joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a1e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140064567
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, r9
mov edi, ecx
mov r12, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
mov ebp, edi
shr ebp, 8
lea r13, [rdx + r8*2]
xor ecx, ecx
lea r8, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_core_src_unicode_printable.rs
cmp rdx, r13
je 0x14006460d
lea rbx, [rdx + 2]
movzx r14d, byte [rdx + 1]
add r14, rcx
cmp byte [rdx], bpl
je 0x1400645be
mov rdx, rbx
mov rcx, r14
jbe 0x14006459e
jmp 0x14006460d
mov qword [rsp + 0x20], r8
mov rdx, r14
mov r15, rax
mov r8, rax
mov rsi, r9
call fcn.14005c3dc
xor ecx, ecx
cmp rdx, rcx
je 0x1400645ea
lea r8, [rcx + 1]
cmp byte [rax + rcx], dil
mov rcx, r8
jne 0x1400645d6
jmp 0x1400645f8
mov rdx, rbx
mov rcx, r14
mov r9, rsi
mov rax, r15
jmp 0x140064597
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, di
mov r9, qword [rsp + 0xa0]
add r9, r12
mov al, 1
cmp r12, r9
je 0x1400645fa
lea r8, [r12 + 1]
movzx edx, byte [r12]
test dl, dl
js 0x140064635
mov r12, r8
jmp 0x14006464d
cmp r8, r9
je 0x140064655
and edx, 0x7f
shl edx, 8
movzx r8d, byte [r12 + 1]
add r12, 2
or edx, r8d
sub ecx, edx
js 0x1400645fa
xor al, 1
jmp 0x14006461d
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_core_src_unicode_printable.rs
mov edx, 0x2b
call fcn.140061bfa
ud2

Function at 0x140068b91
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x14010a018]
call fcn.140068bc8
mov ecx, eax
add rsp, 0x28
jmp fcn.1400b814c

Function at 0x140068bac
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.140068bc8
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400b8154
Function at 0x140068bc8
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x14009913d
dec eax
ret
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400991bc
lea r8, [rsp + 0x2c]
and dword [r8], 0
lea rbx, [rsi + 0x10]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400991fd
cmp dword [rsp + 0x2c], 0
je 0x1400991e1
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140099220
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140155178]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140155178], rsi
jne 0x140099197
mov byte [0x140155170], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1400991f3
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140099267
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400991e6
mov edi, dword [rsp + 0x28]
jmp 0x1400991f3
mov edi, dword [rsi + 0x18]
jmp 0x1400991f1
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea r8, [rsp + 0x30]
and qword [r8], 0
lea rdx, [0x140129b18]
lea r9, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x28]
call fcn.140089dca
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14012e9b0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
call fcn.140061448
ud2
lea rax, str.out_of_TLS_indexes
lea r9, [rsp + 0x30]
mov qword [r9], rax
mov qword [r9 + 8], 1
lea rax, [0x14012e9b0]
mov qword [r9 + 0x10], rax
xorps xmm0, xmm0
movups xmmword [r9 + 0x18], xmm0
lea rax, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
mov qword [rsp + 0x20], rax
lea r8, [0x140129a58]
lea rdx, [rsp + 0x28]
mov cl, 1
call fcn.140089d8e
ud2
Function at 0x1400747cd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x14010a118]
call fcn.140068bc8
mov ecx, eax
add rsp, 0x28
jmp fcn.1400b814c

Function at 0x14007483c
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x140074863
cmp qword [rcx + 0x40], 0
js 0x140074863
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp fcn.140074bd2
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140077cd0
test rax, rax
je 0x14007489b
mov edx, 4
mov rcx, rax
call fcn.140001720
jmp 0x1400748d4
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400747c1
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140074bd2

Function at 0x140074863
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x140074863
cmp qword [rcx + 0x40], 0
js 0x140074863
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp fcn.140074bd2
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140077cd0
test rax, rax
je 0x14007489b
mov edx, 4
mov rcx, rax
call fcn.140001720
jmp 0x1400748d4
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400747c1
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140074bd2
Function at 0x140077cd0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x140077d61
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x140077cf0
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140077cf0
xor ebx, 0x80000000
je 0x140077d5f
mov al, byte [0x140155208]
mov ecx, 4
mov edx, 4
call fcn.140001690
test rax, rax
je 0x140077d74
mov rsi, rax
mov dword [rax], ebx
jmp 0x140077d61
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.14005a4bc
ud2
Function at 0x140083568
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov rsi, qword [rsp + 0x58]
mov eax, dword [rdx]
mov edi, r8d
rol edi, 0x19
mov r10d, dword [rdx + 4]
mov ebx, eax
rol ebx, 0x19
mov r11d, dword [rdx + 8]
mov ebp, r10d
rol ebp, 0x19
mov r14d, r11d
rol r14d, 0x19
mov r15d, r8d
rol r15d, 0xe
xor r15d, edi
mov edi, eax
rol edi, 0xe
xor edi, ebx
mov ebx, r10d
rol ebx, 0xe
xor ebx, ebp
mov ebp, r11d
rol ebp, 0xe
xor ebp, r14d
shr r8d, 3
xor r8d, r15d
add r8d, eax
shr eax, 3
xor eax, edi
add eax, r10d
shr r10d, 3
xor r10d, ebx
add r10d, r11d
shr r11d, 3
xor r11d, ebp
add r11d, dword [rdx + 0xc]
add r8d, dword [rsi + 0xc]
add eax, dword [r9]
add r10d, dword [r9 + 4]
add r11d, dword [r9 + 8]
mov edx, dword [rsi + 4]
mov edi, edx
rol edi, 0xf
mov r9d, dword [rsi]
mov esi, edx
rol esi, 0xd
xor esi, edi
shr edx, 0xa
xor edx, esi
add edx, r11d
mov r11d, r9d
rol r11d, 0xf
mov esi, r9d
rol esi, 0xd
xor esi, r11d
shr r9d, 0xa
xor r9d, esi
mov r11d, edx
rol r11d, 0xf
add r9d, r10d
mov r10d, edx
rol r10d, 0xd
xor r10d, r11d
mov r11d, edx
shr r11d, 0xa
xor r11d, r10d
add r11d, eax
mov eax, r9d
rol eax, 0xf
mov r10d, r9d
rol r10d, 0xd
xor r10d, eax
mov eax, r9d
shr eax, 0xa
xor eax, r10d
add eax, r8d
mov dword [rcx], eax
mov dword [rcx + 4], r11d
mov dword [rcx + 8], r9d
mov dword [rcx + 0xc], edx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140083ea8
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140083ec4
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140085cd8
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x30]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov edi, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r13d, r13d
cmp r8, 0x201
jae 0x140085d31
lea r12, [rsp + 0x48]
mov r14d, 0x200
mov r15, r8
jmp 0x140085d66
sub r8, r13
lea rcx, [rsp + 0x30]
mov rdx, r8
call fcn.140084513
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x40], r13
mov r12, rdi
mov r14, r13
mov r15, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r15d
mov rdx, r12
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x140085d87
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140085dd5
mov r8d, ebp
cmp r15, r8
jne 0x140085dab
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x140085e06
add r15, r15
cmp r15, rsi
cmovae r15, rsi
mov r8, r15
jmp 0x140085d18
jb 0x140085d18
lea r9, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_mod.rs
mov rcx, r12
mov rdx, r14
call fcn.140086816
mov r8, rdx
mov rcx, qword [rsp + 0x28]
mov rdx, rax
call fcn.140085e39
jmp 0x140085de6
call fcn.14006b867
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
mov rcx, rdi
mov rdx, rbx
call fcn.140085884
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_mod.rs
mov edx, 0x28
call fcn.140061bfa
ud2
Function at 0x140087b4b
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140128e78]
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov ecx, 0xffffffff
cmp r9, rcx
cmovb rcx, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140087bba
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140087bf0
test eax, eax
js 0x140087bcb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140087be3
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
lea rsi, [rsp + 0x58]
mov byte [rsi + 4], 0
and dword [rsi], 0
and qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rdi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rdi
call fcn.140001ad1
mov rcx, rsi
mov rdx, rdi
call fcn.140087efc
lea rcx, [rsp + 0x70]
mov qword [rcx], rax
call fcn.1400877d9
mov ecx, 7
int 0x29
ud2
Function at 0x140099119
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140068bc8
mov ecx, eax
add rsp, 0x28
jmp fcn.1400b814c

Function at 0x14009913d
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x14009913d
dec eax
ret
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400991bc
lea r8, [rsp + 0x2c]
and dword [r8], 0
lea rbx, [rsi + 0x10]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400991fd
cmp dword [rsp + 0x2c], 0
je 0x1400991e1
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140099220
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140155178]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140155178], rsi
jne 0x140099197
mov byte [0x140155170], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1400991f3
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140099267
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400991e6
mov edi, dword [rsp + 0x28]
jmp 0x1400991f3
mov edi, dword [rsi + 0x18]
jmp 0x1400991f1
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea r8, [rsp + 0x30]
and qword [r8], 0
lea rdx, [0x140129b18]
lea r9, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x28]
call fcn.140089dca
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14012e9b0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
call fcn.140061448
ud2
lea rax, str.out_of_TLS_indexes
lea r9, [rsp + 0x30]
mov qword [r9], rax
mov qword [r9 + 8], 1
lea rax, [0x14012e9b0]
mov qword [r9 + 0x10], rax
xorps xmm0, xmm0
movups xmmword [r9 + 0x18], xmm0
lea rax, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_thread_local_key.rs
mov qword [rsp + 0x20], rax
lea r8, [0x140129a58]
lea rdx, [rsp + 0x28]
mov cl, 1
call fcn.140089d8e
ud2

Function at 0x140099dd2
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10
mov edx, 8
call fcn.14000f390
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140099e6f]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
Function at 0x14009a189
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rdi, rcx
lea rbx, [rsp + 0x78]
mov rcx, rbx
call fcn.140099a02
lea rsi, [rsp + 0x40]
je 0x14009a1d4
mov rcx, rsi
Function at 0x14009d817
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rcx, rdx
mov rdx, r8
call fcn.14009d9f6
mov rcx, rax
call fcn.14009da32
test rax, rax
je 0x14009d863
mov rdi, rdx
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.14009da69
cmp dword [rbx], 2
jne 0x14009d875
lea rcx, [rsp + 0x38]
call fcn.1400849d8
jmp 0x14009d8f5
and qword [rsi], 0
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r12, qword [rsp + 0x68]
mov rcx, rdi
call fcn.14009daaa
mov rcx, rax
call fcn.14009da32
test rax, rax
je 0x14009d8f5
mov rbx, rdx
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rdx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x14009d8fb
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x14009d8fb
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x14009d907
and qword [rsi], 0
jmp 0x14009d907
and qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rcx, rdi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle

Function at 0x14009fa6d
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140128e78]
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov ecx, 0xffffffff
cmp r9, rcx
cmovb rcx, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x14009fad5
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14009fae4
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14009fb18
cmp eax, 0x103
je 0x14009fb22
test eax, eax
js 0x14009fafe
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
and qword [rsi], 0
jmp 0x14009fb18
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
lea rsi, [rsp + 0x58]
mov byte [rsi + 4], 0
and dword [rsi], 0
and qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rdi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rdi
call fcn.140001ad1
mov rcx, rsi
mov rdx, rdi
call fcn.140087efc
lea rcx, [rsp + 0x70]
mov qword [rcx], rax
call fcn.1400877d9
mov ecx, 7
int 0x29
ud2
Function at 0x1400a0811
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r8, rdx
mov rdx, rcx
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.14009ddca
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400a0855
mov rdi, qword [rsp + 0x30]
mov rcx, rsi
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x1400a085c
mov rcx, rsi
mov rdx, rdi
call fcn.140085884
xor eax, eax
jmp 0x1400a0872
mov rax, qword [rsp + 0x30]
jmp 0x1400a0872
call fcn.14006b867
mov rbx, rax
mov rcx, rsi
mov rdx, rdi
call fcn.140085884
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400a1228
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rax
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x1400a127b
call fcn.140086c38
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400a128e
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400a12b2
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
and qword [rax], 0
test rdi, rdi
je 0x1400a1307
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x1400a1321
lea rax, [0x1400b7d94]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sync_once.rs
mov edx, 0x2b
call fcn.140061bfa
ud2
lea r8, [rsp + 0x30]
and qword [r8], 0
lea rdx, [0x140128ea4]
lea r9, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_net.rs
lea rcx, [rsp + 0x2c]
call fcn.140089dca
ud2
Function at 0x1400a44f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400a4564
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.14009a36d
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400a4555
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400a454a
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
jmp 0x1400a4557
mov rcx, rdi
mov rdx, rbx
call fcn.140085884
xor edi, edi
mov qword [rsi], rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a555f
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400a5591
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400a5596
call fcn.1400a559c
nop
add rsp, 0x38
ret

Function at 0x1400a559c
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x90
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a55d0
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x90
pop rsi
ret
call fcn.14006b867
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
lea r9, [rsp + 0x50]
mov qword [r9], rcx
lea rax, [fcn.14008aa19]
mov qword [r9 + 8], rax
mov qword [rsp + 0x20], 1
lea rdx, [0x140129670]
lea rsi, [rsp + 0x60]
mov r8d, 1
mov rcx, rsi
call fcn.140001ad1
lea rdx, str._opt_x86_64_gnu_build_x86_64_unknown_linux_gnu_stage1_lib_rustlib_src_rust_library_std_src_sys_windows_rand.rs
mov rcx, rsi
call fcn.140061448
ud2

Function at 0x1400a57e8
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400a5930
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov r8, qword [rbx + 8]
test r8, r8
jne 0x1400a581d
mov edx, 0x10
mov rcx, rbx
call fcn.14005a3b0
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp r8, rdx
jne 0x1400a583b
mov edx, 1
mov rcx, rbx
call fcn.14005a3b0
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
sub r8, rdx
add rdx, qword [rbx]
mov rax, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
lea r9, [rsp + 0x2c]
and dword [r9], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1400a5887
mov ebx, dword [rsp + 0x2c]
mov eax, 2
test rbx, rbx
je 0x1400a58ba
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov byte [rsi + 1], 1
jmp 0x1400a58be
call fcn.14006b867
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14006c010
mov ecx, eax
mov r8d, 1
mov r9d, 0x3e5
call fcn.1400880b0
test al, al
je 0x1400a58c2
lea rax, [rsp + 0x30]
jmp 0x1400a58ef
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400a5913
mov rcx, rbx
call fcn.14006c010
mov ecx, eax
mov r8d, 1
mov r9d, 0x6d
call fcn.1400880b0
test al, al
je 0x1400a590d
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
and qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400849d8
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
cmp rax, 2
jne 0x1400a591d
mov qword [rsi + 8], rbx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
test rax, rax
jne 0x1400a5870
mov eax, 1
jmp 0x1400a587a
lea rdx, [rsp + 0x40]
and qword [rdx], 0
mov rcx, rdi
call fcn.140089e03
ud2