joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3d30
Capabilities:
Get disk information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov rbx, r9
mov r14, r8
mov qword [rsp + 0x48], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov rsi, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x1e0]
mov qword [rsp + 0x70], rdx
mov r8, qword [rsp + 0x1d8]
mov qword [rsp + 0x68], r8
mov r9, qword [rsp + 0x1d0]
mov qword [rsp + 0x60], r9
mov r10, qword [rsp + 0x1c8]
mov qword [rsp + 0x58], r10
mov r11, qword [rsp + 0x1c0]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], r11
mov qword [rsp + 0x100], r10
mov qword [rsp + 0x108], r9
mov qword [rsp + 0x110], r8
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0x120], rax
call fcn.1400900e0
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rdx
lea rcx, [rsp + 0xe0]
call fcn.1400b71b0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xc0]
call fcn.1400e8ec0
mov rcx, rax
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
xor eax, eax
mov r8d, eax
call fcn.1400c1dd0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xc0]
call fcn.1400e8ec0
mov rcx, rax
xor r8d, r8d
call fcn.1400c1d30
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x94], eax
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
xor eax, eax
mov r8d, eax
call fcn.1400e8fd0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
xor eax, eax
mov r8d, eax
call fcn.1400e8fd0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rsi, rax
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
xor eax, eax
mov r8d, eax
call fcn.1400e8fd0
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xd0]
call fcn.1400e8ec0
mov rcx, rax
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
xor eax, eax
mov r8d, eax
call fcn.1400c1b50
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xd0]
call fcn.1400e8ec0
mov rcx, rax
xor r8d, r8d
call fcn.1400c1bf0
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x94]
mov r9, qword [rsp + 0x98]
mov r11, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x38], eax
call qword [sym.imp.kernel32.dll_GetVolumeInformationW]
mov rcx, qword [rsp + 0xb0]
mov edx, eax
call fcn.1400cf040
mov rax, qword [rsp + 0xb8]
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a4170
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x20], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x70], rcx
call fcn.1400900e0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x60]
call fcn.1400b71b0
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
call fcn.1400e8ec0
mov rcx, rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
xor eax, eax
mov r8d, eax
call fcn.1400c1e70
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
call fcn.1400e8ec0
mov rcx, rax
xor r8d, r8d
call fcn.1400c1c90
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r8d, eax
call qword [sym.imp.kernel32.dll_GetVolumePathNamesForVolumeNameW]
mov rcx, qword [rsp + 0x40]
mov edx, eax
call fcn.1400cf040
mov rax, qword [rsp + 0x48]
add rsp, 0x88
ret

Function at 0x1400b4fb0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call qword [sym.imp.kernel32.dll_GetSystemInfo]
nop
add rsp, 0x28
ret

Function at 0x1400b4fd0
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x28], r9
mov rax, r8
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov eax, edx
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
mov rax, rcx
mov ecx, dword [rsp + 0x3c]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
mov rcx, qword [rsp + 0x40]
mov edx, eax
call fcn.1400cf040
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret

Function at 0x1400b5030
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x30]
mov edx, eax
call fcn.1400cf040
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x1400b7c70
Capabilities:
Get local ipv4 addresses

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r8
mov r9d, edx
mov rdx, qword [rsp + 0x28]
mov dword [rsp + 0x4c], r9d
mov r10d, ecx
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x48], r10d
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x60], r10d
mov dword [rsp + 0x64], r9d
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
xor eax, eax
mov r8d, eax
call fcn.1400e8f30
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
xor eax, eax
mov r8d, eax
call fcn.1400c25e0
mov ecx, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
mov r8, qword [rsp + 0x50]
mov r9, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
nop
add rsp, 0xa8
ret
Function at 0x1400b8830
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], 0xfffffffffffffffe
mov rsi, r9
mov qword [rbp], rsi
mov rdi, r8
mov qword [rbp + 8], rdi
mov rbx, rdx
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp + 0x180]
mov qword [rbp + 0x20], rdx
mov r8, qword [rbp + 0x178]
mov qword [rbp + 0x28], r8
mov r9, qword [rbp + 0x170]
mov qword [rbp + 0x30], r9
mov r10, qword [rbp + 0x168]
mov qword [rbp + 0x38], r10
mov r11, qword [rbp + 0x160]
mov qword [rbp + 0x40], r11
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], r11
mov qword [rbp + 0xa8], r10
mov qword [rbp + 0xb0], r9
mov qword [rbp + 0xb8], r8
mov qword [rbp + 0xc0], rdx
mov qword [rbp + 0xc8], rax
mov byte [rbp + 0x7f], 0
mov byte [rbp + 0x7f], 1
call fcn.1400e8b70
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rax
jmp 0x1400b8902
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x58]
call fcn.1400e8960
mov qword [rbp - 8], rax
jmp 0x1400b8921
mov rcx, qword [rbp + 0x10]
mov byte [rbp + 0x7f], 0
call fcn.1400900e0
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
jmp 0x1400b8938
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0x68]
call fcn.1400b71b0
mov qword [rbp - 0x20], rax
jmp 0x1400b8957
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
xor eax, eax
mov r8d, eax
call fcn.1400e9020
mov qword [rbp - 0x28], rax
jmp 0x1400b8985
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
xor eax, eax
mov r8d, eax
call fcn.1400c2810
mov qword [rbp - 0x30], rax
jmp 0x1400b89b3
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
xor eax, eax
mov r8d, eax
call fcn.1400c26d0
mov qword [rbp - 0x38], rax
jmp 0x1400b89e1
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
xor eax, eax
mov r8d, eax
call fcn.1400e8fd0
mov qword [rbp - 0x40], rax
jmp 0x1400b8a0f
mov r9, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov r10, qword [rbp - 0x38]
mov r11, qword [rbp - 0x40]
mov rax, rsp
mov qword [rax + 0x28], r11
mov qword [rax + 0x20], r10
mov rax, qword [sym.imp.advapi32.dll_RegQueryValueExW]
call rax
mov dword [rbp - 0x44], eax
jmp 0x1400b8a40
mov eax, dword [rbp - 0x44]
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dcf10
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
call fcn.1400900e0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x28]
call fcn.1400b71b0
mov rdx, qword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
nop
add rsp, 0x48
ret

Function at 0x140120ac0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x140120b00
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140120ba0
jmp 0x140120b8f
jae 0x140120c5f
cmp r8, 0x201
jae 0x140120ba0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140120bf7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140120bcf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14013dbc0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140120c20
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140120ccb
mov r8d, r13d
cmp r12, r8
jne 0x140120b80
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140120cff
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140120b8f
jmp 0x140120ba0
cmp r14, r8
jb 0x140120d19
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140123300
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140120cb4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400065d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140120c9f
jmp 0x140120cb4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14013eca0
jmp 0x140120d2e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14013f1f0
ud2
Function at 0x140128d00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140158730]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140128d38
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140128d96
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140128dc3
test eax, eax
js 0x140128da2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140128db9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140158798]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140122ee0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14011f040
mov ecx, 7
int 0x29
ud2

Function at 0x140129810
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140198181]
mov ecx, 0x10
mov edx, 8
call fcn.1400065c0
test rax, rax
je 0x1401298fb
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401299b0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401298ed
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1401298aa
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401298c4
mov r8, qword [rax + 0x10]
call fcn.1400065d0
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x20]
call fcn.1400065d0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14013ea00
ud2
Function at 0x14013af80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14013b00a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14013b000
cmp r11, r10
ja 0x14013b086
cmp r10, rdx
ja 0x14013b098
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14013b002
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14013afe0
jmp 0x14013b067
ja 0x14013b00a
mov r11, r10
cmp rax, r8
jne 0x14013afa7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14013b06b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14013b040
mov r8, r10
sub ecx, r9d
jns 0x14013b05e
jmp 0x14013b06d
cmp r10, rdx
je 0x14013b07a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14013b06d
xor al, 1
cmp r8, rdx
jne 0x14013b020
jmp 0x14013b06d
xor eax, eax
jmp 0x14013b06d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14013eb60
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14013f260
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14013f1f0
int3

Function at 0x14013d478
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14013d4c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14013d4c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14013d4c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14013d4c2
cmp dword [rcx + 0x84], 0xe
jbe 0x14013d4c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14013d4c4
xor al, al
add rsp, 0x28
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002bbe0]
mov dword [rax], 1
mov rax, qword [0x14002bbf0]
mov dword [rax], 1
mov rax, qword [0x14002bc00]
mov dword [rax], 1
mov rax, qword [0x14002bbd0]
mov dword [rax], 1
mov rax, qword [0x14002ba90]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140003b0d
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140003b2e
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sym.fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x140003cae
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, r13
mov edx, 1
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp sym.fflush

Function at 0x1400096e7
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
cmp qword [0x140034150], 0
jne 0x140009706
add rsp, 0x38
pop r12
pop r13
jmp sym.writeToStdErr__system_u4000
lea r13, [rsp + 0x20]
mov rdx, rcx
mov rcx, r13
call sym.cstrToNimstr
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x140034150]
test r12, r12
je 0x140009739
test byte [r12 + 7], 0x40
jne 0x140009739
mov rcx, r12
call sym.deallocImpl__system_u1765
lea rcx, [0x1400262c0]
call sym.__emutls_get_address
cmp byte [rax], 0
je 0x140009773
mov byte [rax], 0
lea rcx, [0x140026200]
call sym.__emutls_get_address
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop r12
pop r13
jmp sym.eqcopy___stdZtypedthreads_u169
add rsp, 0x38
pop r12
pop r13
ret

