joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140afcec8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140afd04f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140afcef9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afcedf
add dl, dl
jne 0x140afcf06
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afcf66
xor eax, eax
add dl, dl
jne 0x140afcf15
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afd01d
add dl, dl
jne 0x140afcf26
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf33
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf40
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf4d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140afcf5a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140afceee
mov eax, 1
add dl, dl
jne 0x140afcf76
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf83
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcf6b
sub eax, ebx
mov ebx, 1
jne 0x140afcfbc
mov ecx, 1
add dl, dl
jne 0x140afcf9e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afcfab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcf93
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140afcfd8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afcfe5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcfcd
cmp eax, 0x7d00
jae 0x140afd00b
cmp eax, 0x500
jb 0x140afd006
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
cmp eax, 0x7f
ja 0x140afd00e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140afd042
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140afceee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140053630
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x14006f380
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14006f8f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14006f3bf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400a7010]
jmp 0x14006f3c9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14000a260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000a2f0
cmp r10, r11
jb 0x14000a366
cmp r10, rdx
ja 0x14000a37a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000a2f2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000a2d0
jmp 0x14000a354
ja 0x14000a2fa
mov r11, r10
cmp rax, r8
jne 0x14000a294
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000a330
mov rdi, r8
sub ecx, edx
jns 0x14000a34b
jmp 0x14000a356
cmp r8, rsi
je 0x14000a38b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000a356
xor al, 1
cmp rdi, rsi
jne 0x14000a310
jmp 0x14000a356
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14005d0b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14005ce40
ud2
lea rcx, [0x14006cf2f]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14005cec0
ud2
Function at 0x14001a56e
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsi + 0x20]
add rsp, 0x50
pop rsi
ret
Function at 0x14001f050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14001f0ab
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001f0ab
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14001f0c6
cmp eax, 0x42
jne 0x14001f0ab
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14001f176
cmp byte [r9 + r11], 0x5f
jne 0x14001f176
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001f1de
mov rcx, rsi
xor edx, edx
call fcn.14001a8e0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14001a8e0
test al, al
jne 0x14001f271
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001f102
lea rdx, [0x1400674b2]
mov r8d, 1
call fcn.140007fa0
test al, al
jne 0x14001f271
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001f0ba
xor r14d, r14d
lea rbx, str.__JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14001f134
cmp byte [rax + rcx], 0x45
je 0x14001f293
sub r14, 1
jb 0x14001f159
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001f159
mov r8d, 2
mov rdx, rbx
call fcn.140007fa0
test al, al
jne 0x14001f271
mov rcx, rsi
call fcn.14001f2b0
test al, al
jne 0x14001f271
mov rax, qword [rsi]
test rax, rax
jne 0x14001f120
jmp 0x14001f0ba
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14001f238
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14001f1d2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001f1bc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001f1ab
add dl, 0xa9
jmp 0x14001f1ba
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14001f238
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14001f238
movzx edx, bl
add rax, rdx
jae 0x14001f180
jmp 0x14001f238
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14001f238
cmp rax, rcx
jae 0x14001f235
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001f28b
cmp qword [rsi + 0x20], 0
je 0x14001f29f
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14001f050
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001f0bc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001f279
lea rax, [0x140067849]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.140007fa0
test al, al
je 0x14001f279
mov dil, 2
jmp 0x14001f0ba
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14001f0ba
mov dil, 1
xor r8d, r8d
jmp 0x14001f23a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001f0ba
xor edi, edi
jmp 0x14001f0ba
Function at 0x14002d270
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], 0x103
mov qword [rsp + 0x58], 0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14002d2e9
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x50]
cmp eax, 0x103
je 0x14002d320
test eax, eax
js 0x14002d2fa
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14002d313
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x98
pop rdi
pop rsi
ret
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, [0x14006b290]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
lea rax, [0x14006cc28]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x68]
call fcn.14002bf40
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.14002bfe0
mov ecx, 7
int 0x29
ud2
Function at 0x14002ed80
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x14002ee10
jmp 0x14002edff
jae 0x14002eecd
cmp r8, 0x201
jae 0x14002ee10
lea r15, [rbp - 0x58]
mov r12d, 0x200
mov r13, r8
jmp 0x14002ee68
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x14002ee3f
lea rcx, [rbp + 0x3c8]
mov rdx, r14
call fcn.14005dcd0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x3d8], r14
mov rbx, rdi
mov r15, qword [rbp + 0x3e8]
mov r12, r14
mov r13, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r13d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x14002ee8f
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14002ef2c
mov r8d, esi
cmp r13, r8
jne 0x14002edf0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14002ef4e
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14002edff
jmp 0x14002ee10
cmp r12, r8
jb 0x14002ef68
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14002f8c0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3e0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x14002ef17
mov edx, 2
mov rcx, qword [rbp + 0x3e8]
call fcn.140006340
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e0]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x14002ef06
jmp 0x14002ef17
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005cec0
jmp 0x14002ef7d
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.14005ce40
ud2
