joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x140004b90
test r8, r8
je 0x140004c48
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x140004c70
cmp edx, 3
jne 0x140004b77
mov ecx, dword [0x1400250e8]
cmp ecx, 0xffffffff
je 0x140004b77
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140004b77
test byte [rax + 0x40], 0x30
je 0x140004ca0
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x140004bd2
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140004bfd
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140004bf3
call r13
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140004d34
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x140004da0
mov ecx, dword [0x1400250e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140004b77
mov rcx, qword [0x14002f200]
test rcx, rcx
je 0x140004b77
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x14002f200], 0
jmp 0x140004b77
lea rdx, [sym.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x14002f200], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x140004d40
test rcx, rcx
je 0x140004cbd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x140004ce4
call sym._pthread_cleanup_dest.part.0
lea r14, [r12 + 0x38]
lea r13, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x140004d80
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x140004d12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x140004c1a
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x140004d4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140004d34
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x140004b77
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x140004d6d
jmp 0x140004d34
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x140004c32

Function at 0x140005840
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400250e8], eax
cmp eax, 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
ret
Function at 0x1400060b0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea r13, [0x1400250d8]
mov r12, rcx
mov rcx, r13
mov ebx, edx
call sym.pthread_mutex_lock
mov rax, qword [0x14002f218]
test rax, rax
je 0x140006130
mov r9, qword [0x14002f220]
lea r8, [rax - 1]
xor ecx, ecx
cmp rax, 1
jne 0x140006106
jmp 0x1400061b0
cmp rax, rcx
je 0x140006130
lea r8, [rax - 1]
cmp r8, rcx
jb 0x140006130
lea rax, [rcx + r8]
shr rax, 1
mov rdx, rax
shl rdx, 4
add rdx, r9
cmp r12, qword [rdx + 8]
je 0x140006150
jb 0x1400060f8
lea rcx, [rax + 1]
cmp r8, rcx
jae 0x140006106
nop dword [rax + rax]
mov rcx, r13
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rax, qword [rdx]
test rax, rax
je 0x140006130
cmp qword [rax + 0x1d8], r12
jne 0x140006130
test byte [rax + 0x40], 0xc
jne 0x140006130
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140006130
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140006130
mov rcx, r13
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x1400061a8
sub ebx, 2
cmp ebx, 0x15
ja 0x1400061bf
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.pthread_cancel
xor eax, eax
jmp 0x14000613d
cmp r12, qword [r9 + 8]
jne 0x140006130
mov rax, qword [r9]
jmp 0x140006153
mov eax, 0x16
jmp 0x14000613d
Function at 0x140006470
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x1400066d1
test rdi, rdi
je 0x1400064aa
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140006517
add ebx, 1
cmp ebx, 1
je 0x140006620
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x1400064e5
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000671a
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x1400066ba
xor edx, edx
test rsi, rsi
je 0x14000658f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x1400066e8
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006680
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140006650
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140006630
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x1400064e5
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400065ff
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400065d5
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x1400065d5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140006690
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000671a
mov qword [r12 + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
test rdi, rdi
je 0x1400066c6
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140006710
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14000658f
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x1400066d1
call sym.replace_spin_keys.part.0
nop
Function at 0x1400198a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400198c8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140019910
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400198e0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14001991c
call rbp
cmp dword [rax], 4
je 0x1400198e0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140019d30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140019d58
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140019da0
cdqe
add rsi, rax
sub rbx, rax
jne 0x140019d70
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140019dac
call rbp
cmp dword [rax], 4
je 0x140019d70
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x180004370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x180004400
