joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051928
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140051958
xor eax, eax
jmp 0x140051a1b
mov rbp, rbx
cmp word [rax], si
je 0x14005197d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140051964
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140051960
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140050010
movsxd r14, eax
test eax, eax
jne 0x1400519bb
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x140051951
mov rcx, r14
call fcn.14004b0dc
mov rdi, rax
test rax, rax
jne 0x1400519d4
xor ecx, ecx
call fcn.1400493f8
jmp 0x1400519b0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140050010
test eax, eax
jne 0x140051a05
mov rcx, rdi
call fcn.1400493f8
jmp 0x140051a0f
xor ecx, ecx
call fcn.1400493f8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140054748
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140048b4c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.kernel32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400547e9
cmp ebx, dword [rsp + 0x30]
je 0x1400547e2
test esi, esi
je 0x1400547e2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400547bd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400547ca
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400547a7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400547ce
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400547eb
mov eax, 1
jmp 0x1400547eb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400590b0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14004e274
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14004e274
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140059200
cmp rax, 0xffffffffffffffff
je 0x140059200
xor edi, edi
test rbp, rbp
jle 0x1400591ab
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140049120
mov rbx, rax
test rax, rax
jne 0x140059138
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400591a1
mov edx, 0x8000
mov ecx, r14d
call fcn.1400469ec
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14004a9d0
cmp eax, 0xffffffff
je 0x140059181
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140059148
mov edx, r15d
mov ecx, r14d
call fcn.1400469ec
jmp 0x1400591a1
cmp byte [rsi + 0x38], dil
je 0x140059198
cmp dword [rsi + 0x34], 5
jne 0x140059198
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400591a1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400493f8
jmp 0x140059214
jns 0x140059214
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14004e274
cmp rax, 0xffffffffffffffff
jne 0x1400591cc
cmp byte [rsi + 0x30], dil
je 0x140059214
mov edi, dword [rsi + 0x2c]
jmp 0x140059214
mov ecx, r14d
call fcn.1400521f4
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
jne 0x140059214
call qword [sym.imp.kernel32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140059214
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005920d
mov eax, dword [rsi + 0x2c]
jmp 0x140059212
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14004e274
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14000bde0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14000be80
jmp 0x14000be6f
jae 0x14000bf40
cmp r8, 0x201
jae 0x14000be80
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000bed8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000beaf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140034980
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000bf01
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000bfa8
mov r8d, r14d
cmp r15, r8
jne 0x14000be60
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000bfd5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000be6f
jmp 0x14000be80
cmp rsi, r8
jb 0x14000bfef
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000f530
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14000bf91
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140004ea0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14000bf79
jmp 0x14000bf91
lea rcx, [0x140037170]
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140035470
jmp 0x14000c004
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400358c0
ud2
Function at 0x14000c060
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.140021050
mov rax, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x14000c0b6
lea rcx, [rbp - 0x50]
call fcn.140006170
mov qword [rsi], rdi
jmp 0x14000c2a1
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x418], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3f8], 2
mov qword [rbp + 0x400], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor ebx, ebx
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x14000c140
jmp 0x14000c12f
jae 0x14000c206
cmp r8, 0x201
jae 0x14000c140
mov r15d, 0x200
lea r14, [rbp - 0x58]
mov r12, r8
jmp 0x14000c198
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x14000c16f
lea rcx, [rbp + 0x3f0]
mov rdx, r13
call fcn.140034980
mov rbx, qword [rbp + 0x3f0]
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x410], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rbp + 0x400], r13
mov rdi, rbx
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000c1c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000c2db
mov r8d, esi
cmp r12, r8
jne 0x14000c120
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000c316
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000c12f
jmp 0x14000c140
cmp r15, r8
jb 0x14000c330
lea rcx, [rbp + 0x3a8]
mov rdx, r14
call fcn.14000f530
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3e0], xmm1
movaps xmmword [rbp + 0x3d0], xmm0
movabs rdi, 0x8000000000000000
test rbx, rbx
mov rsi, qword [rbp + 0x3c8]
je 0x14000c268
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rbx
call fcn.140004ea0
cmp qword [rbp + 0x3d0], rdi
jne 0x14000c2b8
mov qword [rsi], rdi
lea rcx, [rbp + 0x3d8]
call fcn.140006170
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x14000c2a1
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140004ea0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmm1, xmmword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x14000c28c
jmp 0x14000c2a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3d8], rax
movabs rdi, 0x8000000000000000
mov qword [rbp + 0x3d0], rdi
test rbx, rbx
mov rsi, qword [rbp + 0x3c8]
jne 0x14000c250
jmp 0x14000c268
lea rcx, [0x140037170]
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140035470
jmp 0x14000c345
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400358c0
ud2
Function at 0x14000d190
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x14000d1a0
mov rcx, rdx
mov rdx, r8
jmp fcn.14000d1b0
mov rcx, rdx
mov rdx, r8
jmp fcn.140016890