Function at 0x140030d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140030d30
test ecx, ecx
jne 0x140030d80
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140030d3c
test ecx, ecx
jne 0x140030d80
mov rcx, rdi
call fcn.140030be0
movzx eax, al
test bpl, bpl
jne 0x140030d87
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140030d73.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140030ef8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140030d73.2
xor eax, eax
test bpl, bpl
je 0x140030d4c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140030ed9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140030dba
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140030e39
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140030e00
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140030e1b
inc rax
dec rdi
cmp rax, 1
jne 0x140030de0
jmp 0x140030e39
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140030e1b
cmp ebx, 0x5c
je 0x140030e1b
inc rax
dec rdi
cmp rax, 1
jne 0x140030e00
jmp 0x140030e39
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140030ee7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140030e63
mov al, 9
cmp rdx, 2
je 0x140030e67
cmp rdx, 1
jne 0x140030e77
cmp byte [r8], 0x2e
jne 0x140030e77
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140030e77
mov al, 0xa
jmp 0x140030e77
cmp byte [r8], 0x2e
jne 0x140030e77
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140030d73.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140030d73.2
mov ecx, 2
jmp case.0x140030d73.2
lea r8, str.library_std_srcpath.rs
call fcn.14005cdc0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14005cdc0
ud2
Function at 0x1400313f0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14002dd80
mov r14, qword [rbp - 0x60]
test r14, r14
je 0x140031591
mov qword [rbp + 0x3d8], rsi
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x3c8], xmm0
mov qword [rbp + 0x3c0], r14
mov qword [rbp + 0x408], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x428], rax
xor eax, eax
mov qword [rbp + 0x420], rax
xor ebx, ebx
xor edi, edi
cmp r8, 0x201
jae 0x1400314c0
jmp 0x1400314a2
mov r14, rsi
jae 0x1400315a3
cmp r8, 0x201
jae 0x1400314c0
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x140031522
sub r8, rdi
sub rbx, rdi
cmp rbx, r8
jae 0x1400314f6
lea rcx, [rbp + 0x408]
mov rdx, rdi
call fcn.14005dcd0
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x420], rax
mov rbx, qword [rbp + 0x420]
mov eax, 0xffffffff
cmp rbx, rax
mov edi, 0xffffffff
cmovb rdi, rbx
mov qword [rbp + 0x418], rdi
mov r13, qword [rbp + 0x428]
mov r15, rdi
mov r12, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, r14
mov rcx, r14
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140031550
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400315d9
mov r8d, r14d
cmp r12, r8
jne 0x140031490
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14003167f
mov r14, rsi
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400314a2
jmp 0x1400314c0
lea rcx, [rbp - 0x58]
call fcn.14002b4a0
mov byte [rsi + 0x18], 2
jmp 0x140031649
cmp r15, r8
jb 0x140031699
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.14002f8c0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmmword [rbp + 0x3e0], xmm0
jmp 0x1400315f7
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3e0], rax
mov byte [rbp + 0x3f8], 2
mov r14, rsi
cmp qword [rbp + 0x420], 0
mov rsi, qword [rbp + 0x3d8]
je 0x140031619
mov edx, 2
mov rcx, qword [rbp + 0x428]
call fcn.140006340
cmp byte [rbp + 0x3f8], 2
jne 0x14003165e
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3e0]
call fcn.14002b4a0
cmp qword [rbp + 0x3c8], 0
je 0x140031649
mov edx, 2
mov rcx, r14
call fcn.140006340
nop
add rsp, 0x4b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3e0]
movaps xmm1, xmmword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x3c8], 0
jne 0x14003163c
jmp 0x140031649
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14005cec0
jmp 0x1400316ae
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14005ce40
ud2
Function at 0x140034f30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], 0x103
mov qword [rsp + 0x58], 0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140034fa2
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x50]
cmp eax, 0xc0000011
jne 0x140034fb1
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140034fe9
cmp eax, 0x103
je 0x140034ff3
test eax, eax
js 0x140034fce
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140034fe9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x98
pop rdi
pop rsi
ret
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, [0x14006b290]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
lea rax, [0x14006cc28]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x68]
call fcn.14002bf40
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.14002bfe0
mov ecx, 7
int 0x29
ud2
Function at 0x140035b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x140035b5c
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x140035c4f
test r15w, r15w
je 0x140035b5c
cmp r15w, 0x2e
jne 0x140035c4f
test r12w, r12w
jne 0x140035c4f
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call fcn.140050020
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140035c35
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140035bb1
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x140035c35
cmp word [rsp + 0xac], 0x2e
jne 0x140035bda
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x140035ba0
cmp ax, 0x2e
jne 0x140035bda
cmp word [rsp + 0xb0], 0
je 0x140035ba0
lock inc qword [r14]
jle 0x140035d37
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x140035c7a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
jne 0x140035cc6
mov qword [rsi], 0
jmp 0x140035d25
lock inc qword [r14]
jle 0x140035d37
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.14004f970
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.14004f970
jmp 0x140035cd8
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call fcn.14004f970
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x140041aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14002dd80
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x140041b16
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.140041990
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x140041b24
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140041b44
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x140041b35
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
call fcn.14002b4a0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x140041b35
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140006340
Function at 0x140043760
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov ecx, 0x10
mov edx, 8
call fcn.1400062b0
test rax, rax
je 0x140043831
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140043c20]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140043823
mov rcx, qword [r14]
mov qword [rbp - 0x10], r14
mov rax, qword [r14 + 8]
call qword [rax]
mov rsi, qword [rbp - 0x10]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x140043802
mov rcx, qword [rsi]
mov rdx, qword [rax + 0x10]
call fcn.140006340
mov edx, 8
mov rcx, rsi
call fcn.140006340
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 8
mov edx, 0x10
call fcn.14005cbb0
ud2