cmp r10, r11
jb 0x180004476
cmp r10, rdx
ja 0x18000448a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x180004402
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1800043e0
jmp 0x180004464
ja 0x18000440a
mov r11, r10
cmp rax, r8
jne 0x1800043a4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x180004440
mov rdi, r8
sub ecx, edx
jns 0x18000445b
jmp 0x180004466
cmp r8, rsi
je 0x18000449b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x180004466
xor al, 1
cmp rdi, rsi
jne 0x180004420
jmp 0x180004466
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.180026820
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.180026620
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrary_alloc_srccollections_btreemapentry.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.180026630
ud2
Function at 0x18000a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x18000a5bb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x18000a5bb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x18000a5d6
cmp eax, 0x42
jne 0x18000a5bb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x18000a686
cmp byte [r9 + r11], 0x5f
jne 0x18000a686
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x18000a6ee
mov rcx, rsi
xor edx, edx
call fcn.180005d50
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.180005d50
test al, al
jne 0x18000a781
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18000a612
lea rdx, [0x1800289c3]
mov r8d, 1
call fcn.180002510
test al, al
jne 0x18000a781
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x18000a5ca
xor r14d, r14d
lea rbx, [0x180028d8e]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x18000a644
cmp byte [rax + rcx], 0x45
je 0x18000a7a3
sub r14, 1
jb 0x18000a669
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18000a669
mov r8d, 2
mov rdx, rbx
call fcn.180002510
test al, al
jne 0x18000a781
mov rcx, rsi
call fcn.18000a7c0
test al, al
jne 0x18000a781
mov rax, qword [rsi]
test rax, rax
jne 0x18000a630
jmp 0x18000a5ca
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x18000a748
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x18000a6e2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x18000a6cc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x18000a6bb
add dl, 0xa9
jmp 0x18000a6ca
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x18000a748
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x18000a748
movzx edx, bl
add rax, rdx
jae 0x18000a690
jmp 0x18000a748
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x18000a748
cmp rax, rcx
jae 0x18000a745
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x18000a79b
cmp qword [rsi + 0x20], 0
je 0x18000a7af
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.18000a560
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x18000a5cc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18000a789
lea rax, [0x180028d59]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.180002510
test al, al
je 0x18000a789
mov dil, 2
jmp 0x18000a5ca
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x18000a5ca
mov dil, 1
xor r8d, r8d
jmp 0x18000a74a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x18000a5ca
xor edi, edi
jmp 0x18000a5ca
Function at 0x180010dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x180010df0
test ecx, ecx
jne 0x180010e40
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x180010dfc
test ecx, ecx
jne 0x180010e40
mov rcx, rdi
call fcn.180010ca0
movzx eax, al
test bpl, bpl
jne 0x180010e47
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x180010e33.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x180010fb8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x180010e33.2
xor eax, eax
test bpl, bpl
je 0x180010e0c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x180010f99
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x180010e7a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x180010ef9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x180010ec0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x180010edb
inc rax
dec rdi
cmp rax, 1
jne 0x180010ea0
jmp 0x180010ef9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x180010edb
cmp ebx, 0x5c
je 0x180010edb
inc rax
dec rdi
cmp rax, 1
jne 0x180010ec0
jmp 0x180010ef9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x180010fa7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x180010f23
mov al, 9
cmp rdx, 2
je 0x180010f27
cmp rdx, 1
jne 0x180010f37
cmp byte [r8], 0x2e
jne 0x180010f37
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x180010f37
mov al, 0xa
jmp 0x180010f37
cmp byte [r8], 0x2e
jne 0x180010f37
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x180010e33.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x180010e33.2
mov ecx, 2
jmp case.0x180010e33.2
lea r8, str.library_std_srcpath.rs
call fcn.180026610
ud2
lea r8, str.library_std_srcpath.rs
call fcn.180026610
ud2
Function at 0x18001d1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.18001d070
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x18001d1ef
mov rbx, qword [rbp - 0x30]
mov r14, qword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001d252
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x18001d247
mov rdx, qword [rbp - 0x30]
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x18001d23f
lea rax, [rdx - 1]
mov qword [rbp - 0x18], rax
mov rcx, qword [rdx - 1]
mov qword [rbp - 0x10], rdx
mov rax, qword [rdx + 7]
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 7]
cmp qword [rax + 8], 0
mov rdi, qword [rbp - 0x18]
je 0x18001d232
mov rdx, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.180001540
mov edx, 8
mov rcx, rdi
call fcn.180001540
mov qword [rsi + 8], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x18001d247
mov edx, 2
mov rcx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.180001540
Function at 0x18001fd60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.180025810
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov rsi, rdx
mov r15, rcx
mov qword [rbp + 0xfb0], rcx
mov qword [rbp + 0xfb8], rdx
lea rbx, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea r13, [0x180016320]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xfc0]
mov rcx, r15
mov rdx, rbx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x18001ff68
mov r14, qword [sym.imp.KERNEL32.dll_SleepEx]
lea rbx, [rbp + 0xfc0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r15
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 0
je 0x18001fe31
cmp dword [rbp + 0xfec], 0
jne 0x18001ff7d
mov eax, dword [rbp + 0xff0]
test rax, rax
je 0x18001ff7d
cmp eax, 0x1000
ja 0x18001ffc4
xor r15d, r15d
nop word cs:[rax + rax]
cmp r15, rax
ja 0x18001ffa9
lea rdx, [r15 + rbp]
add rdx, 0xffffffffffffffb0
mov r12, rax
mov r8d, eax
sub r8d, r15d
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov r9, rbx
call rdi
test eax, eax
je 0x18001ff70
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 0
je 0x18001fee0
cmp dword [rbp + 0xfec], 0
jne 0x18001ff76
mov eax, dword [rbp + 0xff0]
add r15, rax
mov rax, r12
cmp r15, r12
jne 0x18001fe80
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov r15, qword [rbp + 0xfe0]
mov rcx, r15
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x18001fe31
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001ff7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15, qword [rbp + 0xfe0]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r15
mov qword [rbp + 0xfe0], rax
mov rdx, rax
call fcn.180026820
jmp 0x18001ffdf
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov qword [rbp + 0xfe0], rax
mov rcx, rax
call fcn.180026620
ud2
Function at 0x180020080
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1800200bf
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x180012370]
mov qword [rbp - 0x28], rax
lea rax, [0x18002b510]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x60], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.180026550
ud2

Function at 0x18c7e24
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18c7e2e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x18c7e57
pop rbp
sub rbp, 0x33
sub rbp, 0x14c7e24
sub rsp, 0x20
jmp 0x18c7e76
mov rax, 0x14c7e24
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x727d20d4
xor byte [rax], dl
inc rax
dec rcx
jne 0x18c7e95
jmp 0x18c7eac
pushfq
pop rbp
cmp eax, 0xd4e85d5f
invalid
Function at 0x140001343
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14001d3fc
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [sym.MZ_zkc4jt_RKXDPRmX9LtVmb5_AeIHFDwxdKR:y_q0a], ax
jne 0x14001d489
movsxd rcx, dword [0x14000003c]
lea rdx, sym.MZ_zkc4jt_RKXDPRmX9LtVmb5_AeIHFDwxdKR:y_q0a
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14001d489
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001d489
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14001d470
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001d46a
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14001d472
add rdx, 0x28
jmp 0x14001d44f
xor edx, edx
test rdx, rdx
jne 0x14001d47b
xor al, al
jmp 0x14001d48f
cmp dword [rdx + 0x24], 0
jge 0x14001d485
xor al, al
jmp 0x14001d48f
mov al, 1
jmp 0x14001d48f
xor al, al
jmp 0x14001d48f
add rsp, 0x18
ret

Function at 0x1400015be
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e1e0
sub rsp, 0x28
xor ecx, ecx
call qword [0x140030178]
test rax, rax
je 0x14001e22a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001e22a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001e22a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001e22a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001e22a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001e22c
xor al, al
add rsp, 0x28
ret
Function at 0x140001712
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
jmp 0x14000f230
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14000f2fc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000f2fc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14000f315
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000f2ec
cmp byte [rax], 0x5c
jne 0x14000f2e6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14000f2e6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14000f2d2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14000f2e3
test r8b, 0x10
jne 0x14000f2e6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14000f2e6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140001177
test edi, edi
jne 0x14000f250
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1400015a5
int3