joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8b1890
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8d25e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8b1a18
mov rax, qword [0x6d8d25e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8b18dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8b1965
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8b18c0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8b1a4d
mov rax, qword [0x6d8d25e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8d25e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8b1a30
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8b195e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8b19c0
add dword [0x6d8d25e4], 1
cmp edi, 8
jae 0x6d8b1993
test dil, 4
jne 0x6d8b1a04
test edi, edi
je 0x6d8b1988
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8b1a1f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8b1988
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8b19ac
jmp 0x6d8b1988
add rsi, qword [0x6d8d25e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8b195e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8b1988
xor esi, esi
jmp 0x6d8b18e7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8b1988
mov rax, qword [0x6d8d25e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8b21a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8d28c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8d28a0]
test rbx, rbx
je 0x6d8b21f4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8b21eb
test rsi, rsi
je 0x6d8b21eb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8b21d0
lea rcx, [0x6d8d28c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8b2430
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8b2440
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8b2450
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8b2491
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8b2488
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8b2493
add rax, 0x28
cmp rax, r9
jne 0x6d8b2474
xor eax, eax
ret

Function at 0x6d8b2530
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8cf1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8b259d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b259d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b259d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b2594
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b259f
add rax, 0x28
cmp rax, r9
jne 0x6d8b2580
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8b26a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8cf1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8b26c0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b26b8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b271d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b2714
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b2724
add rax, 0x28
cmp rax, r9
jne 0x6d8b2700
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8b2740
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8cf1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8b27ae
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b27ae
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8b27ae
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8b27ae
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8b27a5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8b27b5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8b2790
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8b27c8
jmp 0x6d8b27ae
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8b27d6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8b27ae
test r9d, r9d
jg 0x6d8b27c0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8b2b40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400010b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x1400409a0], ecx
lea r8, [0x1400409a0]
mov edx, 1
lea eax, [rdx - 1]
movsxd rcx, eax
mov eax, dword [r8 + rcx*4]
shr eax, 0x1e
xor eax, dword [r8 + rcx*4]
imul ecx, eax, 0x6c078965
movsxd rax, edx
add ecx, edx
inc edx
mov dword [r8 + rax*4], ecx
cmp edx, 0x270
jl 0x1400010c6
mov dword [0x14003a210], edx
ret
Function at 0x140002e10
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400397a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor ebx, ebx
mov qword [0x1400415c0], rax
test rax, rax
jne 0x140002e63
or eax, 0xffffffff
jmp 0x140002fc2
mov r8d, 0x2c
lea rdx, str.HoudiniLicenseServer
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [0x1400415b8], rax
test rax, rax
jne 0x140002e8d
or ebx, 0xffffffff
jmp 0x140002fb3
lea rcx, [rbp - 0x40]
mov r9d, 0x24
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x38]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140002fa6
cmp dword [rbp - 0x34], 1
je 0x140002fa6
cmp dword [rbp - 0x34], 3
jne 0x140002f3b
mov r12d, 0x2710
mov eax, 0xcccccccd
mul dword [rbp - 0x20]
shr edx, 3
cmp edx, 0x3e8
jae 0x140002ee3
mov edx, 0x3e8
jmp 0x140002eea
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400415b8]
lea rax, [rbp - 0x40]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140002fa6
cmp dword [rbp - 0x34], 1
je 0x140002fa6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
ja 0x140002fa6
cmp dword [rbp - 0x34], 3
je 0x140002ec9
call fcn.140002fe4
mov rcx, qword [0x1400415b8]
lea r8, [rbp - 0x38]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140002fa6
jmp 0x140002fa0
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400415b8]
lea rax, [rbp - 0x40]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140002fa6
cmp dword [rbp - 0x34], 1
je 0x140002fa6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
ja 0x140002fa6
cmp dword [rbp - 0x34], 1
jne 0x140002f5c
mov rcx, qword [0x1400415b8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1400415c0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012470
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140003950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14003a450]
mov rbx, rdx
mov r9, rcx
cmp dword [rax + 0x2f0], 0
jne 0x140003ac6
mov eax, dword [rcx]
test eax, 0x7fff0000
jne 0x140003988
mov ecx, 1
add rsp, 0x20
pop rbx
jmp fcn.140003740
mov qword [rsp + 0x30], rbp
btr eax, 0x1f
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], r14
xor r14d, r14d
movzx ebp, ax
shr eax, 0x10
mov esi, eax
test eax, eax
je 0x1400039dc
mov r8d, r14d
lea r10, [rbp*8]
nop word [rax + rax]
mov rax, qword [r9 + 8]
lea rdx, [r10 + r8*8]
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + rax]
mov qword [rcx + r8*8], rax
inc r8
cmp r8, rsi
jl 0x1400039c0
cmp r9, rbx
jne 0x140003a66
mov qword [rsp + 0x40], rdi
mov edi, r14d
test ebp, ebp
je 0x140003a3f
cmp ebp, 2
jb 0x140003a3f
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
lea eax, [rbp - 1]
add eax, esi
movsxd rcx, eax
lea r9, [rdx + rsi*8]
lea rax, [rdx + rcx*8]
cmp r9, r8
ja 0x140003a18
cmp rax, r8
jae 0x140003a3f
mov eax, ebp
and eax, 0xfffffffe
nop dword [rax]
add edi, 2
cmp edi, eax
jl 0x140003a20
mov r8d, eax
xor edx, edx
shr r8, 1
mov rcx, r9
shl r8, 4
and r8, 0xfffffffffffffff8
call fcn.140013440
movsxd rdx, edi
mov rdi, qword [rsp + 0x40]
cmp rdx, rbp
jge 0x140003ab5
nop dword [rax]
mov rax, qword [rbx + 8]
lea rcx, [rsi + rdx]
inc rdx
mov qword [rax + rcx*8], r14
cmp rdx, rbp
jl 0x140003a50
jmp 0x140003ab5
mov eax, dword [rbx]
mov r8d, esi
btr eax, 0x1f
mov ecx, eax
movzx eax, ax
shr ecx, 0x10
add ecx, eax
cmp esi, ecx
jae 0x140003ab5
lea rdx, [rsi*8]
nop word [rax + rax]
mov rax, qword [rbx + 8]
lea rdx, [rdx + 8]
inc r8d
mov qword [rdx + rax - 8], r14
mov eax, dword [rbx]
btr eax, 0x1f
mov ecx, eax
movzx eax, ax
shr ecx, 0x10
add ecx, eax
cmp r8d, ecx
jl 0x140003a90
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x30]
mov dword [rbx], esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14000f860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x48
mov rax, qword [0x14003a450]
mov rbp, r8
mov r13, rdx
mov rsi, rcx
mov r14, qword [rax + 0x248]
test rcx, rcx
je 0x14000fa21
test rdx, rdx
je 0x14000fa21
movsxd rdi, dword [rcx]
test edi, edi
je 0x14000fa21
movsxd rbx, dword [rdx]
test ebx, ebx
je 0x14000fa21
mov rcx, r14
call fcn.140006b50
cmp edi, 2
jl 0x14000f948
cmp ebx, 2
jl 0x14000f948
mov rax, qword [0x14003a450]
cmp edi, ebx
mov r9, qword [r13 + 8]
mov r8, qword [rsi + 8]
cmovg ebx, edi
mov ecx, ebx
mov rdx, qword [rax + 0x280]
mov rax, qword [r14 + 8]
mov qword [rsp + 0x20], rax
mov rdx, qword [rdx + 8]
call fcn.14000e1b0
lea r8d, [rbx*2 + 1]
mov rcx, r14
mov dword [r14], r8d
mov rax, qword [0x14003a450]
mov rdx, qword [rax + 0x280]
mov dword [rdx], r8d
call fcn.140005de0
mov rcx, qword [0x14003a450]
mov rcx, qword [rcx + 0x280]
call fcn.140005de0
mov rdx, rbp
mov rcx, r14
add rsp, 0x48
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140003850
mov qword [rsp + 0x88], r12
lea eax, [rbx + rdi]
mov dword [r14], eax
mov rax, rdi
mov qword [rsp + 0x38], rax
mov r12, rbx
mov qword [rsp + 0x30], rbx
test edi, edi
jle 0x14000f9fa
xor edi, edi
mov qword [rsp + 0x40], r15
mov esi, edi
test r12, r12
jle 0x14000f9e1
lea r15, [rdi*8]
mov rbp, r12
mov r12, qword [rsp + 0x80]
mov rbx, r15
mov rdx, qword [r13 + 8]
lea rax, [rsi + rbx]
mov rcx, qword [r12 + 8]
lea r8, [rsp + 0x98]
mov rdx, qword [rax + rdx]
mov rcx, qword [r15 + rcx]
call fcn.14000efc0
mov rdx, qword [r14 + 8]
lea rbx, [rbx + 8]
mov rcx, qword [rsp + 0x98]
xor qword [rdx + rbx - 8], rcx
mov rcx, qword [r14 + 8]
xor qword [rcx + rbx], rax
sub rbp, 1
jne 0x14000f992
mov r12, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
inc rdi
sub rsi, 8
cmp rdi, rax
jl 0x14000f977
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, r14
call fcn.140005de0
mov rdx, rbp
mov rcx, r14
mov r12, qword [rsp + 0x88]
add rsp, 0x48
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140003850
mov rcx, rbp
add rsp, 0x48
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140006b50
Function at 0x14001c77c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14001c60f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c60f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c60f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c60f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c60f
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c60f
cmp dword [rcx + 0xf8], 0
je 0x14001c60f
mov ecx, ebx
call fcn.14001c6b0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14001c4a0
