joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x140043e38]
mov rdx, qword [0x140043e48]
sub rdx, rax
cmp rcx, 0xffffffffffffffef
ja 0x140002488
lea rbx, [rcx + 0xf]
and rbx, 0xfffffffffffffff0
cmp rdx, rbx
jae 0x140002471
cmp rbx, 0xffff
ja 0x1400023da
cmp dword [0x140035264], 1
mov r8d, dword [0x140043d90]
mov edx, 0x10000
sbb eax, eax
and eax, 0xffffffc4
cmp qword [0x140043d88], 1
adc rdx, 0
lea r9d, [rax + 0x40]
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, 0xfff
jne 0x1400023f5
cmp qword [0x140043eb0], 0x3ff
jbe 0x1400023c2
lea rcx, [0x140038109]
mov qword [rsp + 0x28], rax
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14000249b
mov rdx, rbx
lea rcx, [0x140038120]
call sym.GC_default_warn_proc.lto_priv.0
mov rcx, rbx
call sym.GC_win32_get_mem
test rax, rax
je 0x1400023ee
add qword [0x140043df8], rbx
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x1400380f1]
mov qword [rsp + 0x28], rax
call sym.GC_default_on_abort.lto_priv.0
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rsi
mov rdx, qword [0x140043eb0]
mov rax, qword [rsp + 0x28]
cmp rdx, 0x3ff
jbe 0x14000243e
lea rcx, [0x140038109]
call sym.GC_default_on_abort.lto_priv.0
call rsi
mov rdx, qword [0x140043eb0]
mov rax, qword [rsp + 0x28]
add qword [0x140043df8], 0x10000
lea rcx, [rdx + 1]
mov qword [0x140043eb0], rcx
lea rcx, [0x140043dc0]
mov qword [rcx + rdx*8 + 0x163d0], rax
lea rdx, [rax + 0x10000]
mov qword [0x140043e48], rdx
add rbx, rax
mov qword [0x140043e38], rbx
add rsp, 0x38
pop rbx
pop rsi
ret
mov rbx, 0xfffffffffffffff0
cmp rdx, 0xffffffffffffffef
jbe 0x1400023da
jmp 0x140002471
mov rdx, qword [0x140043eb0]
jmp 0x14000243e

Function at 0x140003be0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov esi, dword [0x14006e420]
mov dword [0x14006e42c], 1
test esi, esi
jne 0x140003c18
mov dword [0x14006e42c], 0
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edi, esi
lea rbx, [rsp + 0x20]
lea rbp, [0x14006e2e0]
shl rdi, 3
mov rdx, rbp
mov rcx, rbx
mov r8, rdi
call sym.memcpy
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov dword [0x14006e420], 0
add rdi, rbx
call sym.memset
mov edx, esi
lea rcx, str.Found__u_leaked_objects:_n
call sym.GC_err_printf
mov rsi, qword [rbx]
add rbx, 8
mov rcx, rsi
call sym.GC_default_print_heap_obj_proc
mov rcx, rsi
call sym.GC_free
cmp rdi, rbx
jne 0x140003c60
lea rcx, str.GC_ABORT_ON_LEAK
call sub.ucrtbase.dll_getenv
test rax, rax
je 0x140003bff
lea rcx, str.Leaked_or_smashed_objects_encountered
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140003bff
Function at 0x1400044e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r14d, r14d
cmp dword [0x140043d94], 2
mov rbx, rcx
mov edi, edx
je 0x140004627
lea r12, [0x140035040]
mov rax, qword [r12 + 8]
lea rbp, [0x140043dc0]
lea rsi, [rax + 8]
lea r13, [rax + 0x408]
test rax, rax
je 0x1400045d6
mov r15, qword [rsi]
nop
test r15, r15
je 0x1400045c9
test rbx, rbx
je 0x140004548
call rbx
test eax, eax
jne 0x140004614
mov rdx, r15
mov rcx, qword [0x140043e78]
shr rdx, 0x16
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbp + rax*8 + 0x263d0]
cmp rdx, qword [rax + 0x2010]
jne 0x140004588
jmp 0x14000458d
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x14000458d
cmp rcx, rax
jne 0x140004578
mov rdx, r15
shr rdx, 0xc
and edx, 0x3ff
mov rax, qword [rax + rdx*8]
mov rcx, qword [rax]
mov qword [rsi], rcx
test edi, edi
je 0x140004600
mov rdx, qword [0x140043988]
movzx r9d, word [rax + 0x1a]
sub rdx, 1
cmp r9, rdx
je 0x140004600
mov r15, rcx
test r15, r15
jne 0x140004539
add rsi, 8
cmp r13, rsi
jne 0x14000452c
add r12, 0x20
lea rax, [0x1400350a0]
cmp rax, r12
jne 0x14000450c
cmp dword [0x140043d94], 2
je 0x140004635
mov eax, 1
jmp 0x140004616
mov rdx, qword [rax + 0x20]
mov rcx, r15
call sym.GC_reclaim_small_nonempty_block.constprop.0
mov r15, qword [rsi]
jmp 0x140004530
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
jmp 0x140004505
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r8d, r8d
lea rcx, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
sub eax, r14d
mov edx, eax
call sym.GC_log_printf
jmp 0x1400045f3
Function at 0x140004be0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rcx
shl rbp, 4
mov rcx, rbp
call sym.GC_scratch_alloc.lto_priv.0
mov edx, 1
mov rbx, rax
mov eax, dword [0x140043978]
test eax, eax
je 0x140004c2b
mov eax, dword [0x140043960]
xor edx, edx
mov esi, eax
or esi, dword [0x14006e428]
setne dl
test eax, eax
sete al
movzx eax, al
mov rsi, qword [0x140043e50]
mov dword [0x14006e428], eax
mov dword [0x140043e94], 0
test rsi, rsi
je 0x140004cb0
test rbx, rbx
je 0x140004c98
mov ecx, dword [0x140043d94]
test edx, edx
jne 0x140004cd8
lea rax, [rbx + rbp]
mov qword [0x140043e50], rbx
mov qword [0x140043e88], rdi
mov qword [0x140043e58], rax
test ecx, ecx
jne 0x140004d58
sub rbx, 0x10
mov qword [0x140043e60], rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rdi
lea rcx, str.GC_Warning:_Failed_to_grow_mark_stack_to__ld_frames_n
call sym.GC_default_warn_proc.lto_priv.0
mov rbx, qword [0x140043e50]
jmp 0x140004c7b
test rbx, rbx
je 0x140004d86
lea rax, [rbx + rbp]
mov qword [0x140043e50], rbx
mov qword [0x140043e88], rdi
mov qword [0x140043e58], rax
jmp 0x140004c7b
mov rax, qword [0x14006e4b0]
mov r8, qword [0x140043e88]
lea r12, [rax - 1]
mov rdx, rax
shl r8, 4
and r12, rsi
sub rdx, r12
test r12, r12
cmovne r12, rdx
cmp r12, r8
jb 0x140004d28
test ecx, ecx
je 0x140004cb9
lea rcx, str.Recycle__lu__lu_scratch_allocated_bytes_at__p_n
mov r9, rsi
xor edx, edx
call sym.GC_log_printf
mov ecx, dword [0x140043d94]
jmp 0x140004c5a
mov r13, r8
neg rax
sub r13, r12
and r13, rax
test ecx, ecx
jne 0x140004d72
test r13, r13
je 0x140004d49
lea rcx, [rsi + r12]
mov rdx, r13
call sym.GC_add_to_heap
mov ecx, dword [0x140043d94]
jmp 0x140004c5a
mov edx, edi
lea rcx, str.Grew_mark_stack_to__lu_frames_n
call sym.GC_log_printf
mov rbx, qword [0x140043e50]
jmp 0x140004c7b
mov r9, rsi
mov edx, r13d
lea rcx, str.Recycle__lu__lu_scratch_allocated_bytes_at__p_n
call sym.GC_log_printf
jmp 0x140004d38
lea rcx, str.No_space_for_mark_stack_n
call sym.GC_err_printf
xor ecx, ecx
call sym.GC_default_on_abort.lto_priv.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140004db0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor edx, edx
mov rax, qword [rcx]
cmp dword [rax], 0xc0000005
je 0x140004dd0
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
ret
cmp qword [rax + 0x20], 1
jne 0x140004dc3
mov r9, qword [rax + 0x28]
lea rbx, [0x140043dc0]
mov r10, qword [0x14006e4b0]
mov rdx, r9
shr rdx, 0x16
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbx + rax*8 + 0x263d0]
cmp rdx, qword [rax + 0x2010]
je 0x140004e2d
mov r8, qword [0x140043e78]
jmp 0x140004e28
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x140004e2d
cmp r8, rax
jne 0x140004e18
mov rdx, r9
shr rdx, 0xc
and edx, 0x3ff
cmp qword [rax + rdx*8], 0
jne 0x140004e67
mov rax, qword [0x14006e2c0]
cmp rax, 0xffffffffffffffff
je 0x140004e60
add rsp, 0x28
pop rbx
pop rsi
jmp rax
xor edx, edx
jmp 0x140004dc3
cmp dword [0x140035264], 1
mov rsi, r10
mov rdx, r10
sbb eax, eax
neg rsi
and rsi, r9
and eax, 0xffffffc4
lea r9, [0x14006e4b8]
lea r8d, [rax + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140004efa
mov rax, qword [0x14006e4b0]
xor edx, edx
mov r8d, 1
shr rax, 0xc
je 0x140004ef0
nop dword [rax]
mov rcx, rsi
mov r11, r8
shr rcx, 0xc
and ecx, 0x3ffff
mov rax, rcx
shl r11, cl
shr rax, 6
add rax, 0x1c79
lock or qword [rbx + rax*8], r11
mov rax, qword [0x14006e4b0]
shr rax, 0xc
add rdx, 1
add rsi, 0x1000
cmp rdx, rax
jb 0x140004eb0
mov edx, 0xffffffff
jmp 0x140004dc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.un_VirtualProtect_failed:_errcode_0x_X_n
mov edx, eax
call sym.GC_log_printf
lea rcx, str.un_VirtualProtect_failed
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140004e97
Function at 0x140007c40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r11, rcx
mov rcx, qword [0x14006e4b0]
shl rdx, 0xc
mov rbx, r11
lea r10, [r11 + rdx]
mov rax, rcx
lea r9, [rcx + r10 - 1]
neg rax
and rbx, rax
and r9, rax
lea rax, [rbx + 0x1000]
cmp r9, rax
je 0x140007d20
xor r8d, 1
mov rax, rbx
mov edi, 1
and r8d, 1
lea rsi, [0x140043dc0]
cmp rbx, r9
jae 0x140007ce6
nop dword [rax + rax]
cmp rax, r11
setb dl
cmp rax, r10
setae cl
or dl, cl
jne 0x140007cb5
test r8b, r8b
je 0x140007cdb
mov rcx, rax
mov r14, rdi
shr rcx, 0xc
and ecx, 0x3ffff
mov rdx, rcx
shl r14, cl
shr rdx, 6
add rdx, 0x1c79
lock or qword [rsi + rdx*8], r14
add rax, 0x1000
cmp rax, r9
jb 0x140007ca0
cmp dword [0x140035264], 1
mov rdx, r9
mov rcx, rbx
sbb eax, eax
lea r9, [0x14006e4b8]
sub rdx, rbx
and eax, 0xffffffc4
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140007d60
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
ret
mov rax, rbx
lea rdx, [0x140043dc0]
shr rax, 0x12
and eax, 0xfff
add rax, 0x1c78
mov rdx, qword [rdx + rax*8 + 8]
mov rax, rbx
shr rax, 0xc
bt rdx, rax
jae 0x140007c7f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.un_VirtualProtect_failed:_errcode_0x_X_n
mov edx, eax
call sym.GC_log_printf
lea rcx, str.un_VirtualProtect_failed
call sym.GC_default_on_abort.lto_priv.0
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
jmp qword [sym.imp.KERNEL32.dll_DebugBreak]
Function at 0x140008040
Capabilities:
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x140043160]
mov rdi, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
lea r12, [rsi + 0x800]
nop dword [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400080dc
lea rbp, str.ResumeThread_failed
jmp 0x140008090
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400080dc
cmp byte [rbx + 0x3b], 0
je 0x140008088
mov rcx, qword [rbx + 0x10]
call rdi
cmp eax, 0xffffffff
jne 0x1400080ac
mov rcx, rbp
call sym.GC_default_on_abort.lto_priv.0
call r13
mov edx, dword [0x140043978]
test edx, edx
je 0x1400080d0
mov eax, dword [0x140043960]
test eax, eax
jne 0x1400080d0
lea rax, [0x14006e200]
cmp rbx, rax
jne 0x1400080f8
nop dword [rax]
mov byte [rbx + 0x3b], 0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008090
add rsi, 8
cmp r12, rsi
jne 0x140008070
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [0x140043d88], 0
jne 0x1400080d0
mov rcx, rbx
xor r8d, r8d
mov edx, 1
and rcx, 0xfffffffffffff000
call sym.GC_remove_protection.part.0.lto_priv.0
jmp 0x1400080d0
Function at 0x140008c50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [0x140043974]
test ebx, ebx
jne 0x140008cf5
mov r11d, dword [0x140043978]
test r11d, r11d
je 0x140008d00
mov r10d, dword [0x140043e90]
test r10d, r10d
je 0x140008d00
lea esi, [rcx + rcx*4]
mov ebx, dword [0x1400724f0]
add esi, esi
cmp esi, ebx
jg 0x140008c9f
jmp 0x140008ce1
add ebx, 1
cmp esi, ebx
je 0x140008cdb
xor ecx, ecx
call sym.GC_mark_some
test eax, eax
je 0x140008c98
cmp esi, ebx
jle 0x140008cdb
mov r9d, dword [0x140072538]
test r9d, r9d
jg 0x140008cca
cmp dword [0x140035260], 0xf423f
jne 0x140008e81
lea rcx, [sym.GC_never_stop_func]
call sym.GC_stopped_mark
call sym.GC_finish_collection
mov ebx, dword [0x1400724f0]
test ebx, ebx
jle 0x140008cf5
sub ebx, esi
mov eax, 0
cmovs ebx, eax
mov dword [0x1400724f0], ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.GC_should_collect.lto_priv.0
test eax, eax
je 0x140008cf5
mov r8d, dword [0x140043978]
test r8d, r8d
je 0x140008e58
mov ecx, dword [0x1400724f4]
test ecx, ecx
jne 0x140008d35
mov eax, dword [0x1400724f8]
cmp eax, dword [0x140035248]
jl 0x140008e73
mov edx, dword [0x140043d94]
test edx, edx
jne 0x140008eb3
call sym.GC_promote_black_lists
mov edx, 1
xor ecx, ecx
call sym.GC_reclaim_all
mov rbx, qword [0x140043e28]
test rbx, rbx
je 0x140008dc3
mov r11d, 0x3ff
jmp 0x140008d98
test byte [rax + 0x19], 4
jne 0x140008d8f
mov rcx, qword [rbx + 0x2010]
xor edx, edx
shl rcx, 0xa
add rcx, r11
shl rcx, 0xc
call sym.clear_marks_for_block
sub r11, 1
test r11, r11
js 0x140008db7
mov rax, qword [rbx + r11*8]
cmp rax, 0xfff
ja 0x140008d70
lea rdx, [r11 - 1]
sub r11, rax
test rax, rax
cmove r11, rdx
test r11, r11
jns 0x140008d98
mov rbx, qword [rbx + 0x2000]
test rbx, rbx
jne 0x140008d60
mov dword [0x140043e98], 0
mov dword [0x140043e90], 5
mov qword [0x140043e80], 0
mov dword [0x1400724f8], 0
mov dword [0x1400724fc], 1
cmp dword [0x140035260], 0xf423f
jne 0x140008e2c
lea rcx, [sym.GC_never_stop_func]
call sym.GC_stopped_mark
test eax, eax
jne 0x140008e4d
mov eax, dword [0x1400724fc]
test eax, eax
jne 0x140008cf5
add dword [0x140072538], 1
jmp 0x140008cf5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x140035260], 0xf423f
mov dword [0x14007253c], eax
je 0x140008e02
lea rcx, [sym.GC_timeout_stop_func]
jmp 0x140008e09
add rsp, 0x28
pop rbx
pop rsi
jmp sym.GC_finish_collection
lea rcx, [sym.GC_never_stop_func]
call sym.GC_try_to_collect_inner
mov dword [0x1400724f8], 0
jmp 0x140008cf5
add eax, 1
mov dword [0x1400724f8], eax
jmp 0x140008df6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [sym.GC_timeout_stop_func]
mov dword [0x14007253c], eax
call sym.GC_stopped_mark
test eax, eax
jne 0x140008cd6
add dword [0x140072538], 1
mov ebx, dword [0x1400724f0]
jmp 0x140008ce1
mov eax, dword [0x140043988]
mov r8d, dword [0x140043e00]
lea rcx, str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
lea edx, [rax + 1]
call sym.GC_log_printf
jmp 0x140008d43
Function at 0x14000ccb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov r10, qword [rcx]
movsxd rcx, dword [rcx + 8]
cmp rcx, 0x10
ja 0x14000cd50
cmp rcx, 3
jbe 0x14000cde0
mov r8, rcx
lea rdx, [rcx - 4]
mov eax, dword [r10 + rcx - 4]
shr r8, 3
lea r9, [r8*4]
shl rax, 0x20
mov r8d, dword [r10 + r8*4]
sub rdx, r9
mov edx, dword [r10 + rdx]
or rax, rdx
movabs rdx, 0xa0761d6478bd642f
xor rax, rdx
mov edx, dword [r10]
shl rdx, 0x20
or rdx, r8
movabs r8, 0xe7037ed1a0b428db
xor rdx, r8
mul rdx
xor r9d, r9d
mov r8, rdx
xor r8, rax
movabs rax, 0xe7037ed1a0b428db
xor rax, rcx
mov rcx, r9
imul rcx, rax
mul r8
add rcx, rdx
xor rax, rcx
pop rbx
pop rsi
pop rdi
pop rbp
ret
movabs rdx, 0xa0761d6478bd642f
mov r9, rcx
cmp rcx, 0x30
ja 0x14000ce50
mov rax, qword [r10 + 8]
lea r8, [r9 - 0x10]
movabs r11, 0xe7037ed1a0b428db
xor rax, rdx
mov rdx, qword [r10]
xor rdx, r11
mul rdx
xor rdx, rax
cmp r8, 0x10
ja 0x14000ce35
sub r9, 0x11
shr r9, 4
lea rax, [r9 + 1]
neg r9
shl rax, 4
and r9, 0xfffffffffffffff0
add r10, rax
add r9, r8
movabs rax, 0xe7037ed1a0b428db
xor rax, qword [r10 + r9 - 0x10]
mov r8, rax
mov rax, qword [r10 + r9 - 8]
xor r9d, r9d
xor rax, rdx
mul r8
mov r8, rdx
xor r8, rax
jmp 0x14000cd29
movabs r8, 0x1ff5c2923a788d2c
xor r9d, r9d
test rcx, rcx
je 0x14000cd29
movzx edx, byte [r10]
movzx eax, byte [r10 + rcx - 1]
shl rdx, 0x10
or rax, rdx
mov rdx, rcx
shr rdx, 1
movzx edx, byte [r10 + rdx]
shl rdx, 8
or rax, rdx
movabs rdx, 0xe7037ed1a0b428db
xor rax, rdx
movabs rdx, 0xa0761d6478bd642f
jmp 0x14000cd1d
mov rax, qword [r10 + 0x18]
xor r11, qword [r10 + 0x10]
xor rax, rdx
mul r11
xor rdx, rax
jmp 0x14000cd92
mov r11, rdx
mov rbx, rdx
mov r8, rdx
movabs rbp, 0xe7037ed1a0b428db
movabs rdi, 0x8ebc6af09c88c6e3
movabs rsi, 0x589965cc75374cc3
nop word [rax + rax]
mov rax, qword [r10]
xor r8, qword [r10 + 8]
sub r9, 0x30
add r10, 0x30
xor rbx, qword [r10 - 0x18]
xor r11, qword [r10 - 8]
xor rax, rbp
mul r8
mov r8, rdx
xor r8, rax
mov rax, qword [r10 - 0x20]
xor rax, rdi
mul rbx
mov rbx, rdx
xor rbx, rax
mov rax, qword [r10 - 0x10]
xor rax, rsi
mul r11
mov r11, rdx
xor r11, rax
cmp r9, 0x30
ja 0x14000ce80
mov rdx, r8
xor rdx, rbx
xor rdx, r11
cmp r9, 0x10
jbe 0x14000cdaf
jmp 0x14000cd67

Function at 0x14000d0d0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xc], 0xfa1d05ee
je 0x14000d0f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 1
lea rsi, [0x1400391e0]
mov ebx, 0x1e
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, rax
nop word [rax + rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000d110
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000d140
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [rcx]
mov eax, dword [rax]
lea edx, [rax - 0x40010006]
and edx, 0xfffffffb
je 0x14000d267
cmp eax, 0xe06d7363
je 0x14000d267
mov rdx, qword [0x14003a6b0]
pxor xmm0, xmm0
lea rdi, str.Unhandled_Exception_0x
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x54], xmm0
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x58], eax
lea rax, [0x140039120]
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x64], xmm0
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x7000fe86
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x74], 1
movups xmmword [rsp + 0x80], xmm0
call sym.str_intp.constprop.0
mov rsi, qword [rsp + 0x20]
mov byte [rsp + 0x3f], 0xa
mov rbx, qword [rsp + 0x28]
test rsi, rsi
je 0x14000d278
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
test ebx, ebx
jle 0x14000d21e
mov ecx, 1
movsxd rbx, ebx
call rbp
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000d200
mov ecx, 1
lea rsi, [rsp + 0x3f]
mov ebx, 1
call rbp
mov rdi, rax
nop word [rax + rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000d238
mov edx, 0x36
lea rcx, [0x140039228]
call sym.eprintln.isra.0
xor eax, eax
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, 1
mov ebx, 0xc
lea rsi, str.println_NIL_
call rbp
mov rdi, rax
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000d295
mov ecx, 1
lea rsi, [rsp + 0x3f]
mov ebx, 1
call rbp
mov rdi, rax
nop word [rax + rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000d2d0
jmp 0x14000d256

Function at 0x14000d300
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.signal__d:_segmentation_fault_n
mov rcx, rax
call sym.fprintf
lea rcx, [0x140039228]
mov edx, 0x36
call sym.eprintln.isra.0
lea ecx, [rbx + 0x80]
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14001b6e0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ecx, 1
lea rsi, [0x14003afc0]
mov ebx, 0x1e
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14001b708
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14001c3b0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rdi, qword [rdx + 8]
mov r13, qword [rdx]
mov r15d, edi
mov esi, edi
mov r12, r13
mov qword [rsp + 0x48], rdi
mov rbx, rcx
sub r15d, 1
js 0x14001c57a
movsxd rax, r15d
add rax, r13
