joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46caa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d23
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409800
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046aca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d00
cmp byte [0x005e618a], 0
je 0x46cab5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x469ce0
jmp 0x403d00

Function at 0x46cac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x005e64c8]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e64c0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e618a], 0
je 0x46caf5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e6800]
aesenc xmm0, xmmword [0x005e6810]
aesenc xmm0, xmmword [0x005e6820]
movq rax, xmm0
ret
jmp 0x4099e0

Function at 0x46cb00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x005e64c8]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e64c0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e618a], 0
je 0x46cb36
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e6800]
aesenc xmm0, xmmword [0x005e6810]
aesenc xmm0, xmmword [0x005e6820]
movq rax, xmm0
ret
jmp 0x409a20

Function at 0x46e8c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46e8f4
mov rcx, 0x28
jmp 0x46e8ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e63e0], rcx
pop rbp
ret

Function at 0x476ac0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4771ff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x476aed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x476d71
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x476d9d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00507a20]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004bb7c0]
lea rbx, [0x00505a40]
call fcn.004653a0
inc rax
cmp rax, r8
jge 0x476dc2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x476df7
lea rdi, [0x004bb840]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x476ae3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x476ddb
jmp 0x476db0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046aca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00476ac0
Function at 0x4773a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4773b7
inc rax
cmp rax, 4
jge 0x4773cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4773b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4773e0
inc rax
cmp rax, 4
jge 0x4773ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x477417
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4773fb
jmp 0x4773dd

Function at 0x47b940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ba0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x005e63e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b9ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bb8c0]
xor ebx, ebx
mov rcx, rdx
call fcn.004666e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047bf20
inc rbx
cmp rcx, rbx
jae 0x47b9de
mov edi, 1
lea rsi, [0x004bb8c0]
call fcn.004667c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00505be8]
lea rsi, [0x005052d8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046aca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047b940
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1401a3000
add rsp, 0x28
jmp 0x140008188
Function at 0x1400011c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x1400437e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm2, xmmword [rdx]
pxor xmm2, xmm0
movdqa xmm5, xmmword [rdx + 0x10]
pxor xmm5, xmm0
movdqa xmm6, xmmword [rdx + 0x20]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x30]
pxor xmm7, xmm0
movdqa xmm1, xmmword [rdx + 0x40]
pxor xmm1, xmm0
movdqa xmm3, xmmword [rdx + 0x50]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x60]
pxor xmm4, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm2, xmm10
aesenc xmm5, xmm10
aesenc xmm6, xmm10
aesenc xmm7, xmm10
aesenc xmm1, xmm10
aesenc xmm3, xmm10
aesenc xmm4, xmm10
aesenc xmm0, xmm10
aesenc xmm2, xmm9
aesenc xmm5, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm1, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm0, xmm9
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x40]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x50]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x60]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x70]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x80]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x90]
aesenc xmm2, xmm8
aesenc xmm5, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0xa0]
aesenclast xmm2, xmm8
aesenclast xmm5, xmm8
movdqa xmmword [rdx], xmm2
movdqa xmmword [rdx + 0x10], xmm5
aesenclast xmm6, xmm8
movdqa xmmword [rdx + 0x20], xmm6
aesenclast xmm7, xmm8
movdqa xmmword [rdx + 0x30], xmm7
aesenclast xmm1, xmm8
aesenclast xmm3, xmm8
movdqa xmmword [rdx + 0x40], xmm1
movdqa xmmword [rdx + 0x50], xmm3
aesenclast xmm4, xmm8
movdqa xmmword [rdx + 0x60], xmm4
aesenclast xmm0, xmm8
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140048d20
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140048dc0
jmp 0x140048daf
jae 0x140048e7f
cmp r8, 0x201
jae 0x140048dc0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140048e17
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140048def
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14005f610
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140048e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140048eeb
mov r8d, r13d
cmp r12, r8
jne 0x140048da0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140048f1f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140048daf
jmp 0x140048dc0
cmp r14, r8
jb 0x140048f39
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14004bdf0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140048ed4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140044640
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140048ebf
jmp 0x140048ed4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_7120fdac7a6e55a5e4b606256042890b36067052library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140060820
jmp 0x140048f4e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140060bd0
ud2
Function at 0x1400507f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x140063328]
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
movaps xmmword [rbp + 0x10], xmm0
test r9, r9
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140050882
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x1400508af
test eax, eax
js 0x14005088e
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x1400508a5
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.14004bae0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.140047320
mov ecx, 7
int 0x29
ud2
Function at 0x14005d480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14005d50a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14005d500
cmp r10, r11
jb 0x14005d586
cmp r10, rdx
ja 0x14005d598
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14005d502
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14005d4e0
jmp 0x14005d567
ja 0x14005d50a
mov r11, r10
cmp rax, r8
jne 0x14005d4a7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14005d56b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14005d540
mov r8, r10
sub ecx, r9d
jns 0x14005d55e
jmp 0x14005d56d
cmp r10, rdx
je 0x14005d57a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14005d56d
xor al, 1
cmp r8, rdx
jne 0x14005d520
jmp 0x14005d56d
xor eax, eax
jmp 0x14005d56d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140060700
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140060c40
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140060bd0
int3
Function at 0x140001450
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140001390
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, qword [rsp + 0x40]
test eax, eax
je 0x14000153a
cmp rdx, 8
jb 0x1400014e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000156e
call fcn.140015b4c
movdqa xmm0, xmmword [0x14001a520]
movdqu xmmword [rsp + 0x38], xmm0
xor edi, edi
mov word [rsp + 0x28], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140001533
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000152e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400015ee
mov rcx, r8
call fcn.140015b4c
mov al, 1
jmp 0x1400015c7
cmp rdx, 8
jb 0x14000157a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001575
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001575
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015b4c
movdqa xmm0, xmmword [0x14001a520]
movdqu xmmword [rsp + 0x38], xmm0
xor edi, edi
mov word [rsp + 0x28], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400015c5
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400015c0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400015ee
mov rcx, r8
call fcn.140015b4c
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140015af0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140001600
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140001390
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001680
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001680
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000ab80
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000ad40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor bl, bl
jmp 0x140001682
mov bl, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400016c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015b4c
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140015af0
add rsp, 0x50
pop rbx
ret

Function at 0x1400016e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000179e
mov qword [rsp + 0x170], rbx
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140001753
inc rcx
test eax, eax
jne 0x140001740
test edx, edx
jne 0x140001784
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001784
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001732
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140015af0
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140002c40
Capabilities:
Delete file
Download url
Get file attributes
Receive data
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x140002c9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x140002c92
or eax, 2
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret