joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140066ece], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x1400231e5
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140066e98], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140066e98], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140066e98], rdx
call fcn.140021140
cmp eax, ebx
jne 0x14002334d
mov byte [0x140066ece], 1
lea rdx, [0x140047488]
mov rcx, rsi
call fcn.140037320
test eax, eax
je 0x140023270
cmp byte [0x140066ecd], 1
je 0x140023270
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c28], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c30], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c38], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c40], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c48], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c50], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c58], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140067c60], rax
mov byte [0x140066ecd], 1
mov r8, qword [0x140066e98]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140023297
inc rax
test cl, cl
jne 0x140023280
mov ecx, r9d
jmp 0x14002329c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x1400232a3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140023308
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1400232e5
inc rax
test cl, cl
jne 0x1400232d0
mov ecx, r9d
jmp 0x1400232ea
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1400232f1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x1400232c0
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140023338
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001f7c0
add rdi, 8
sub rbx, 1
jne 0x140023320
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1400320b4
call fcn.140029e50
int3
Function at 0x140026250
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140065300]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140026301
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140035874
cmp rax, 1
jne 0x140026337
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1400262dd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1400262d0
cmp rcx, 1
jb 0x140026337
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400262a0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400266c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140029e50
int3

Function at 0x140026540
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140065300]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x1400265ef
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140035874
cmp rax, 1
jne 0x140026625
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400265cc
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400265c0
cmp rcx, 1
jb 0x140026625
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140026590
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400266c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140029e50
int3

Function at 0x1400270f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002713e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002713e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002713e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002713e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002713e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027140
xor al, al
add rsp, 0x28
ret
Function at 0x14002b4c4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b533
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b533
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b533
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b533
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b533
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b533
cmp dword [rcx + 0xf8], 0
je 0x14002b533
mov ecx, ebx
call fcn.14002b5e4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b3c0
nop
cmp dword [rbp + 0x20], 0
je 0x14002b581
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b58c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b4c4

Function at 0x14002b6c8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b533
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b533
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b533
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b533
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b533
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b533
cmp dword [rcx + 0xf8], 0
je 0x14002b533
mov ecx, ebx
call fcn.14002b5e4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b3c0
nop
cmp dword [rbp + 0x20], 0
je 0x14002b581
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b58c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b4c4
Function at 0x14003d400
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003d487
mov rsi, rbx
cmp word [rax], bp
je 0x14003d446
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003d430
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003d42c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140038980
mov rdi, rax
test rax, rax
je 0x14003d474
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140043780
mov rbp, rdi
xor ecx, ecx
call fcn.1400394c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003fb8c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003fba2
mov al, 1
jmp 0x14003fc02
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003fbb3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003fc00
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003dba4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fc00
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003fc00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003fc00
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003fc02
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140043560
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140043588
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140043588
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400e7b60]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400e7b70]
mov dword [rax], 1
mov rax, qword [0x1400e7b80]
mov dword [rax], 1
mov rax, qword [0x1400e7b00]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400e7b50]
mov dword [0x1400fc00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400e7c30]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400e7c10]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400e7ab0]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140006720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140006760
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140006755
cmp edi, 0x2d
jne 0x140006760
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x1400068f4
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1400068ff
movzx r11d, r11b
cmp rbx, rsi
jae 0x1400067fd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x1400067bc
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x1400067fd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x1400067fd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x1400067a0
cmp r11d, 0xccccccc
jne 0x1400067e8
cmp sil, 7
jbe 0x1400067a0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE23parse_exponent_overflowCs63Ca0MJTfU7_3rls
jmp 0x1400068e1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14000681a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14000682a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1400bb9d0]
subpd xmm1, xmmword [0x1400bb9e0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14000689c
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400bb9f0]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140006878
jnp 0x1400068ca
test r10d, r10d
jns 0x140006928
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x140006870
mov eax, eax
mov r9, qword [0x1400ba058]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x1400068e9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x1400bba00]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x1400bba10]
jae 0x140006928
test r8b, r8b
jne 0x1400068d7
xorpd xmm0, xmmword [0x1400bba20]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x1400068cf
jmp 0x1400068d7
mov qword [rsp + 0x28], 5
jmp 0x140006908
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE5errorCs63Ca0MJTfU7_3rls
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400068e1
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE5errorCs63Ca0MJTfU7_3rls
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400068de
Function at 0x140012120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140012160
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140012155
cmp edi, 0x2d
jne 0x140012160
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x1400122f4
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1400122ff
movzx r11d, r11b
cmp rbx, rsi
jae 0x1400121fd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x1400121bc
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x1400121fd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x1400121fd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x1400121a0
cmp r11d, 0xccccccc
jne 0x1400121e8
cmp sil, 7
jbe 0x1400121a0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE23parse_exponent_overflowB7_
jmp 0x1400122e1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14001221a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14001222a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1400bd660]
subpd xmm1, xmmword [0x1400bd670]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14001229c
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400bd680]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140012278
jnp 0x1400122ca
test r10d, r10d
jns 0x140012328
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x140012270
mov eax, eax
lea r9, [0x1400bd818]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x1400122e9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x1400bd690]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x1400bd6a0]
jae 0x140012328
test r8b, r8b
jne 0x1400122d7
xorpd xmm0, xmmword [0x1400bd6b0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x1400122cf
jmp 0x1400122d7
mov qword [rsp + 0x28], 5
jmp 0x140012308
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE5errorB7_
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400122e1
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym._RNvMs3_NtCsa9EHgZ0QDXL_10serde_json2deINtB5_12DeserializerNtNtB7_4read7StrReadE5errorB7_
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400122de
Function at 0x140022370
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x1400223d3
lea rsi, [rbp - 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rbp + 0x16c], eax
test eax, eax
jne 0x1400223df
lea rax, [0x1400b795c]
mov qword [rdi], rax
add rsp, 0x1f0
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.library_std_src_synconce.rs
call sym.core::option::unwrap_failed::hf854068267f7c4f8
mov qword [rbp + 0x138], 0
lea rdx, [0x1400c93c8]
lea r9, str.library_std_src_syspalwindows_net.rs
lea rcx, [rbp + 0x16c]
lea r8, [rbp + 0x138]
call dbg.assert_failed<i32, i32>
int3
Function at 0x140043d90
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret

Function at 0x140045100
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140045190
jmp 0x14004517f
jae 0x14004524b
cmp r8, 0x201
jae 0x140045190
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1400451e7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1400451bf
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h0a1ba4070e627a48
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x14004520d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400452b7
mov r8d, r13d
cmp r12, r8
jne 0x140045170
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400452ea
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14004517f
jmp 0x140045190
cmp r14, r8
jb 0x140045304
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call dbg.from_wide
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x1400452a0
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x14004528b
jmp 0x1400452a0
lea rcx, [0x1400c5940]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call dbg.panic
jmp 0x140045319
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call dbg.slice_end_index_len_fail
ud2
Function at 0x140045350
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x14004536f
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hff640d2006a2350b]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call dbg.panic_fmt
ud2
Function at 0x140045d40
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov r14, r9
mov r15, r8
mov r8, rdx
mov rdx, rcx
movabs r13, 0x8000000000000000
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r9
lea rsi, [rbp - 0x10]
mov rcx, rsi
call sym.std::sys::pal::windows::to_u16s::inner::h83e262786e95c011
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 8]
cmp rdi, r13
jne 0x140045d9f
mov r14, rbx
jmp 0x140045e04
lea rcx, [rbp - 0x10]
mov rdx, r15
mov r8, r14
call sym.std::sys::pal::windows::to_u16s::inner::h83e262786e95c011
mov r12, qword [rbp - 0x10]
mov r15, qword [rbp - 8]
cmp r12, r13
jne 0x140045dc0
mov r14, r15
jmp 0x140045deb
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
je 0x140045e1d
xor r14d, r14d
test r12, r12
je 0x140045deb
add r12, r12
mov r8d, 2
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
test rdi, rdi
je 0x140045e04
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
test r14, r14
jne 0x140045e34
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
test r12, r12
jne 0x140045dd7
jmp 0x140045deb
mov qword [rbp + 0x20], r14
lea rax, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::ffi::os_str::Display_as_core::fmt::Debug_::fmt::ha3d9ea8a970727b1]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov qword [rbp], rcx
mov qword [rbp + 8], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hff640d2006a2350b]
mov qword [rbp + 0x18], rax
lea rax, str.failed_to_set_environment_variable____to___:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 3
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 3
lea rdx, str.library_std_srcenv.rs
lea rcx, [rbp - 0x60]
call dbg.panic_fmt
ud2