joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7df0
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14017cc50
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14017c5d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14017cc8f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d7020]
jmp 0x14017cc99
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c806b
Capabilities:
Query environment variable

Disassembly:
jmp 0x140233130
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140232f60
lea rcx, [rsp + 0x40]
call fcn.1402330e0
movzx eax, al
test eax, eax
jne 0x140233178
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140232f90
mov rax, qword [rsp + 0x70]
jmp 0x140233349
lea rcx, [rsp + 0x40]
call fcn.1402330b0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140233050
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1402330b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c934e
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14023321e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140232f90
mov rax, qword [rsp + 0x80]
jmp 0x140233349
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c7c33
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c79ea
lea rcx, [rsp + 0x48]
call fcn.1400c73c3
movzx eax, al
test eax, eax
jne 0x140233285
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5e1a
lea rcx, [rsp + 0x40]
call fcn.140232f90
mov rax, qword [rsp + 0x88]
jmp 0x140233349
lea rcx, [rsp + 0x48]
call fcn.1400c85de
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1402330b0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c934e
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14023331b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5e1a
lea rcx, [rsp + 0x40]
call fcn.140232f90
mov rax, qword [rsp + 0xa0]
jmp 0x140233349
lea rcx, [rsp + 0x48]
call fcn.1400c799f
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c5e1a
lea rcx, [rsp + 0x40]
call fcn.140232f90
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400c8089
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14017cb80
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14017c550
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14017cbc1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d7020]
jmp 0x14017cbc7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400c816a
Capabilities:
Get geographical location

Disassembly:
jmp 0x14020f7b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14020e6e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14020f817
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402d7030]
jmp 0x14020f839
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c7323
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400c8183
Capabilities:
Terminate process

Disassembly:
jmp 0x140159720
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400c856b
Capabilities:
Print debug messages

Disassembly:
jmp 0x140244d30
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402b9140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140244d56
jmp 0x140244dd3
mov rcx, qword [rbp + 0x30]
call fcn.1400c7841
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140244d6f
jmp 0x140244dd3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140244d8c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c6054
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c66e4
test eax, eax
jne 0x140244dd3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400c7b3e
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400c89df
Capabilities:
Set environment variable

Disassembly:
jmp 0x140235290
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400c8d4f
Capabilities:
Parse pe header

Disassembly:
jmp 0x14015b130
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14015b150
xor al, al
jmp 0x14015b1d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14015b163
xor al, al
jmp 0x14015b1d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14015b18d
xor al, al
jmp 0x14015b1d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14015b1a1
xor al, al
jmp 0x14015b1d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14015b1b3
xor al, al
jmp 0x14015b1d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14015b1cf
xor al, al
jmp 0x14015b1d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400c9628
Capabilities:
Terminate process

Disassembly:
jmp 0x14017df40
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14017df6e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400ca27b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400ca30c
Capabilities:
Print debug messages

Disassembly:
jmp 0x140222c00
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400ca4a1
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14017ccc0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14017c610
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14017cd09
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d7020]
jmp 0x14017cd18
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400ca5c3
Capabilities:
Set environment variable

Disassembly:
jmp 0x14024e680
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c7107
lea rcx, [rsp + 0x48]
call fcn.1400c7107
call fcn.1400c7fda
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c6dba
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14024e6ef
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c76cf
lea rcx, [rsp + 0x78]
call fcn.1400c76cf
mov eax, dword [rsp + 0x24]
jmp 0x14024e780
call fcn.1400c7fda
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c6dba
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14024e736
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c76cf
lea rcx, [rsp + 0x78]
call fcn.1400c76cf
mov eax, dword [rsp + 0x2c]
jmp 0x14024e780
lea rcx, [rsp + 0x48]
call fcn.1400c700d
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c700d
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c76cf
lea rcx, [rsp + 0x78]
call fcn.1400c76cf
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140213800
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c6054
sub rsp, rax
mov rax, qword [0x1402b9140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402be0c0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1402139f2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140213946
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140213946
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14021392b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1402138c8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1402139b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140213a11
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1402139ed
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140213a11
jmp 0x14021389e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c7b3e
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140213ac0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c6054
sub rsp, rax
mov rax, qword [0x1402b9140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402be0c0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140213ccd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140213c19
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140213c19
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140213bf9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140213b88
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140213c8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140213cec
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140213cc8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140213cec
jmp 0x140213b5e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c7b3e
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14000b3cb
Capabilities:
Encode data using base64
Hash data using sha512

Disassembly:
mov rcx, qword [rcx]
add qword [rcx + 0x40], r8
adc qword [rcx + 0x48], 0
jmp 0x14010baae
Function at 0x140046543
Capabilities:
Manipulate console buffer

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
test dl, dl
je 0x14004656d
lea rdx, str._re_2Ke__25he__25l_usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_console_0.15.8_src_term.rs
mov r8d, 5
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.14004606a
call fcn.140045baf
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov rdx, rax
call fcn.1400465f1
cmp qword [rsi], 0
je 0x1400465e4
mov rsi, qword [rsp + 0x40]
movzx eax, word [rsp + 0x56]
sub ax, word [rsp + 0x52]
lea r14, [rsp + 0x34]
and dword [r14], 0
movzx edi, word [rsp + 0x50]
movzx ebx, word [rsp + 0x4e]
movsx ebp, ax
shl ebx, 0x10
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov dl, 0x20
mov r8d, ebp
mov r9d, ebx
call sub.kernel32.dll_FillConsoleOutputCharacterA
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov edx, edi
mov r8d, ebp
mov r9d, ebx
call sub.kernel32.dll_FillConsoleOutputAttribute
mov rcx, rsi
mov edx, ebx
call sub.kernel32.dll_SetConsoleCursorPosition
xor eax, eax
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14004704d
Capabilities:
Manipulate console buffer

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov rsi, rcx
test dl, dl
je 0x1400470db
mov eax, 1
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
lea r8, [rsp + 0x80]
mov qword [r8], rcx
lea rcx, [0x14016f628]
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
and qword [rdx + 0x20], 0
lea rcx, [fcn.140047930]
mov qword [r8 + 8], rcx
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], rax
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.140044fbd
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov rdx, rbx
call fcn.14004606a
mov rsi, rax
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140045538
jmp 0x140047163
mov rcx, rsi
call fcn.140045baf
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov rdx, rax
call fcn.1400465f1
cmp qword [rsi], 0
je 0x140047161
mov rsi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x4c]
movzx edi, word [rsp + 0x50]
test ax, ax
mov ecx, 1
cmovle ecx, eax
sub eax, ecx
movzx edx, word [rsp + 0x4e]
lea r14, [rsp + 0x68]
and dword [r14], 0
movsx ebx, cx
shl edx, 0x10
movzx ebp, ax
or ebp, edx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov dl, 0x20
mov r8d, ebx
mov r9d, ebp
call sub.kernel32.dll_FillConsoleOutputCharacterA
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov edx, edi
mov r8d, ebx
mov r9d, ebp
call sub.kernel32.dll_FillConsoleOutputAttribute
mov rcx, rsi
mov edx, ebp
call sub.kernel32.dll_SetConsoleCursorPosition
xor esi, esi
mov rax, rsi
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400473b2
Capabilities:
Manipulate console buffer

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test dl, dl
je 0x140047459
inc rbx
lea rax, [rsp + 0x28]
mov qword [rax], rbx
inc rdi
lea rcx, [rsp + 0x30]
mov qword [rcx], rdi
lea r8, [rsp + 0x80]
mov qword [r8], rax
lea rax, [0x14016f5f0]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
lea rax, [fcn.140047930]
mov qword [r8 + 8], rax
mov qword [rdx + 8], 3
and qword [rdx + 0x20], 0
mov qword [r8 + 0x10], rcx
mov qword [r8 + 0x18], rax
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], 2
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.140044fbd
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov rdx, rbx
call fcn.14004606a
mov rsi, rax
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140045538
jmp 0x14004748b
mov rcx, rsi
call fcn.140045baf
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov rdx, rax
call fcn.1400465f1
cmp qword [rsi], 0
je 0x140047489
mov rcx, qword [rsp + 0x40]
shl ebx, 0x10
movzx edx, di
or edx, ebx
call sub.kernel32.dll_SetConsoleCursorPosition
xor esi, esi
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004e130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14004e1c0
cmp r11, r10
ja 0x14004e236
cmp r10, rdx
ja 0x14004e248
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14004e1c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14004e1a0
jmp 0x14004e224
ja 0x14004e1ca
mov r11, r10
cmp rax, r8
jne 0x14004e164
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14004e200
mov rdi, r8
sub ecx, edx
jns 0x14004e21b
jmp 0x14004e226
cmp r8, rsi
je 0x14004e257
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14004e226
xor al, 1
cmp rdi, rsi
jne 0x14004e1e0
jmp 0x14004e226
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400496e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140048190
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140048530
int3
Function at 0x1400582da
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x140058344
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400582f6
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400582f6
add ebp, 0x80000000
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14005b77f
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14006fc18
test rbx, rbx
je 0x14005b7b8
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14005b7d2
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14005b7ca

Function at 0x14005b7d2
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14005b7f8
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14005b7e2
mov qword [rcx], rax
ret