joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015ffac
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov edi, edx
mov ebx, ecx
call fcn.14015e78f
mov rsi, rdx
test rax, rax
jne 0x14015e8d0
mov qword [rbp], rsi
mov word [rbp + 0xe], bx
mov word [rbp + 0xc], di
test bx, bx
js 0x14015e80c
test di, di
js 0x14015e858
mov rcx, qword [rsi + 0x10]
shl edi, 0x10
movzx edx, bx
or edx, edi
call sub.KERNEL32.dll_SetConsoleCursorPosition
test eax, eax
je 0x14015e8a4
xor esi, esi
jmp 0x14015e8ac
lea rax, [rbp + 0xe]
lea rcx, [rbp - 0x28]
mov qword [rcx], rax
lea rax, str.Argument_Out_of_Range_Exception_when_setting_cursor_position_to_X:
lea rdx, [rbp - 0x58]
mov qword [rdx], rax
push 1
pop rax
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea r8, [0x14015d640]
mov qword [rcx + 8], r8
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.14023f17a
lea rcx, [rbp - 0x18]
call fcn.14015e566
jmp 0x14015e8be
lea rax, [rbp + 0xc]
lea rcx, [rbp - 0x28]
mov qword [rcx], rax
lea rax, str.Argument_Out_of_Range_Exception_when_setting_cursor_position_to_Y:
lea rdx, [rbp - 0x58]
mov qword [rdx], rax
push 1
pop rax
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea r8, [0x14015d640]
mov qword [rcx + 8], r8
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.14023f17a
lea rcx, [rbp - 0x18]
call fcn.14015e566
jmp 0x14015e8be
call fcn.14019912a
mov rsi, rax
mov rcx, rsi
call fcn.14019840b
test rsi, rsi
je 0x14015e8df
call fcn.14019912a
mov rsi, rax
mov rcx, rbp
call fcn.14015e794
test rsi, rsi
jne 0x14015e8d0
xor esi, esi
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
jmp 0x14015e8c1
sub rsp, 0x28
mov r9d, r8d
movsx eax, cx
movsx r8d, dx
imul r8d, eax
xor ecx, ecx
xor edx, edx
call fcn.14015ffde
test rax, rax
je 0x14015ffd1
add rsp, 0x28
ret
xor ecx, ecx
xor edx, edx
add rsp, 0x28
jmp 0x14015e7a6

Function at 0x140167494
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x1401674ba
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x1401674a4
mov qword [rcx], rax
ret

Function at 0x1401675a2
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.140167469
test rbx, rbx
je 0x1401675db
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140167494
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14016748c
Function at 0x14019a9b9
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
push 2
pop rax
push reloc.WS2_32.dll_socket
pop rbx
cmove ebx, eax
mov rax, qword [0x1403af3d8]
cmp rax, 3
jne 0x14019aa59
mov ecx, ebx
mov edx, edi
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x14019aa39
mov rdi, rax
lea r8, [rbp - 0x14]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14019aa47
call fcn.14019912a
mov qword [rbp - 0x10], rax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbp - 0x10]
jmp 0x14019aa3e
call fcn.14019912a
mov qword [rsi + 8], rax
push 1
pop rax
jmp 0x14019aa4d
mov qword [rsi + 8], rdi
xor eax, eax
mov qword [rsi], rax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 1]
mov byte [rax], 1
lea r8, [rbp - 0x20]
mov qword [r8], rax
lea rax, str.R._
mov qword [rsp + 0x20], rax
lea rcx, [0x1403af3d8]
lea r9, method..virtual_0
xor edx, edx
call fcn.1402892b0
jmp 0x14019a9ee
Function at 0x14019d022
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdx, qword [0x1403af400]
test rdx, rdx
jne 0x14019d175
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14019d09d
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019d09d
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019d09d
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
jmp 0x14019d12b
lea rcx, [0x1402e5c60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14019d188
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019d188
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019d188
mov r14, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019d188
mov rdi, rax
lea rcx, [rbp - 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14019d188
mov qword [rbp - 0x10], r14
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
push 0x18
pop rcx
call fcn.1401673df
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rdi
mov rax, qword [rbp - 0x18]
mov qword [rdx + 0x10], rax
xor eax, eax
lock cmpxchg qword [0x1403af400], rdx
je 0x14019d175
mov rdi, rax
mov rcx, qword [rdx]
mov qword [rbp - 0x10], rdx
mov rdx, qword [rdx + 0x10]
call fcn.14019d21a
mov rcx, qword [rbp - 0x10]
call fcn.140079780
mov rdx, rdi
and qword [rsi + 8], 0
mov qword [rsi], rdx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x1402e5d68]
push 0x5b
pop rdx
call fcn.140288303
ud2
Function at 0x1401a33be
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.1401a55d9
test rax, rax
je 0x1401a33fc
lea rdx, method..virtual_0
mov rcx, rax
call fcn.1401a2568
mov rax, qword [rdi + 0x30]
jmp 0x1401a3441
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.1401a27f3
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rdi + 0x28], rax
movups xmm0, xmmword [rbx + 0x18]
movups xmmword [rdi + 0x18], xmm0
movups xmm0, xmmword [rbx + 8]
movups xmmword [rdi + 8], xmm0
mov rax, qword [rdi + 0x30]
mov qword [rdi], rcx
and qword [rdi + 0x40], 0
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
jmp fcn.1401a28a1
Function at 0x1401a55d9
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test r12, r12
je 0x1401a566c
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x1401a5606
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x1401a5606
xor ebx, 0x80000000
je 0x1401a566c
mov al, byte [0x1403afa10]
mov ecx, 4
mov edx, 4
call fcn.140118d00
test rax, rax
je 0x1401a567f
mov dword [rax], ebx
jmp 0x1401a566e
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1402869f0
ud2

Function at 0x1401a6988
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x668
movaps xmmword [rsp + 0x650], xmm6
mov rsi, rcx
mov rax, r8
shr rax, 0x3d
jne 0x1401a6a17
movzx ebx, r9b
shl rbx, 7
sub rbx, 0xffffffffffffff80
shl r8, 3
cmp r8, rbx
jne 0x1401a6a17
mov rdi, rdx
lea rcx, [rsp + 0x140]
mov r8d, 0xf4
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call fcn.1401a631c
cmp eax, 3
je 0x1401a69fa
mov eax, eax
lea r8, [rsp + 0x140]
mov rcx, rdi
mov edx, ebx
cmp eax, 2
jne 0x1401a6a0e
call fcn.14025c280
jmp 0x1401a6a13
lea r8, [rsp + 0x140]
mov rcx, rdi
mov edx, ebx
call fcn.1402799a0
jmp 0x1401a6a13
call fcn.14025d750
test eax, eax
je 0x1401a6a32
mov dword [rsi], 2
movaps xmm6, xmmword [rsp + 0x650]
add rsp, 0x668
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [rsp + 0x358]
lea rbx, [rsp + 0x140]
mov r8d, 0xf4
mov rcx, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
xorps xmm6, xmm6
movaps xmmword [rbx], xmm6
lea rbx, [rsp + 0x30]
lea r8, [rsp + 0x140]
mov rcx, rbx
mov rdx, rdi
call fcn.1401a6353
mov r14, qword [rbx]
mov rdi, qword [rbx + 8]
bswap r14
bswap rdi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rdi
xor eax, eax
cmp rax, 0x100
je 0x1401a6aa0
movups xmmword [rsp + rax + 0x140], xmm6
add rax, 0x10
jmp 0x1401a6a8a
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x140]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memcpy
call fcn.1401a633b
test al, al
je 0x1401a6aee
mov rax, r14
shld rax, rdi, 1
shld rdi, r14, 1
sar r14, 0x3f
movabs rcx, 0xc200000000000000
and rcx, r14
xor rcx, rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
jmp 0x1401a6b13
mov eax, dword [0x1403afa1c]
not eax
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x20]
test eax, 0x10400000
jne 0x1401a6b0e
call fcn.14025b2a0
jmp 0x1401a6b13
call fcn.14025a880
lea rdi, [rsp + 0x450]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x550]
lea rdx, [rsp + 0x358]
mov r8d, 0xf4
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x14c]
mov r8d, 0x200
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
and dword [rsi], 0
add rsi, 4
lea rdx, [rsp + 0x140]
mov r8d, 0x20c
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1401a6a1d
Function at 0x1401ab567
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
lea rbx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.16.20_src_rand.rs
mov r12d, 0xffffffff
mov r13, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov r14, r15
cmp r15, rsi
jae 0x1401ab5c6
mov rcx, rdi
mov rdx, rsi
mov r8, r14
mov r9, rbx
call fcn.14011b51e
mov r15, rdx
cmp rdx, r12
cmovae r15, r12
mov rcx, rax
mov edx, r15d
call r13
add r15, r14
test al, al
jne 0x1401ab593
cmp r14, rsi
setb al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401b1900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x1401b195b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1401b195b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x1401b1976
cmp eax, 0x42
jne 0x1401b195b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1401b1a26
cmp byte [r9 + r11], 0x5f
jne 0x1401b1a26
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1401b1a8e
mov rcx, rsi
xor edx, edx
call fcn.1401ad120
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1401ad120
test al, al
jne 0x1401b1b21
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b19b2
lea rdx, [0x1402ecfd2]
mov r8d, 1
call fcn.14014eb90
test al, al
jne 0x1401b1b21
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1401b196a
xor r14d, r14d
lea rbx, [0x14030c108]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1401b19e4
cmp byte [rax + rcx], 0x45
je 0x1401b1b43
sub r14, 1
jb 0x1401b1a09
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b1a09
mov r8d, 2
mov rdx, rbx
call fcn.14014eb90
test al, al
jne 0x1401b1b21
mov rcx, rsi
call fcn.1401ae9f0
test al, al
jne 0x1401b1b21
mov rax, qword [rsi]
test rax, rax
jne 0x1401b19d0
jmp 0x1401b196a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1401b1ae8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x1401b1a82
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1401b1a6c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1401b1a5b
add dl, 0xa9
jmp 0x1401b1a6a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1401b1ae8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1401b1ae8
movzx edx, bl
add rax, rdx
jae 0x1401b1a30
jmp 0x1401b1ae8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1401b1ae8
cmp rax, rcx
jae 0x1401b1ae5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1401b1b3b
cmp qword [rsi + 0x20], 0
je 0x1401b1b34
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1401b1900
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1401b196c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b1b29
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x1402ed340]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14014eb90
test al, al
je 0x1401b1b29
mov dil, 2
jmp 0x1401b196a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1401b196a
mov dil, 1
xor r8d, r8d
jmp 0x1401b1aea
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1401b196a
Function at 0x1401ef63b
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1401ef667
xor eax, eax
jmp 0x1401ef66c
call fcn.14019912a
nop
add rsp, 0x38
ret

Function at 0x1401f1ba0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1402fda68]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1401f1c13
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1401f1c4a
test eax, eax
js 0x1401f1c24
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401f1c3d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1402fdad0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401efbe0
mov rcx, rax
call fcn.1401efd20
mov ecx, 7
int 0x29
ud2
Function at 0x1401f56a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1401f56d0
test ecx, ecx
jne 0x1401f5720
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1401f56dc
test ecx, ecx
jne 0x1401f5720
mov rcx, rdi
call fcn.1401f5580
movzx eax, al
test bpl, bpl
jne 0x1401f5727
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x1401f5713.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1401f5898]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x1401f5713.2
xor eax, eax
test bpl, bpl
je 0x1401f56ec
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1401f5879
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x1401f575a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1401f57d9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1401f57a0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1401f57bb
inc rax
dec rdi
cmp rax, 1
jne 0x1401f5780
jmp 0x1401f57d9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1401f57bb
cmp ebx, 0x5c
je 0x1401f57bb
inc rax
dec rdi
cmp rax, 1
jne 0x1401f57a0
jmp 0x1401f57d9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x1401f5887
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x1401f5803
mov al, 9
cmp rdx, 2
je 0x1401f5807
cmp rdx, 1
jne 0x1401f5817
cmp byte [r8], 0x2e
jne 0x1401f5817
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x1401f5817
mov al, 0xa
jmp 0x1401f5817
cmp byte [r8], 0x2e
jne 0x1401f5817
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x1401f5713.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x1401f5713.2
mov ecx, 2
jmp case.0x1401f5713.2
lea r8, str.library_std_srcpath.rs
call fcn.140286eb0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140286eb0
ud2
Function at 0x1401f9690
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1402fda68]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1401f96fc
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1401f970b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1401f9743
cmp eax, 0x103
je 0x1401f974d
test eax, eax
js 0x1401f9728
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1401f9743
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1402fdad0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401efbe0
mov rcx, rax
call fcn.1401efd20
mov ecx, 7
int 0x29
ud2

Function at 0x1401f9ed0
Capabilities:
Create directory

Disassembly:
test cl, cl
je 0x1401f9edf
mov rcx, rdx
mov rdx, r8
jmp fcn.1401f9fa0
mov rcx, rdx
mov rdx, r8
jmp fcn.1401f9ef0

Function at 0x1401f9ef0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401f2800
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x1401f9f91
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
call fcn.1401f97b0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1401f9f91
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1401f9f6d
test rsi, rsi
je 0x1401f9f69
mov edx, 2
mov rcx, rdi
call fcn.140118d90
xor esi, esi
jmp 0x1401f9f91
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1401f9f8e
mov edx, 2
mov rcx, rdi
call fcn.140118d90
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401ff050
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1403afa10]
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.140118d00
test rax, rax
je 0x1401ff126
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401ff1b0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401ff118
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x1401ff0f6
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140118d90
mov edx, 8
mov rcx, qword [rbp - 0x18]
call fcn.140118d90
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, reloc.WS2_32.dll_recv
call fcn.1402869f0
ud2

Function at 0x1401ff2d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1401ff313
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1401f6ac0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140286df0
ud2

Function at 0x1402041c0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1402041f5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1402041fa
call fcn.1401ff2d0
nop
add rsp, 0x38
ret