joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140035991
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140035950
mov ecx, dword [r10]
jmp 0x140035a7a
cmp ecx, 0x4e0
jb 0x140035a7a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400359b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140035a00
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14004a7f9
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
cwd
sub rsp, 0x20
and rbx, rax
stc
mov rdx, qword [0x140040b50]
mov rbx, r8
cmp cl, 0xd6
cmp rdx, qword [0x140040b58]
jmp 0x14004a81e
je 0x14004a9c0
mov rdx, qword [rdx]
movsx cx, bh
mov rcx, rdx
stc
and ah, 0xc7
sal eax, 0x30
movzx eax, byte [rcx]
cmp al, 0xc3
jmp 0x14004a83f
je 0x14004a877
cmp al, 0xcc
je 0x14004a90c
inc rcx
add ah, al
adc al, dh
mov rax, rcx
cmp r9b, r9b
stc
sub rax, rdx
jmp 0x14004a869
cmp rax, rdx
jmp 0x14004a871
jbe 0x14004a835
mov rcx, qword [r8]
cmc
test rcx, rcx
jmp 0x14004a883
je 0x14004a8fb
mov rdx, qword [r8 + 0x10]
cmc
sub rdx, rcx
test cl, dil
test r11d, 0x12db5945
jmp 0x14004a8a0
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14004a8e4
mov r8, qword [rcx - 8]
shr ah, 0xab
bt rax, 0x5d
sar al, cl
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
test bpl, cl
cmp rax, 0x1f
jmp 0x14004a8d6
ja 0x14004aa6a
mov rcx, r8
jmp 0x14004a8e4
call fcn.140035ce4
sub eax, eax
test dil, 0x7a
mov qword [rbx], rax
clc
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
sub al, al
add rsp, 0x20
movsx rbx, dx
pop rbx
jmp 0x14004a90b
ret
mov rcx, qword [r8]
test rcx, rcx
jmp 0x14004a917
je 0x14004a9a8
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
cmp r9w, 0x360d
clc
and rdx, 0xfffffffffffffff8
cmp esi, 0x201033cc
cmp rdx, 0x1000
jmp 0x14004a941
jb 0x14004a981
mov r8, qword [rcx - 8]
add ah, cl
add rdx, 0x27
shld ax, r10w, 0x94
rcl ah, 0xa2
movsxd rax, r11d
sub rcx, r8
sar ah, 0x7e
sar al, cl
lea rax, [rcx - 8]
clc
stc
cmp r8w, r14w
cmp rax, 0x1f
ja 0x14004aa6a
mov rcx, r8
jmp 0x14004a981
call fcn.140035ce4
sub eax, eax
test r10w, 0x2e73
mov qword [rbx], rax
test sil, dil
cmp sil, r9b
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
btr ebx, 0x57
jmp 0x14004a9a8
mov al, 1
add rsp, 0x20
mov rbx, 0x66be6a14
movsx ebx, r15w
jmp 0x14004a9be
pop rbx
ret
mov rcx, qword [r8]
clc
cmc
test rcx, rcx
jmp 0x14004a9cd
je 0x14004aa57
mov rdx, qword [r8 + 0x10]
cmc
cmp r10w, r12w
sub rdx, rcx
jmp 0x14004a9e4
and rdx, 0xfffffffffffffff8
cmc
clc
jmp 0x14004a9ef
cmp rdx, 0x1000
jmp 0x14004a9fb
jb 0x14004aa31
mov r8, qword [rcx - 8]
sal ah, 0x82
shr al, cl
add rdx, 0x27
inc al
sub rcx, r8
shl al, 0x8c
lea rax, [rcx - 8]
cmp rax, 0x1f
jmp 0x14004aa23
ja 0x14004aa6a
mov rcx, r8
jmp 0x14004aa31
call fcn.140035ce4
sub eax, eax
cmc
mov qword [rbx], rax
cmp r10d, 0x25d8791b
mov qword [rbx + 8], rax
jmp 0x14004aa4c
mov qword [rbx + 0x10], rax
inc bx
movsx rbx, r12w
add rsp, 0x20
movzx bx, dil
mov rbx, r13
pop rbx
jmp 0x14004aa69
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004b50b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
setnp al
mov eax, 0x13d0
jmp 0x14004b535
call fcn.140036bc0
sub rsp, rax
mov rax, qword [0x140040010]
cmc
sal di, 0x2b
bt rbx, r15
xor rax, rsp
bswap di
shr dil, cl
not dil
mov qword [rsp + 0x13c0], rax
jmp 0x14004b566
mov rdi, rdx
sub ebx, 0x32a1557b
shl rbx, cl
sar bl, cl
mov rbx, rcx
mov qword [rsp + 0x28], rcx
cmp di, 0x750a
test r9d, r9d
sub esi, esi
jmp 0x14004b58b
mov dword [rsp + 0x20], esi
jmp 0x14004b594
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
sal ch, 0xc4
mov dword [rsp + 0x13b4], 0xffffffff
btc rcx, 0x1c
bt rcx, r11
xchg cl, ch
mov dword [rsp + 0x34], eax
bts rax, r15
lea ecx, [rsi + 1]
test r8, 0x1dfa3e55
nop word [rax + rax]
mov eax, r8d
clc
test r12b, dl
shr eax, 0x1e
clc
stc
xor eax, r8d
imul r8d, eax, 0x6c078965
test r14b, 0x46
stc
add r8d, ecx
jmp 0x14004b5f5
mov dword [rsp + rcx*4 + 0x34], r8d
jmp 0x14004b5ff
inc rcx
test r13b, al
cmp bpl, r12b
cmp rcx, 0x270
jmp 0x14004b614
jb 0x14004b5d2
mov dword [rsp + 0x30], 0x270
stc
mov qword [rbx], rsi
stc
clc
cmp r11w, 0x4ae5
mov qword [rbx + 0x10], rsi
test r11b, 0xad
mov qword [rbx + 0x18], 0xf
cmc
mov byte [rbx], 0
cmc
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
jbe 0x14004b678
mov rdx, rdi
jmp 0x14004b65d
mov rcx, rbx
jmp 0x14004b665
call fcn.140034820
mov qword [rbx + 0x10], rsi
jmp 0x14004b673
jmp 0x14004b686
test rdi, rdi
jmp 0x14004b680
je 0x14004b77e
lea rcx, [rsp + 0x30]
jmp 0x14004b690
call fcn.140035930
mov ecx, eax
cqo
mov eax, 0x8d3dcb09
and dl, 0xe7
mul ecx
shr edx, 5
test r11b, al
jmp 0x14004b6ae
cmp edx, 0x469ee58
jae 0x14004b686
mov eax, 0x8d3dcb09
inc dx
mul ecx
or rax, r15
shr edx, 5
and r8w, 0x2471
imul eax, edx, 0x3a
or dl, 0x22
sub ecx, eax
cmp r14d, r13d
movzx r8d, bp
adc r8b, bpl
lea edx, [rcx - 0x7fffffbf]
rcr r8b, 0x72
mov rcx, qword [rbx + 0x10]
or r8b, 0x8e
sar r8w, cl
mov r8, qword [rbx + 0x18]
test esp, edx
cmp rcx, r8
jmp 0x14004b706
jae 0x14004b754
lea rax, [rcx + 1]
stc
mov qword [rbx + 0x10], rax
shl al, 0x48
rol ax, cl
and rax, r9
mov rax, rbx
jmp 0x14004b726
cmp r8, 0x10
jmp 0x14004b72f
jb 0x14004b73d
mov rax, qword [rbx]
jmp 0x14004b73d
mov byte [rax + rcx], dl
jmp 0x14004b745
mov byte [rax + rcx + 1], 0
jmp 0x14004b74f
jmp 0x14004b76f
movzx r9d, dl
mov ch, 0xcf
movsx rcx, dx
not rcx
mov rcx, rbx
jmp 0x14004b76a
call fcn.140034970
sub rdi, 1
jmp 0x14004b778
jne 0x14004b686
mov rax, rbx
movzx cx, dil
bt cx, 0x1c
mov rcx, qword [rsp + 0x13c0]
test r8w, 0x10b
cmp edi, 0x38bc1e67
stc
xor rcx, rsp
call fcn.140082865
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x20]
jmp 0x14004b7b9
mov rsi, qword [r11 + 0x28]
movsx di, al
mov rdi, rcx
mov rsp, r11
xchg di, di
movsx di, r13b
pop rdi
ret
Function at 0x14008d540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14008d56d
xor al, al
jmp 0x14008d6cf
mov rax, qword [0x1400ad6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400ad6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400ad6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400ad6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400ad6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400ad6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400ad6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400ad6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400ad700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14008d6c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14008d619
mov r11d, 2
jmp 0x14008d63d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14008d633
mov r11d, 1
jmp 0x14008d63d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14008d6e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14008d682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14008d69a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14008d6aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14008d6b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14008d600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14008d6ca

Function at 0x1400d4aec
Capabilities:
Encode data using xor

Disassembly:
push 0x587ac230
call fcn.140fa457c
fldenv [rbp + 0x47e27261]
jno 0x1400d4b76
scasd eax, dword [rdi]
xor byte [rdi], dl
leave
invalid
sbb ch, ch
invalid
Function at 0x140f5b01b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rsi, rax
jmp 0x140f3015b
sub rsp, 0x180
inc cx
movsx ecx, bx
and rsp, 0xfffffffffffffff0
sal cl, cl
mov rbx, r10
sbb rax, rcx
sal rsi, cl
add cl, r13b
movabs rcx, 0
btr rsi, 0xad
sal al, cl
sbb al, 0x3e
sub rbx, rcx
and al, sil
sub al, r15b
or si, r13w
lea rsi, [0x140f2150d]
movzx rax, dx
mov eax, dword [r10]
add r10, 4
xor eax, ebx
stc
rol eax, 3
add eax, 0x5da05cd5
test r11b, 0x86
cmc
test r13d, r12d
xor eax, 0x31bd1996
sub eax, 0x23aa400c
jmp 0x140fa613b
push rsi
ret
push rbx
pushfq
push r12
bts ebx, eax
movsxd rbx, r8d
rol bx, 0xfc
push rdi
clc
movsx rbx, r12w
btc bx, 0x3c
push r8
bts bx, r12w
ror bl, cl
jmp 0x141015db3
ror eax, 2
test r12d, 0x6486320e
push rbx
rcr rbx, 0x14
ror bh, cl
xor dword [rsp], eax
cmp r13w, 0x24ee
sub rbx, rsp
pop rbx
cmp r8b, bpl
clc
movsxd rax, eax
jmp 0x140f19fe8
push rax
movsx rbx, di
push r9
bt ax, dx
push rsi
rol eax, 0x79
bts ax, r15w
ror si, 0x7d
push r11
push r15
push rdx
rcl r11w, 0xf1
push rcx
mov bl, ch
btc eax, 0xae
push rbp
movzx rbx, di
mov esi, r15d
rcl r11w, 0xf3
push r14
cwd
cbw
rdtsc
push r10
push r13
movzx rbx, bx
movabs rbp, 0
btc eax, esp
rol ebx, 0x40
rdtsc
push rbp
cbw
mov r10, qword [rsp + 0x90]
rol r10d, 1
not esi
lahf
bswap r10d
add r10d, 0x477629e1
adc bl, 0xef
neg r10d
sar ecx, cl
xchg r11b, al
movzx rdx, r15w
sub r10d, 0x47dd4604
rol r10d, 3
movzx ecx, r10w
bsr eax, edi
test bx, dx
lea r10, [r10 + rbp]
bt dx, 0x9f
cmp bl, r14b
movabs rdx, 0x100000000
lea r10, [r10 + rdx]
bts cx, cx
bswap r11
mov r11, rsp
jmp 0x140f214cb
Function at 0x140003da0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003e30
jmp 0x140003e1f
jae 0x140003ef0
cmp r8, 0x201
jae 0x140003e30
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003e88
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140003e5f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001c270
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003eb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003f58
mov r8d, r14d
cmp r15, r8
jne 0x140003e10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003f7b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003e1f
jmp 0x140003e30
cmp rsi, r8
jb 0x140003f95
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140006bb0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140003f41
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400010d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140003f29
jmp 0x140003f41
lea rcx, str.internal_error:_entered_unreachable_code_rustc_5680fa18feaa87f3ff04063800aec256c3d4b4belibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001ce00
jmp 0x140003faa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001d250
ud2
Function at 0x1400075b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400075e0
test ecx, ecx
jne 0x140007630
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1400075ec
test ecx, ecx
jne 0x140007630
mov rcx, rdi
call fcn.140007490
movzx eax, al
test bpl, bpl
jne 0x140007637
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140007623.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1400077a8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140007623.2
xor eax, eax
test bpl, bpl
je 0x1400075fc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140007789
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14000766a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1400076e9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x1400076b0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1400076cb
inc rax
dec rdi
cmp rax, 1
jne 0x140007690
jmp 0x1400076e9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1400076cb
cmp ebx, 0x5c
je 0x1400076cb
inc rax
dec rdi
cmp rax, 1
jne 0x1400076b0
jmp 0x1400076e9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140007797
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140007713
mov al, 9
cmp rdx, 2
je 0x140007717
cmp rdx, 1
jne 0x140007727
cmp byte [r8], 0x2e
jne 0x140007727
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140007727
mov al, 0xa
jmp 0x140007727
cmp byte [r8], 0x2e
jne 0x140007727
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140007623.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140007623.2
mov ecx, 2
jmp case.0x140007623.2
lea r8, str.library_std_srcpath.rs
call fcn.14001d1d0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001d1d0
ud2
Function at 0x14000bbb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001fe60]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000bbf4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000bc5a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000bc91
test eax, eax
js 0x14000bc6b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000bc84
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006890
mov rcx, rax
call fcn.140001ab0
mov ecx, 7
int 0x29
ud2

Function at 0x14001a0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001a14a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001a140
cmp r10, r11
jb 0x14001a1e3
cmp r10, rdx
ja 0x14001a1f7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001a142
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001a120
jmp 0x14001a1b7
ja 0x14001a14a
mov r11, r10
cmp rax, r8
jne 0x14001a0f2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a1bb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001a190
mov r8, r10
sub ecx, r9d
jns 0x14001a1ae
jmp 0x14001a1bd
cmp r10, rdx
je 0x14001a1c9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001a1bd
xor al, 1
cmp r8, rdx
jne 0x14001a170
jmp 0x14001a1bd
xor eax, eax
jmp 0x14001a1bd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001ce00
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001d2d0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001d250
ud2
Function at 0x14001bc14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001bc5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001bc5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001bc5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001bc5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001bc5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001bc60
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140005800
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x140092dd0]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x14000581c
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14000582a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140005835
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140005840
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14000584b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140005856
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140005861
bts eax, 1
test cl, 2
je 0x14000586a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x140005901
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x14000590d
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x1400058f5
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x140005810
mov dword [0x140092dc0], 1
ret