jmp 0x14001c406
sub r15d, 1
sub rax, 1
cmp r15d, 0xffffffff
je 0x14001c448
cmp byte [rax], 0x3a
jne 0x14001c3f8
lea r14, [rsp + 0x50]
mov rdx, r13
mov r9d, r15d
mov r8d, edi
mov rcx, r14
call sym.string_substr.constprop.0.isra.0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x44], edx
test edx, edx
je 0x14001c4b0
jle 0x14001c58b
xor ebp, ebp
cmp byte [rax], 0x3a
je 0x14001c48d
nop dword [rax]
movq xmm6, qword [0x14003cd90]
lea rbp, [0x14003a840]
jmp 0x14001c4f4
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x38]
mov r9d, 1
mov rcx, r14
call sym.string_substr.constprop.0.isra.0
movsxd rax, ebp
add rax, qword [rsp + 0x50]
movzx eax, byte [rax]
sub eax, 0x30
cmp al, 9
ja 0x14001c448
add ebp, 1
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x38]
mov r9d, 1
mov rcx, r14
call sym.string_substr.constprop.0.isra.0
cmp ebp, dword [rsp + 0x58]
jl 0x14001c460
nop dword [rax + rax]
lea r9d, [r15 + 1]
mov r8d, edi
mov rdx, r13
mov rcx, r14
call sym.string_substr.constprop.0.isra.0
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, edi
mov rdx, r13
mov rcx, r14
mov rbp, qword [rsp + 0x50]
movq xmm6, qword [rsp + 0x58]
call sym.string_substr.isra.0
mov rax, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov esi, eax
test esi, esi
jle 0x14001c537
cmp byte [r12], 0x5b
jne 0x14001c537
lea eax, [rsi - 1]
movsxd rdx, eax
cmp byte [r12 + rdx], 0x5d
jne 0x14001c537
mov dword [rsp + 0x20], eax
mov r8d, esi
mov rdx, r12
lea rcx, [rsp + 0x50]
mov r9d, 1
call sym.string_substr.isra.0
mov rax, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov esi, eax
mov eax, esi
mov qword [rbx], r12
movabs rsi, 0xffffffff00000000
and rsi, qword [rsp + 0x48]
or rsi, rax
mov qword [rbx + 0x10], rbp
mov rax, rbx
mov qword [rbx + 8], rsi
movq qword [rbx + 0x18], xmm6
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movq xmm6, qword [0x14003cd90]
lea rbp, [0x14003a840]
jmp 0x14001c537
xor eax, eax
lea rdi, [rsp + 0x74]
mov ecx, 0x19
mov dword [rsp + 0x70], 0xfe07
rep stosd dword [rdi], eax
lea rax, [0x14003b0c4]
mov dword [rsp + 0xa0], edx
mov rcx, r14
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rax, qword [0x14003cdd0]
mov dword [rsp + 0x98], 0xfe07
mov qword [rsp + 0x68], rax
lea rax, [0x14003b0e0]
mov qword [rsp + 0x88], rax
mov rax, qword [0x14003cdd8]
mov dword [rsp + 0xbc], 1
mov qword [rsp + 0x90], rax
lea rax, [0x14003a840]
mov qword [rsp + 0xb0], rax
call sym.str_intp.constprop.1
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call sym._v_panic.isra.0
nop
nop
Function at 0x14001c620
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [rdx + 0xc], 2
jne 0x14001c657
mov r8, qword [rdx]
movsxd rax, dword [rdx + 0x18]
mov eax, dword [r8 + rax]
mov edx, dword [r8]
mov dword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0
shl rax, 0x20
or rax, rdx
mov qword [rcx + 0x10], rax
add rsp, 0x28
ret
lea rcx, str.WyRandRNG_needs_2_32_bit_unsigned_integers_as_the_seed.
mov edx, 0x37
call sym.eprintln.isra.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop