5f0], rdx
mov edx, 0x125
lea r8, [rax + rdx]
mov qword [rsp + 0x5e8], r8
mov r8d, 0x119
add r8, rax
mov qword [rsp + 0x570], r8
mov r8d, 0x11d
add r8, rax
mov qword [rsp + 0x568], r8
lea rax, [rsp + 0x918]
add rcx, rax
mov qword [rsp + 0x618], rcx
add rdx, rax
mov qword [rsp + 0x610], rdx
xorps xmm6, xmm6
lea rax, [rdi + 0x3b8]
mov qword [rsp + 0x250], rax
lea rax, [rdi + 0x410]
mov qword [rsp + 0x628], rax
lea rax, [rdi + 0x428]
mov qword [rsp + 0x620], rax
lea rax, [rdi + 0x3f0]
mov qword [rsp + 0x210], rax
lea rax, [rdi + 0x3c0]
lea rcx, [rdi + 0x48]
mov qword [rsp + 0x88], rcx
lea rcx, [rdi + 0x3a8]
mov qword [rsp + 0x598], rcx
lea rcx, [rdi + 0x50]
mov qword [rsp + 0x5f8], rcx
lea rcx, [rdi + 0x58]
mov qword [rsp + 0x560], rcx
lea rcx, [rdi + 0x1c8]
mov qword [rsp + 0x240], rcx
lea rcx, [rdi + 0x230]
mov qword [rsp + 0x1b0], rcx
lea r15, [rdi + 0x1a0]
lea rcx, [rdi + 0x238]
mov qword [rsp + 0x248], rcx
lea rcx, [rdi + 0x358]
mov qword [rsp + 0x578], rcx
lea rcx, [rdi + 0x494]
mov qword [rsp + 0x608], rcx
lea rcx, [rdi + 0x4c9]
mov qword [rsp + 0x600], rcx
lea r13, [rsp + 0x400]
mov qword [rsp + 0x580], rcx
mov dword [rsp + 0xbc], ecx
mov qword [rsp + 0x198], rcx
mov dword [rsp + 0x17c], ecx
mov dword [rsp + 0x180], ecx
mov qword [rsp + 0x588], rcx
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x60], r15
Function at 0x14009bd70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.1400051b0
cmp rax, rcx
je 0x14009bd95
cmp rdx, 4
jae 0x14009bd98
xor eax, eax
xor r8d, r8d
jmp 0x14009be30
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14012d090]
movdqa xmm3, xmmword [0x14012d0a0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14009bdc0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14009be47
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14009be30
ret
Function at 0x14009cd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x14009cdab
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14009cdab
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x14009cdc6
cmp eax, 0x42
jne 0x14009cdab
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14009ce76
cmp byte [r8 + r11], 0x5f
jne 0x14009ce76
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14009cede
mov rcx, rsi
xor edx, edx
call fcn.1400987e0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1400987e0
test al, al
jne 0x14009cf71
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14009ce02
lea rdx, [0x140173df3]
mov r8d, 1
call fcn.1400057b0
test al, al
jne 0x14009cf71
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14009cdba
xor r14d, r14d
lea rbx, [0x140174161]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14009ce34
cmp byte [rax + rcx], 0x45
je 0x14009cf93
sub r14, 1
jb 0x14009ce59
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14009ce59
mov r8d, 2
mov rdx, rbx
call fcn.1400057b0
test al, al
jne 0x14009cf71
mov rcx, rsi
call fcn.14009a000
test al, al
jne 0x14009cf71
mov rax, qword [rsi]
test rax, rax
jne 0x14009ce20
jmp 0x14009cdba
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x14009cf38
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x14009ced2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14009cebc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14009ceab
add dl, 0xa9
jmp 0x14009ceba
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14009cf38
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14009cf38
movzx edx, bl
add rax, rdx
jae 0x14009ce80
jmp 0x14009cf38
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14009cf38
cmp rax, rcx
jae 0x14009cf35
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14009cf8b
cmp qword [rsi + 0x20], 0
je 0x14009cf84
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14009cd50
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14009cdbc
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14009cf79
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_____::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x140174140]
test r9b, r9b
cmovne rdx, rax
call fcn.1400057b0
test al, al
je 0x14009cf79
mov dil, 2
jmp 0x14009cdba
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14009cdba
mov dil, 1
xor r9d, r9d
jmp 0x14009cf3a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14009cdba
Function at 0x14009f108
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
movabs rax, 0x8000000000000000
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
cmp qword [rcx + 0x18], rax
je 0x14009f174
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x90], rdx
cmp qword [rcx + 0x30], rax
je 0x14009f1af
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x14009f1a6
mov r8, qword [rcx + 0x38]
xor edx, edx
lea r9, [0x14017ed40]
xor r10d, r10d
movzx r11d, byte [r8 + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp rax, r10
jne 0x14009f193
jmp 0x14009f1a8
xor edx, edx
