joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400705d4
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400705d4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400020f4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14007065e
cmp byte [rbp - 0x21], r15b
je 0x140070659
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140070694
call fcn.140003e54
test eax, eax
jne 0x140070680
cmp byte [rbp - 0x21], r15b
je 0x140070678
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140070694
cmp byte [rbp - 0x21], r15b
je 0x140070691
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140004020
test eax, eax
jne 0x140070734
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400020f4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400706d3
cmp byte [rbp - 0x21], r15b
je 0x140070708
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140070708
call fcn.140003e54
test eax, eax
jne 0x1400706f4
cmp byte [rbp - 0x21], r15b
je 0x1400706ed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140070708
cmp byte [rbp - 0x21], r15b
je 0x140070705
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140004020
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140070734
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140070737
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140070745
mov rcx, rdi
call fcn.140001168
cmp byte [rbp + 0x3f], r15b
je 0x140070754
mov rcx, qword [rbp + 0x27]
call fcn.140001168
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140d6b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d6b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d6b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d6b06f
add dl, dl
jne 0x140d6b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d6b0f6
xor eax, eax
add dl, dl
jne 0x140d6b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d6b1ad
add dl, dl
jne 0x140d6b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d6b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d6b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d6b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d6b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d6b07e
mov eax, 1
add dl, dl
jne 0x140d6b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d6b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d6b0fb
sub eax, ebx
mov ebx, 1
jne 0x140d6b14c
mov ecx, 1
add dl, dl
jne 0x140d6b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d6b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d6b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d6b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d6b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d6b15d
cmp eax, 0x7d00
jae 0x140d6b19b
cmp eax, 0x500
jb 0x140d6b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6b07e
cmp eax, 0x7f
ja 0x140d6b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d6b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d6b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x211d413c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x211d413d8
mov eax, 1
add rsp, 0x38
ret
mov rax, qword [0x211ee2a80]
xor r9d, r9d
lea r8, [sym.RunInjectorThreadProxy_void_]
xor edx, edx
mov qword [rax], rcx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x211d41960
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x211d419d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x211ee5064]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x211d41b80
mov rax, qword [0x211ee5068]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x211d41a1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x211d41aa7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x211d41a00
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x211d41bdd
mov rax, qword [0x211ee5068]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x211ee5068]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x211d41bc2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x211d41aa0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x211d41b30
add dword [0x211ee5064], 1
cmp ebx, 8
jae 0x211d41ad8
test bl, 4
jne 0x211d41b90
test ebx, ebx
je 0x211d41ac9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x211d41bb0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x211d41ac9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x211d41b0a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x211ee5068]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x211d41aa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x211d41a27
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x211d41ac9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x211d41ac9
mov rax, qword [0x211ee5068]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]
Function at 0x211d41ee0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x211ee50a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x211ee5080]
test rbx, rbx
je 0x211d41f34
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x211d41f2b
test r12, r12
je 0x211d41f2b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x211d41f10
lea rcx, [0x211ee50a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x211d42160
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x211d42170
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x211d42180
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x211d421c5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x211d421bc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x211d421c7
add rax, 0x28
cmp rax, r9
jne 0x211d421a8
xor eax, eax
ret

Function at 0x211d42270
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x211ee2a00]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x211d422e9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d422e9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x211d422e6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x211d422dd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x211d422e9
add r8, 0x28
cmp r8, r9
jne 0x211d422c8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x211d423d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x211ee2a00]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x211d4243f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d4243f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x211d4243d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x211d42434
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x211d42448
add rax, 0x28
cmp rax, r9
jne 0x211d42420
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x211d42460
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x211ee2a00]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x211d424d8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d424d8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x211d424d8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x211d424d8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x211d424cc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x211d424e0
add rdx, 0x28
cmp rdx, r10
jne 0x211d424b8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x211d424f0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x211d424fe
mov edx, dword [rax + 0xc]
test edx, edx
je 0x211d424d5
test r8d, r8d
jg 0x211d424e8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1401320b2
Capabilities:
Execute anti-debugging instructions
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
loope 0x1401320f5
cmp ecx, 0x3f088aec
dec rbp
call fcn.1401315b9
test r10d, 0x25056dd6
nop
jl 0x140131b4a
jne 0x140132114
je 0x140132114
inc rbx
test r11, rdi
ror ebx, 0xc0
xor edx, 0x1c9a6229
jg 0x1401324c3
lea esi, [rbx - 0xee86]
ret
rol r14d, 0x2e
jne 0x14013110b
lea r14d, [rcx - 0x2072]
rol r9d, 0x82
or r8d, 0x56f68cda
ret
jmp fcn.140131d7b
or edx, 0x16fc68d5
call rcx
ror edx, 0xf5
pause
add r13d, 0xe31ad0c8
je 0x140132387
jne 0x140132387
jmp rax
jmp fcn.140131bb4
jae 0x140131346
jle 0x1401316a7
popf
jne 0x1401324f4
je 0x1401324f4
lea r11d, [rbx - 0x6454]
xor esi, 0xe8bf6882
jmp rcx
jmp 0x14013233b

Function at 0x1401338c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, [0x140133b00]
jmp 0x1401338e3
xchg rbx, rax
mov qword [rsp + 0x18], rbx
xchg rbx, rax
mov dword [rsp + 8], 0
xchg r15, rax
mov r15, qword [rsp + 0x30]
jmp 0x140133905
jmp 0x140133988
xchg r15, rax
xchg rdx, rax
mov qword [rsp + 0x10], rdx
xchg rdx, rax
jne 0x140133943
je 0x140133943
mov ebx, 0x7c9ae8b
pause
jmp 0x140133900
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14027aef0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14027af00]
mov dword [rax], 1
mov rax, qword [0x14027af10]
mov dword [rax], 1
mov rax, qword [0x14027aee0]
mov dword [rax], 1
mov rax, qword [0x14027ad30]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14027aed0]
mov dword [0x1402ac00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14027ae30]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14027ae10]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14027acc0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067
Function at 0x140002ea2
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
mov cl, 1
jmp sym.std::fs::DirBuilder::_create::h38f24b56013f7e2a

Function at 0x1400068fc
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x1400113e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, rdx
add rdx, 8
cmp qword [rax], 0
je 0x140011431
cmp qword [rax + 0x38], 0xffffffffffffffff
mov r8, qword [rax + 0x48]
mov r9, qword [rax + 0x50]
mov r10, qword [rax + 0x58]
mov rax, qword [rax + 0x60]
je 0x140011525
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x140011534
mov bl, byte [rax + 0x1a]
mov r8, qword [rax + 8]
mov r10, qword [rax + 0x48]
mov r9, qword [rax + 0x50]
mov sil, byte [rax + 0x18]
xor r11d, r11d
test bl, bl
jne 0x14001155a
mov edi, esi
xor dil, 1
mov byte [rax + 0x18], dil
test r8, r8
je 0x140011475
cmp r8, r9
jae 0x14001146f
cmp byte [r10 + r8], 0xbf
jg 0x140011475
jmp 0x14001156a
jne 0x14001156a
cmp r8, r9
je 0x14001153b
movzx edi, byte [r10 + r8]
test dil, dil
jns 0x1400114e1
mov ebp, edi
and ebp, 0x1f
movzx r15d, byte [r10 + r8 + 1]
and r15d, 0x3f
cmp dil, 0xdf
jbe 0x1400114ce
movzx r14d, byte [r10 + r8 + 2]
shl r15d, 6
and r14d, 0x3f
or r14d, r15d
cmp dil, 0xf0
jb 0x1400114d8
movzx edi, byte [r10 + r8 + 3]
and ebp, 7
shl ebp, 0x12
shl r14d, 6
and edi, 0x3f
or edi, r14d
or edi, ebp
jmp 0x1400114e1
shl ebp, 6
or ebp, r15d
mov edi, ebp
jmp 0x1400114e1
shl ebp, 0xc
or r14d, ebp
mov edi, r14d
test sil, sil
jne 0x140011549
cmp edi, 0x110000
je 0x140011540
mov esi, 1
cmp edi, 0x80
jb 0x140011517
mov esi, 2
cmp edi, 0x800
jb 0x140011517
cmp edi, 0x10000
mov esi, 4
sbb rsi, 0
add r8, rsi
mov qword [rdx], r8
mov sil, 1
jmp 0x140011447
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
call sym.core::str::pattern::TwoWaySearcher::next::hd54ccce178a873f1
jmp 0x14001155d
test sil, sil
jne 0x14001154c
mov byte [rax + 0x1a], 1
xor r11d, r11d
jmp 0x14001155a
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r11d, 1
mov qword [rcx], r11
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str._rustc_7f2fc33da6633f5a764ddc263c769b6b2873d167librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call sym.core::str::slice_error_fail::heef5c420b51ea4d9
int3
Function at 0x140054cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140054d50
cmp r11, r10
ja 0x140054dc7
cmp r10, rdx
ja 0x140054dd9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140054d52
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140054d30
jmp 0x140054db4
ja 0x140054d5a
mov r11, r10
cmp rax, r8
jne 0x140054cfe
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140054d90
mov rdi, r8
sub ecx, edx
jns 0x140054dab
jmp 0x140054db6
cmp r8, rsi
je 0x140054de8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140054db6
xor al, 1
cmp rdi, rsi
jne 0x140054d70
jmp 0x140054db6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::h6c569a63597ac0ca
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::h4c376ee8536a9e87
lea rcx, str.librarycore_srcunicodeprintable.rs
call sym.core::option::unwrap_failed::h9762a13207486022
int3

Function at 0x140057c25
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ca060]
test ecx, ecx
je 0x140057c3e
dec ecx
add rsp, 0x28
jmp fcn.14015714c
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h0e06e82ccfad3bc9
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h76a98b32ece36886
mov ecx, eax
jmp 0x140057c35

Function at 0x140057c4e
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140057c6f
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140157154
mov rcx, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h76a98b32ece36886
mov ecx, eax
jmp 0x140057c62

Function at 0x140057c7b
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx]
mov edx, 1
mov rcx, rdi
call sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3set17h8305cdea3cd3f87aE.1850
lea rcx, [rsi + 8]
call sym._ZN4core3ptr174drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_alloc..boxed..Box_LT_dy
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov rcx, rdi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sym._ZN3std3sys3pal7windows16thread_local_key9StaticKey3set17h8305cdea3cd3f87aE.1850
Function at 0x140057fe4
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x20]
and qword [rdi], 0
lea rcx, [0x1401e0d18]
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x140058025
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140058057
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
lea rdi, [rsp + 0x28]
mov rcx, rdi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h43df8540eb0de255
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140061892
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x1400618b8
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x1400618a2
mov qword [rcx], rax
ret
Function at 0x14008d888
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
lea rdx, [0x140234458]
mov r8d, 1
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x14008d8c0
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call sym.core::ptr::drop_in_place_std::io::error::Error_::h1078034340800ae2
nop
add rsp, 0x28
ret

Function at 0x1400945ae
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call sym.core::hash::impls::__impl_core::hash::Hash_for_isize_::hash::h64701fa64a6ed40d
test rbx, rbx
je 0x1400945e7
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__fnv::FnvHasher_as_core::hash::Hasher_::write::h4dda8e5742fafab7
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__http::header::name::StandardHeader_as_core::hash::Hash_::hash::h126a13bf8e68ce4c