Function at 0x140012ac0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002f7d0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call fcn.140034300
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x14001a6a0]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.14001a440
cmp qword [rbp + 0xfe8], 0
jne 0x140012c97
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x140012c63
cmp r12, 0x1000
ja 0x140012cb9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140012c37
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140012be0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x140012c3d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140012c20
jbe 0x140012b90
jmp 0x140012ca5
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140012b45
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.140006170
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.140006170
jmp 0x140012c63
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.140035940
jmp 0x140012ccd
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.1400358c0
ud2
Function at 0x140016890
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140021050
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140016951
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140019280
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
je 0x140016951
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140016925
test rdi, rdi
je 0x140016921
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004ea0
xor esi, esi
jmp 0x140016951
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x14001694e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004ea0
mov rsi, rbx
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x140017f40
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.140021050
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
movabs r14, 0x8000000000000000
cmp rax, r14
je 0x140017fb2
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140019280
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
cmp rax, r14
jne 0x140017fd0
mov qword [rsi + 8], rdx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp + 8], rax
mov qword [rbp], rdx
mov r8, qword [rbp + 0x70]
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.140021050
mov rax, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
cmp rax, r14
je 0x140018022
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140019280
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
cmp rbx, r14
jne 0x140018053
mov r14, qword [rbp]
mov r15, qword [rbp + 8]
mov qword [rsi + 8], rdi
mov qword [rsi], 1
test r15, r15
je 0x140017fbd
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.140004ea0
jmp 0x140017fbd
mov qword [rbp - 0x18], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140018130]
lea r9, [rbp - 0x18]
mov r14, qword [rbp]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
mov r15, qword [rbp + 8]
je 0x1400180a5
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rbx, rbx
jne 0x1400180c7
jmp 0x140018035
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
je 0x140018035
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.140004ea0
jmp 0x140018035
Function at 0x140018150
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140039120]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140018194
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400181fa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140018231
test eax, eax
js 0x14001820b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140018224
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140039180]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000f310
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140006750
mov ecx, 7
int 0x29
ud2

Function at 0x140019a40
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x24], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 0x10], rax
nop

Function at 0x14001a440
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
sub esp, 0x78
Function at 0x140020180
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400201c3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [case.0x14000d21b.114]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400353a0
ud2
Function at 0x14002e5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002e61a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002e610
cmp r11, r10
ja 0x14002e6a5
cmp r10, rdx
ja 0x14002e6b7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002e612
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002e5f0
jmp 0x14002e687
ja 0x14002e61a
mov r11, r10
cmp rax, r8
jne 0x14002e5c2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002e68b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002e660
mov r8, r10
sub ecx, r9d
jns 0x14002e67e
jmp 0x14002e68d
cmp r10, rdx
je 0x14002e699
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002e68d
xor al, 1
cmp r8, rdx
jne 0x14002e640
jmp 0x14002e68d
xor eax, eax
jmp 0x14002e68d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140035310
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140035940
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400358c0
int3

Function at 0x14002fd00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002fd4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002fd4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002fd4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002fd4a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002fd4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002fd4c
xor al, al
add rsp, 0x28
ret

Function at 0x140033960
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140033988
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140033988
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x416aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061d240]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416b05
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416b14
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416b33
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416b43
cmp rbx, 0x1000
jae 0x416b0b
jmp 0x416bad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416b55
xor edx, edx
jmp 0x416ba4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061d240]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416b39
jmp 0x416b28
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061d240]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004ddfda]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004de449]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e0794]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS