joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000128c
Capabilities:
Create directory

Disassembly:
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x70], 0x6c3d907d
mov eax, dword [rsp + 0x8c]
xor eax, 0x773a2ca4
mov rcx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x60], rcx
mov ecx, eax
mov rdx, qword [rsp + 0x60]
call rdx
lea rdx, str.:ec
xor eax, eax
mov r8d, eax
mov r9, qword [rsp + 0x70]
mov r10, r9
sub r10, 0x1bfe249f
lea rcx, str.:ec
mov r11, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
mov esi, eax
mov qword [rsp + 0x58], rdx
mov rdx, rsi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r9
call r11
mov edi, 0x31750b3e
mov ecx, edi
mov edi, eax
imul edi, edi
mov ebx, eax
imul ebx, ebx
imul eax, eax
imul edi, edi
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x34], eax
jb 0x140001382
mov rax, qword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor ecx, ecx
mov edx, ecx
retf 0x7eb9
sub r11b, byte [rdx - 0x77]
and al, 0x30
mov rcx, rdx
mov r8d, dword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov edx, r8d
mov r8, qword [rsp + 0x28]
call rax
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x6c]
sub eax, 3
sbb ecx, ecx
and ecx, 1
mov dword [rsp + 0x24], eax
mov eax, ecx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x40]
and rax, rax
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x34]
imul ecx, edx
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], ecx
call rax
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x20]
cmp eax, ecx
jae 0x140001365
jmp 0x14000132e

Function at 0x1400013c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], 0x1bc1c17b
mov qword [rsp + 0x28], 0x1647810e
and al, 0x28
invalid
add dword [rdi + 0x16], 0x8b058b48
cmp al, 0
add bh, bh
ror byte [rax - 0x75], 1
and al, 0x28
sub rcx, 0x420824ac
cmp rcx, 0x46a02f83
mov dword [rsp + 0x24], eax
jne 0x1400013fd
add rsp, 0x38
ret
mov eax, dword [rsp + 0x24]
cmp eax, 4
jae 0x1400013f8
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2

Function at 0x1400031f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
lea rax, [fcn.1400031f0]
mov ecx, dword [rsp + 0x24]
mov edx, ecx
xor edx, 0xffffffff
mov dword [rsp + 0x24], edx
mov dword [rsp + 0x14], ecx
mov qword [rsp + 8], rax
jmp 0x14000323f
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
mov rdx, qword [rsp + 0x18]
xor rdx, 0xffffffffffffffff
mov r8d, dword [rax + rcx]
mov qword [rsp + 0x18], rdx
cmp r8d, 0x4550
jne 0x14000324f
mov rax, qword [rsp]
add rsp, 0x28
ret
mov rax, qword [rsp + 8]
cmp word [rax], 0x5a4d
mov qword [rsp], rax
je 0x140003213
mov eax, dword [rsp + 0x14]
imul ecx, eax, 0x2c773039
mov dword [rsp + 0x24], ecx
mov rdx, qword [rsp]
add rdx, 0xfffffffffffff000
and rdx, 0xfffffffffffff000
mov qword [rsp + 8], rdx
jmp 0x14000323f
Function at 0x140003280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
xor eax, eax
mov qword [rsp + 8], rcx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x10]
xor rcx, qword [rsp + 0x10]
mov edx, eax
mov r8d, edx
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 8]
mov r9b, byte [rcx + r8]
mov edx, eax
add edx, 1
cmp r9b, 0
mov dword [rsp], eax
mov dword [rsp + 4], edx
jne 0x14000328f
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x1400032d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x64], 0x1a9c9d8d
mov dword [rsp + 0x60], 0x11da1d56
mov eax, dword [rsp + 0x60]
imul eax, eax, 0x6e2e9bc6
mov r9, qword [rsp + 0x58]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x50], 0
cmp r8d, 0
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x44], r8d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r9
jne 0x14000331e
add rsp, 0x68
ret
lea rax, [0x140005260]
imul ecx, dword [rsp + 0x64], 0x1a08ffe7
mov edx, dword [rsp + 0x50]
mov r8d, edx
and r8d, 0xf
mov r8d, r8d
mov r9d, r8d
mov r10, qword [rsp + 0x30]
xor r10, 0x5bccd2da
mov qword [rsp + 0x58], r10
mov r10, qword [rsp + 0x38]
mov dword [rsp + 0x2c], ecx
mov rcx, r10
mov r11, qword [rsp + 0x48]
mov dword [rsp + 0x28], edx
mov rdx, r11
mov r8d, dword [rsp + 0x28]
movzx r9d, byte [rax + r9]
call fcn.140001170
mov rax, qword [rsp + 0x30]
and rax, 0x2e53e841
mov qword [rsp + 0x58], rax
mov r8d, dword [rsp + 0x28]
add r8d, 1
mov dword [rsp + 0x60], 0x3ce34e07
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x50], 0x5cef9e81
mov r8d, dword [rsp + 0x2c]
cmp r8d, 0x7f3a1926
jae 0x14000331e
mov dword [rsp + 0x60], 0xa995b15e
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x50], ecx
mov ecx, dword [rsp + 0x44]
cmp eax, ecx
je 0x140003319
jmp 0x14000331e
Function at 0x140003f4c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140003b5c
add rsp, 0x28
jmp 0x140003f70
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14001d938], rdi
jne 0x140008848
mov eax, dword [0x14001d930]
cmp eax, 1
je 0x140008868
mov eax, dword [0x14001d930]
cmp eax, ebx
jne 0x14000887f
mov dword [0x14001d930], 1
lea r13, [0x140014218]
lea rdi, [0x140014200]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000401c
cmp eax, ebx
jne 0x14000401c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140004011
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140003ffa
cmp eax, ebx
jne 0x140008875
mov eax, dword [0x14001d930]
cmp eax, 1
jne 0x14000404c
lea rdx, [0x1400141f8]
lea rcx, [0x1400141c0]
call fcn.140167000
mov dword [0x14001d930], 2
cmp r12d, ebx
jne 0x14000405b
mov rax, rbx
xchg qword [0x14001d938], rax
cmp qword [0x14001d950], rbx
jne 0x14000888e
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x1400088b7
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14000409f
cmp word [rcx], 0x22
je 0x140008912
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140004084
cmp word [rcx], bx
jne 0x1400088c1
cmp word [rcx], bx
jne 0x1400088ce
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400040e8
nop
jmp 0x1400088e6
cmp rax, rdi
jne 0x140008858
mov r12d, 1
jmp 0x140003fba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003fa9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140004024
mov eax, 0xff
jmp 0x140008951
mov dword [0x14001db2c], 1
jmp 0x140004024
lea rcx, [0x14001d950]
call fcn.140011e1c
cmp eax, ebx
je 0x140004068
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14001d950]
nop
jmp 0x140004068
mov eax, 0xff
jmp 0x140008951
cmp edx, ebx
je 0x1400040a8
jmp 0x14000408a
cmp word [rcx], 0x20
ja 0x1400040b1
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400040a8
mov dword [0x14001db28], eax
cmp dword [0x14001d30c], ebx
jne 0x1400088fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001db2c], ebx
jne 0x140008910
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001db28]
jmp 0x140008951
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140004094
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140020a40
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx]
xor r11d, r11d
movabs r10, 0x100000001b3
cmp r8, r11
je 0x140020a66
movzx eax, byte [rdx + r11]
xor r9, rax
imul r9, r10
inc r11
jmp 0x140020a50
mov qword [rcx], r9
ret
Function at 0x140046480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140046500
cmp r10, rax
jb 0x140046574
cmp r10, rdx
ja 0x140046588
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140046502
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x1400464e0
jmp 0x140046563
ja 0x14004650a
mov rax, r10
cmp r11, r8
jne 0x1400464b2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140046540
mov r15, rbx
sub ecx, edx
jns 0x14004655a
jmp 0x140046565
cmp rbx, r14
je 0x140046599
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140046565
xor al, 1
cmp r15, r14
jne 0x140046520
jmp 0x140046565
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14014e560
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14014e490
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14014e4a0
ud2
Function at 0x1400743cc
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [0x1401efed8]
test rdi, rdi
jne 0x140074512
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140074439
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074439
mov rbx, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074439
mov r15, rax
mov r12d, 1
jmp 0x1400744c7
lea rcx, [0x14016aab8]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140074528
mov rbx, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074528
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074528
mov r15, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140074528
mov r14, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