mov dword [rsp + 0x98], edx
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x14009f204
mov rax, r14
shr rax, 0x3c
jne 0x14009f2c8
mov rbx, qword [rcx + 8]
lea rdi, [r14*8]
mov al, byte [0x140195158]
xor ecx, ecx
mov rdx, rdi
call fcn.1400dd0f0
test rax, rax
je 0x14009f2cd
mov rsi, rax
xor eax, eax
mov rcx, qword [rbx + rax*8]
mov qword [rsi + rax*8], rcx
inc rax
cmp r14, rax
jne 0x14009f1ef
mov eax, r14d
jmp 0x14009f20b
xor eax, eax
mov esi, 8
lea rcx, [rsp + 0x60]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x14009f263
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov ebx, 1
jmp 0x14009f29d
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov al, byte [0x140195158]
mov edx, 0x20
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x14009f2da
mov rdi, rax
mov eax, 1
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r15
xor ebx, ebx
test r14, r14
je 0x14009f2b3
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, rsi
call fcn.1400f4d54
mov rax, rbx
mov rdx, rdi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140002480
mov ecx, 8
mov rdx, rdi
call fcn.1400024c0
mov ecx, 8
mov edx, 0x20
call fcn.1400024c0
int3

Function at 0x14009fba3
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
mov qword [r8], 0
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x14009fbcf
mov rdx, qword [rsp + 0x20]
jmp 0x14009fbd7
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x1400a1471
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400a149d
xor eax, eax
jmp 0x1400a14aa
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1400a164b
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call sub.ws2_32.dll_connect
test eax, eax
je 0x1400a166e
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
jmp 0x1400a1670
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400acdc0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400ace45
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400ace86
cmp dword [rsp + 0x2c], 0
je 0x1400ace6a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400aceac
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140195128]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140195128], rsi
jne 0x1400ace20
mov byte [0x140195120], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400ace7c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x1400acef6
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400ace6f
mov edi, dword [rsp + 0x28]
jmp 0x1400ace7c
mov edi, dword [rsi + 0x18]
jmp 0x1400ace7a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x1401776d0]
lea r9, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.1400ad4c0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x14017d4e0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140004c80
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x14017d4e0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1400ad500
int3
Function at 0x1400ad3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14012a0d0]
test ecx, ecx
je 0x1400ad479
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400ad3d4
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400ad3d4
add rdi, 0x10
jmp 0x1400ad46f
mov ecx, dword [0x14012a0d0]
test ecx, ecx
je 0x1400ad48c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400ad46d
mov rsi, rax
test rax, rax
jne 0x1400ad43c
movzx eax, byte [0x140195158]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400ad4af
mov rsi, rax
lea rax, [0x14012a0b8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14012a0d0]
test ecx, ecx
je 0x1400ad49f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400ad46f
test rcx, rcx
je 0x1400ad46f
lock dec qword [rcx]
jne 0x1400ad46f
call fcn.1400acd60
jmp 0x1400ad46f
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14012a0b8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ad3b6
lea rcx, [0x14012a0b8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ad3e4
lea rcx, [0x14012a0b8]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ad434
mov ecx, 8
mov edx, 0x18
call fcn.1400024c0
int3
Function at 0x1400ae110
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1401772e0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1400ae181
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400ae1b7
test eax, eax
js 0x1400ae192
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400ae1aa
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140177348]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400ad320
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400ac680
mov ecx, 7
int 0x29
ud2

Function at 0x1400ae6a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14012a0b0]
test ecx, ecx
je 0x1400ae75a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400ae6d0
cmp qword [rax + 8], 0
je 0x1400ae6d0
add rax, 0x10
jmp 0x1400ae754
mov ecx, dword [0x14012a0b0]
test ecx, ecx
je 0x1400ae76d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400ae752
mov rsi, rax
test rax, rax
jne 0x1400ae738
movzx eax, byte [0x140195158]
mov edx, 0x20
xor ecx, ecx
call fcn.1400dd0f0
test rax, rax
je 0x1400ae790
mov rsi, rax
lea rax, [0x14012a098]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14012a0b0]
test ecx, ecx
je 0x1400ae780
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x1400ae754
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14012a098]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ae6b5
lea rcx, [0x14012a098]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ae6e0
lea rcx, [0x14012a098]
call fcn.1400acdc0
mov ecx, eax
jmp 0x1400ae730
mov ecx, 8
mov edx, 0x20
call fcn.1400024c0
int3
Function at 0x1400b2520
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.1400caf10
mov rdi, rdx
test rax, rax
je 0x1400b25b0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.1400ac5c0
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1400cb170
cmp dword [rsp + 0x38], 2
jne 0x1400b25df
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1400b262b
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x1400b2657
lea rcx, [rsp + 0x88]
call fcn.1400ac5c0
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x1400b26b5
mov qword [rsp + 0x80], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x1400b2731
mov rbx, qword [rsp + 0x80]
jmp 0x1400b26b7
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x1400b2720
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x1400b2720
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x1400b275d
mov qword [rsi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400b275d
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400ac5c0
mov qword [rsi], 0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400b259f
Function at 0x1400cb9c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.1400aecb0
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
jne 0x1400cba0f
lea rcx, [rsp + 0xb0]
call fcn.1400ac5c0
mov qword [rsi], rdi
jmp 0x1400cbbf3
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x1400cbaa0
jmp 0x1400cba7f
jae 0x1400cbb47
cmp r8, 0x201
jae 0x1400cbaa0
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x1400cbae7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x1400cbac7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1400af1b0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x1400cbb0e
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400cbb86
mov r8d, r15d
cmp r12, r8
jne 0x1400cba70
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400cbc23
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x1400cba7f
jmp 0x1400cbaa0
cmp rdi, r8
jb 0x1400cbc3d
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.1400b0c20
movabs rdi, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x1400cbba7
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x60], rdi
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x1400cbbc4
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, qword [rsp + 0x28]
call fcn.1400f4d54
cmp qword [rsp + 0x60], rdi
jne 0x1400cbc08
mov qword [rsi], rdi
lea rcx, [rsp + 0x68]
call fcn.1400ac5c0
cmp qword [rsp + 0x40], 0
je 0x1400cbbf3
mov rcx, qword [0x1401950f0]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.1400f4d54
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x1400cbbe0
jmp 0x1400cbbf3
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140005ad0
jmp 0x1400cbc52
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.140005730
ud2
Function at 0x1400cd580
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
sub esp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1401772e0]
add eax, 0xa9d4a
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
ror dword [rdi], 0x57
ror byte [rdi], 0x11
and al, 0x38
and al, 0x38
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
rol byte [rbp + 0x31], 0xc9
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1400cd5ea
mov rcx, rdi
mov edx, 0xffffffff
invalid
invalid
invalid
call sub.KERNEL32.dll_WaitForSingleObject
invalid
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1400cd5f9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400cd630
cmp eax, 0x103
je 0x1400cd63a
test eax, eax
js case.0x1400cd403.173
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400cd630
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140177348]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
nop
add byte [rax], al
add byte [rax - 0x73], cl
and al, 0x58
lea rdx, [rsp + 0x78]
call fcn.1400ad320
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x70]
call fcn.1400ac680
std
invalid
mov ecx, 7
add byte [rax], al
add ch, cl
sub dword [rdi], ecx
invalid

Function at 0x1400cee10
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.1400aecb0
mov rax, qword [rsp + 0x28]
and al, 0x28