cmp dword [rbp + 0x20], 0
je 0x14001c65c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001c664
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001c5a8
Function at 0x140003a20
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003ab0
jmp 0x140003a9f
jae 0x140003b70
cmp r8, 0x201
jae 0x140003ab0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003b08
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140003adf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400196f0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003b31
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003bd8
mov r8d, r14d
cmp r15, r8
jne 0x140003a90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003bfb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003a9f
jmp 0x140003ab0
cmp rsi, r8
jb 0x140003c15
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400054e0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140003bc1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001150
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140003ba9
jmp 0x140003bc1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001a180
jmp 0x140003c2a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001a570
ud2
Function at 0x14000a400
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001c9e0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000a444
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000a4aa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000a4e1
test eax, eax
js 0x14000a4bb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000a4d4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140001500
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140005280
mov rcx, rax
call fcn.140001970
mov ecx, 7
int 0x29
ud2
Function at 0x140017620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001769a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140017690
cmp r11, r10
ja 0x140017733
cmp r10, rdx
ja 0x140017747
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017692
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140017670
jmp 0x140017707
ja 0x14001769a
mov r11, r10
cmp rax, r8
jne 0x140017642
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001770b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400176e0
mov r8, r10
sub ecx, r9d
jns 0x1400176fe
jmp 0x14001770d
cmp r10, rdx
je 0x140017719
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001770d
xor al, 1
cmp r8, rdx
jne 0x1400176c0
jmp 0x14001770d
xor eax, eax
jmp 0x14001770d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001a180
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a5e0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a570
ud2

Function at 0x14001915c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400191a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400191a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400191a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400191a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400191a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400191a8
xor al, al
add rsp, 0x28
ret
Function at 0x140004e10
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [0x1401255c8]
movzx r12d, r9b
movzx edi, r8b
movzx esi, dl
mov ebp, ecx
test r8b, r8b
je 0x140004e57
inc dword [0x14012ac50]
add rbx, 0x150
mov qword [0x1401255c8], rbx
lea rdx, [0x140129540]
mov rcx, rbx
mov r8d, 0x150
call fcn.1400d78b0
mov dword [rbx + 0x3c], ebp
test dil, dil
je 0x140004e82
lea rcx, [0x14012c5c0]
xor edx, edx
call fcn.1400296f0
xor edi, edi
cmp dword [0x14012ac98], edi
mov qword [0x14012d190], rdi
je 0x140004eb6
mov rax, qword [0x140127148]
lea rcx, [0x1400f1524]
test rax, rax
je 0x140004eb0
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test sil, sil
jne 0x140004f42
cmp byte [rbx + 0x12e], dil
jne 0x140004eea
cmp r12b, 0x65
sete dil
mov byte [rbx + 0x12e], dil
test dil, dil
je 0x140004eea
mov qword [rbx], 0xffffffffffffffff
mov dword [rbx + 0x34], 0xffffffff
cmp dword [0x14012d19c], 0
je 0x140004efc
cmp dword [0x14012d198], 0
jne 0x140004f05
cmp byte [rbx + 0x12e], 0
je 0x140004f42
cmp byte [rbx + 0x12e], 0
mov byte [rbx + 0x12c], 0
jne 0x140004f42
cmp dword [0x14012d19c], 0
jge 0x140004f2a
mov dword [rbx + 0x120], 0xffffffff
jmp 0x140004f42
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x11c], eax
mov eax, dword [0x14012d19c]
mov dword [rbx + 0x120], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140006d40
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp qword [0x14012d240], 0
mov rbx, rdx
mov rsi, rcx
je 0x140006d67
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
test rcx, rcx
je 0x140006dd7
mov eax, 0xffffffff
cmp rdx, rax
jne 0x140006d90
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
mov ebx, ebx
test rbx, rbx
je 0x140006dd7
lea rdx, [rbx + 1]
lea rcx, [0x14012d228]
call fcn.140006e00
test rax, rax
jne 0x140006dba
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rdi, qword [0x14012d240]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400da434
xor r11d, r11d
mov word [rdi + rbx*2], r11w
lea rcx, [0x14012d228]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.140006ec0