mov rax, rdi
call qword [0x1401534b8]
test eax, eax
jne 0x140074528
mov rbx, qword [rsp + 0x20]
xor r12d, r12d
mov ecx, 0x20
call fcn.140103636
mov rdi, rax
mov qword [rax], r12
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r14
xor eax, eax
lock cmpxchg qword [0x1401efed8], rdi
je 0x140074512
mov rbx, rax
cmp qword [rdi], 0
jne 0x140074502
mov rcx, qword [rdi + 8]
call sub.kernel32.dll_CloseHandle
mov edx, 8
mov rcx, rdi
call fcn.140004990
mov rdi, rbx
and qword [rsi], 0
mov qword [rsi + 8], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:__w_tempcargo_home_registry_srcmscodehub.visualstudio.com_6ebbd88449dc646cparking_lot_core_0.8.5_src_thread_parkerwindowsmod.rs
lea r8, [0x14016abc8]
mov edx, 0x5b
call fcn.14014f8da
ud2
Function at 0x1400818c7
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400819a9
mov r14, r8
mov r15, rdx
mov r10, qword [rdx]
movabs rax, 0xcbf29ce484222325
xor rax, r10
movabs rdx, 0x100000001b3
imul rax, rdx
movzx r8d, byte [r15 + 8]
xor rax, r8
imul rax, rdx
movzx r9d, byte [r15 + 9]
xor rax, r9
imul rax, rdx
xor r11d, r11d
xor edx, edx
div rcx
mov r12, rdx
mov rdi, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x20]
mov rax, qword [rdi + r12*8]
imul rbx, rax, 0x18
add rbx, rcx
cmp rax, rdx
cmovae rbx, r11
jae 0x140081966
cmp qword [rbx], r10
jne 0x140081966
cmp byte [rbx + 8], r8b
jne 0x140081966
cmp byte [rbx + 9], r9b
jne 0x140081966
mov rdx, qword [rbx + 0x10]
mov eax, 1
jmp 0x14008199b
mov qword [rdi + r12*8], rdx
cmp rdx, qword [rsi + 0x18]
jne 0x140081981
lea rcx, [rsi + 0x10]
call fcn.14007c4b7
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x20]
imul rax, rdx, 0x18
movups xmm0, xmmword [r15]
movups xmmword [rcx + rax], xmm0
mov qword [rcx + rax + 0x10], r14
inc rdx
mov qword [rsi + 0x20], rdx
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero
lea r8, str.C:__w_tempcargo_home_registry_srcmscodehub.visualstudio.com_6ebbd88449dc646c_regex_1.7.0_srccompile.rs
mov edx, 0x39
call fcn.14014e4a0
ud2
Function at 0x1400a7370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x1400a73c2
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x1400a73c2
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x1400a73dd
cmp eax, 0x42
jne 0x1400a73c2
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x1400a741a
cmp byte [rdi + rcx], 0x5f
jne 0x1400a741a
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1400a7512
mov rcx, rsi
xor edx, edx
call fcn.1400a2ee0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.1400a2ee0
test al, al
jne 0x1400a7415
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400a748c
lea rdx, [0x1401db82c]
mov r8d, 1
call fcn.140042330
test al, al
je 0x1400a748c
mov dil, 2
jmp 0x1400a73d1
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x1400a752e
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x1400a7506
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400a746f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400a745e
add dl, 0xa9
jmp 0x1400a746d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400a752e
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x1400a752e
movzx edx, bl
add rax, rdx
jae 0x1400a7430
jmp 0x1400a752e
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400a73d1
xor ebx, ebx
lea r14, [0x1401cc1c3]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400a74c4
cmp byte [rax + rcx], 0x45
je 0x1400a75bc
sub rbx, 1
jb 0x1400a74e9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400a74e9
mov r8d, 2
mov rdx, r14
call fcn.140042330
test al, al
jne 0x1400a7415
mov rcx, rsi
call fcn.1400a75d0
test al, al
jne 0x1400a7415
mov rax, qword [rsi]
test rax, rax
jne 0x1400a74b0
jmp 0x1400a73d1
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x1400a752e
cmp rax, r9
jae 0x1400a752b
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
jbe 0x1400a757f
mov bl, 1
xor r8d, r8d
jmp 0x1400a7530
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400a756e
lea rax, [0x1401c5519]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.140042330
mov dil, 2
test al, al
jne 0x1400a73d1
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x1400a73d1
cmp qword [rsi + 0x20], 0
je 0x1400a7578
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400a7370
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400a73d3
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400a73d1
Function at 0x1400aeeb7
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rdx
mov r14, rcx
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, r8
mov r8, r9
call fcn.1400aefe0
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.14008dc19
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400aef4e
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.140004c28
mov rbx, qword [rsp + 0x40]
jmp 0x1400aef19
test eax, eax
jne 0x1400aef70
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x1400aef8f
movabs rax, 0xde00000002
jmp 0x1400aef78
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400071c0
jmp 0x1400aefa5
mov rcx, qword [rsp + 0x50]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14004f377
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010b430
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r15d, r15d
xor ebx, ebx
cmp r8, 0x201
jae 0x14010b4c0
jmp 0x14010b4af
jae 0x14010b57e
cmp r8, 0x201
jae 0x14010b4c0
mov r13d, 0x200
lea rdi, [rbp - 0x58]
mov rsi, r8
jmp 0x14010b517
sub r8, rbx
sub r15, rbx
cmp r15, r8
jae 0x14010b4ef
lea rcx, [rbp + 0x3c8]
mov rdx, rbx
call fcn.1401519e0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r12, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r12, rax
mov ebx, 0xffffffff
cmovb rbx, r12
mov qword [rbp + 0x3d8], rbx
mov r15, r12
mov r13, rbx
mov rdi, qword [rbp + 0x3e8]
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, esi
mov rdx, rdi
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14010b53f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14010b5dd
mov r8d, r14d
cmp rsi, r8
jne 0x14010b4a0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14010b600
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x14010b4af
jmp 0x14010b4c0
cmp r13, r8
jb 0x14010b61a
lea rcx, [rbp + 0x3a8]
mov rdx, rdi
call fcn.14010ba00
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3e0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test r12, r12
je 0x14010b5c8
mov edx, 2
mov rcx, qword [rbp + 0x3e8]
call fcn.140004990
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e0]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test r12, r12
jne 0x14010b5b7
jmp 0x14010b5c8
lea rcx, str.internal_error:_entered_unreachable_codecannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_1.65.0library_std_src_threadlocal.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14014e4a0
jmp 0x14010b62f
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r13
mov r8, rax
call fcn.14014e490
ud2
Function at 0x14010d3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14010d3f3
test ecx, ecx
jne 0x14010d442
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x14010d400
test ecx, ecx
jne 0x14010d442
mov rcx, rdi
call fcn.14010d2a0
movzx r10d, al
test bl, bl
jne 0x14010d449
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14010d436.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14010d5bc]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14010d436.2
xor r10d, r10d
test bl, bl
je 0x14010d410
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14010d59e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14010d47b
xor edi, edi
jmp 0x14010d4f8
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14010d4c0
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14010d4db
inc rsi
dec rax
cmp rsi, 1
jne 0x14010d4a0
jmp 0x14010d4f8
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14010d4db
cmp ebx, 0x5c
je 0x14010d4db
inc rsi
dec rax
cmp rsi, 1
jne 0x14010d4c0
jmp 0x14010d4f8
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14010d5ac
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14010d522
mov al, 9
cmp rdx, 2
je 0x14010d526
cmp rdx, 1
jne 0x14010d536
cmp byte [r9], 0x2e
jne 0x14010d536
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14010d536
mov al, 0xa
jmp 0x14010d536
cmp byte [r9], 0x2e
jne 0x14010d536
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14010d436.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14010d436.2
mov esi, 2
jmp case.0x14010d436.2
lea r8, str.library_std_srcpath.rs
call fcn.14014e480
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14014e480
ud2