Function at 0x14000977c
Capabilities:
Write file on windows

Disassembly:
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
lea rcx, [0x140027f38]
test rdx, rdx
je 0x140009793
lea rcx, [rax + 8]
jmp sym.showErrorMessage__system_u4005
Function at 0x14000a7b7
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rax, str.echoBinSafe
lea rbp, [0x140027f88]
xor ebx, ebx
lea r13, [0x140034120]
lea r15, [0x1400262c0]
mov rsi, rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov qword [rsp + 0x48], rbp
lea r14, [rsp + 0x20]
mov qword [rsp + 0x40], 0
mov word [rsp + 0x50], 0
call sym.nimFrame.constprop.0_7
mov rcx, r13
mov qword [rsp + 0x40], 0xad7
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [sym.__acrt_iob_func]
cmp rbx, rdi
jl 0x14000a88f
mov qword [rsp + 0x40], 0xaf3
mov ecx, 1
mov qword [rsp + 0x48], rbp
call r12
mov r8d, 1
mov edx, 1
lea rcx, [0x140027f7b]
mov r9, rax
call sym.fwrite
mov ecx, 1
mov qword [rsp + 0x40], 0xaf4
call r12
mov rcx, rax
call sym.fflush
mov rcx, r13
mov qword [rsp + 0x40], 0xaf8
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14000a8d8
mov ecx, 1
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], 0xaef
call r12
xor r8d, r8d
mov rdx, r14
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call sym.writeWindows__system_u9044
mov rcx, r15
call sym.__emutls_get_address
cmp byte [rax], 0
jne 0x14000a8d8
inc rbx
jmp 0x14000a82d
call sym.popFrame_7
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b2d9
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rax, str.rawParseInt
mov qword [rsp + 0x38], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x30]
lea rax, str.C:Users_vikraAppDataLocalMicrosoftWinGetPackages_nim.nim_Microsoft.Winget.Source_8wekyb3d8bbwe_nim_2.0.8libpureparseutils.nim
mov word [rsp + 0x50], 0
mov rdi, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
call sym.nimFrame.constprop.0_8
test rsi, rsi
jle 0x14000b340
mov al, byte [rbp]
cmp al, 0x2b
je 0x14000b345
xor r12d, r12d
cmp al, 0x2d
sete r12b
lea r13, [r12 + r12 - 1]
jmp 0x14000b34f
xor r12d, r12d
jmp 0x14000b34b
mov r12d, 1
or r13, 0xffffffffffffffff
mov qword [rsp + 0x40], 0x1b4
cmp r12, rsi
jge 0x14000b504
mov al, byte [rbp + r12]
sub eax, 0x30
cmp al, 9
ja 0x14000b504
mov qword [rdi], 0
lea r14, [rsp + 0x20]
movabs r15, 0x8000000000000000
movzx ebx, byte [rbp + r12]
lea eax, [rbx - 0x30]
cmp al, 9
jbe 0x14000b3a6
mov rcx, qword [rdi]
cmp r13, 0xffffffffffffffff
jne 0x14000b4c7
jmp 0x14000b4b9
sub rbx, 0x30
mov r8, r14
mov rcx, r15
mov qword [rsp + 0x40], 0x1b8
mov rdx, rbx
call sym.nimAddInt_3
test al, al
jne 0x14000b4f3
mov rax, qword [rsp + 0x20]
mov r8d, 0xa
mov rcx, qword [rdi]
cqo
idiv r8
cmp rax, rcx
jle 0x14000b405
mov qword [rsp + 0x40], 0x1bb
call sym.integerOutOfRangeError__pureZparseutils_u325
mov rcx, qword [0x14002ba70]
call sym.__emutls_get_address
cmp byte [rax], 0
je 0x14000b445
jmp 0x14000b504
lea r8, [rsp + 0x28]
mov edx, 0xa
mov qword [rsp + 0x40], 0x1b9
call sym.nimMulInt64
test al, al
jne 0x14000b4f3
mov rax, qword [rsp + 0x28]
mov rdx, rax
sub rdx, rbx
xor rax, rdx
xor rbx, rdx
not rax
or rax, rbx
jns 0x14000b4f3
mov qword [rdi], rdx
mov r8, r14
mov edx, 1
mov rcx, r12
mov qword [rsp + 0x40], 0x1bc
call sym.nimAddInt_3
test al, al
jne 0x14000b4f3
mov qword [rsp + 0x40], 0x1bd
mov r12, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
cmp r12, rsi
jge 0x14000b394
test r12, r12
jns 0x14000b495
lea rdx, [rsi - 1]
mov rcx, r12
call sym.raiseIndexError2
jmp 0x14000b504
cmp byte [rbp + r12], 0x5f
jne 0x14000b387
mov edx, 1
mov rcx, r12
call sym.nimAddInt_3
test al, al
jne 0x14000b4f3
mov r12, qword [rsp + 0x28]
jmp 0x14000b479
mov eax, 1
shl rax, 0x3f
cmp rcx, rax
je 0x14000b4e3
lea r8, [rsp + 0x28]
mov rdx, r13
mov qword [rsp + 0x40], 0x1c1
call sym.nimMulInt64
test al, al
je 0x14000b4fa
jmp 0x14000b4f3
mov qword [rsp + 0x40], 0x1bf
call sym.integerOutOfRangeError__pureZparseutils_u325
jmp 0x14000b504
call sym.raiseOverflow
jmp 0x14000b504
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x14000b507
xor r12d, r12d
call sym.popFrame_8
mov rax, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret