joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9b5b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.004d1340
xorps xmm15, xmm15
mov r14, qword [0x006c19c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4f9a6a
nop dword [rax]
cmp rdx, 0x40
ja 0x4f9b4d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4f99d9
mov rax, rdx
mov rcx, rsi
nop
call fcn.00469d60
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4f9a41
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004f9f80
xorps xmm15, xmm15
mov r14, qword [0x006c19c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4f9b42
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4f9a77
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4f9af5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004f9f80
xorps xmm15, xmm15
mov r14, qword [0x006c19c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4f9b38
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4f9b34
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00469d60
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00469480
mov rax, rdx
mov ecx, 0x40
call fcn.00469480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004670e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f9920
Function at 0x140004de0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140004e80
jmp 0x140004e6f
jae 0x140004f40
cmp r8, 0x201
jae 0x140004e80
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140004ed8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x140004eaf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001a970
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004f01
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004fa8
mov r8d, r14d
cmp r15, r8
jne 0x140004e60
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004fd5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140004e6f
jmp 0x140004e80
cmp rsi, r8
jb 0x140004fef
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140006e00
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140004f91
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140002550
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140004f79
jmp 0x140004f91
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001b380
jmp 0x140005004
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001b7d0
ud2
Function at 0x14000b080
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001e100]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000b0c4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000b12a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000b161
test eax, eax
js 0x14000b13b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000b154
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006b40
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140002fd0
mov ecx, 7
int 0x29
ud2
Function at 0x140018da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140018e1a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140018e10
cmp r11, r10
ja 0x140018eb1
cmp r10, rdx
ja 0x140018ec3
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140018e12
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140018df0
jmp 0x140018e87
ja 0x140018e1a
mov r11, r10
cmp rax, r8
jne 0x140018dc2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140018e8b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140018e60
mov r8, r10
sub ecx, r9d
jns 0x140018e7e
jmp 0x140018e8d
cmp r10, rdx
je 0x140018e99
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140018e8d
xor al, 1
cmp r8, rdx
jne 0x140018e40
jmp 0x140018e8d
xor eax, eax
jmp 0x140018e8d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14001ff6b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001b380
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001b850
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001b7d0
int3

Function at 0x14001a3d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a422
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a422
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a422
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a422
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a422
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a424
xor al, al
add rsp, 0x28
ret
Function at 0x1800116d0
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r10b, 1
xor eax, eax
lock cmpxchg byte [rcx + 0x12], r10b
jne 0x180011753
cmp qword [rcx], 0
mov qword [rbp - 0x18], rcx
je 0x18001175b
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
mov dword [rbp - 0xc], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x180011731
mov edx, dword [rbp - 0xc]
xor eax, eax
jmp 0x180011745
call fcn.180026a20
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
mov rcx, qword [rbp - 0x18]
mov byte [rcx + 0x12], 0
add rsp, 0x40
pop rbp
ret
mov rcx, r9
call fcn.18003d250
lea rcx, str.attempt_to_perform_operation_on_pipe_stream_which_has_been_sent_off_to_limboattempt_to_bury_same_pipe_stream_twicenamed_pipebecause_it_would_have_caused_a_deadlockconcurrent_I_O_with_a__attempted__this_leads_to_deadlocks_due_to_the_synchronization_used_by_named_pipes_on_Windows_internally__and_was_prevented
lea r8, str.C:UsersNullSense.cargo_registry_srcindex.crates.io_6f17d22bba15001finterprocess_2.2.1_srcoswindows_named_pipe_streamimpl_send_off.rs
mov edx, 0x4c
call fcn.18003e420
ud2

Function at 0x1800117a0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r10b, 1
xor eax, eax
lock cmpxchg byte [rcx + 0x12], r10b
jne 0x18001183a
cmp qword [rcx], 0
mov qword [rbp - 0x18], rcx
je 0x180011842
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
mov dword [rbp - 0xc], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, eax
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x180011815
mov edx, dword [rbp - 0xc]
mov r9, qword [rbp - 0x18]
mov byte [r9 + 0x12], 0
xor ecx, ecx
mov r8b, 1
xor eax, eax
lock cmpxchg byte [r9 + 0x11], r8b
jmp 0x180011831
call fcn.180026a20
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov rax, qword [rbp - 0x18]
mov byte [rax + 0x12], 0
mov ecx, 1
mov rax, rcx
add rsp, 0x40
pop rbp
ret
mov rcx, r9
call fcn.18003d250
lea rcx, str.attempt_to_perform_operation_on_pipe_stream_which_has_been_sent_off_to_limboattempt_to_bury_same_pipe_stream_twicenamed_pipebecause_it_would_have_caused_a_deadlockconcurrent_I_O_with_a__attempted__this_leads_to_deadlocks_due_to_the_synchronization_used_by_named_pipes_on_Windows_internally__and_was_prevented
lea r8, str.C:UsersNullSense.cargo_registry_srcindex.crates.io_6f17d22bba15001finterprocess_2.2.1_srcoswindows_named_pipe_streamimpl_send_off.rs
mov edx, 0x4c
call fcn.18003e420
ud2
Function at 0x180012a80
Capabilities:
Connect pipe

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea r14, [rdx + 0x60]
mov cl, 1
xor eax, eax
lock cmpxchg byte [rdx + 0x60], cl
jne 0x180012ae0
mov rbx, qword [0x1800709f0]
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x180012aea
xor edx, edx
movzx eax, byte [rdi + 0x61]
test al, al
je 0x180012afc
mov rcx, r14
call fcn.1800151a0
mov qword [rsi + 8], rax
mov qword [rsi], 3
jmp 0x180012bf6
mov rcx, r14
call fcn.18003dae0
jmp 0x180012aac
call fcn.18003da10
mov edx, eax
xor dl, 1
movzx eax, byte [rdi + 0x61]
test al, al
jne 0x180012ac8
mov dword [rbp - 0xc], edx
mov qword [rbp - 0x18], r14
mov r14b, byte [rdi + 0x70]
mov rcx, qword [rdi + 0x68]
xor edx, edx
call qword [sym.imp.kernel32.dll_ConnectNamedPipe]
test eax, eax
je 0x180012b85
test r14b, r14b
setne r8b
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 2
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call fcn.18001b820
test rax, rax
jne 0x180012bcd
mov r14, qword [rdi + 0x68]
mov qword [rdi + 0x68], rdx
cmp byte [rbp - 0xc], 0
mov rcx, qword [rbp - 0x18]
jne 0x180012b62
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x180012c2a
xor eax, eax
xchg byte [rcx], al
cmp al, 2
je 0x180012c0b
mov qword [rsi], 1
mov qword [rsi + 8], r14
mov word [rsi + 0x10], 1
mov byte [rsi + 0x12], 0
jmp 0x180012bf6
call fcn.180026a20
mov edx, eax
shl rdx, 0x20
or rdx, 2
movabs rax, 0xffffffff00000000
and rax, rdx
movabs rcx, 0x21700000000
cmp rax, rcx
je 0x180012b17
movabs rcx, 0x21800000000
cmp rax, rcx
jne 0x180012bcd
movabs rdx, 0xd00000003
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
mov qword [rsi + 8], rdx
mov qword [rsi], 3
test al, al
jne 0x180012bee
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x180012c15
xor eax, eax
xchg byte [rcx], al
cmp al, 2
je 0x180012c04
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.18003dba0
jmp 0x180012bf6
call fcn.18003dba0
jmp 0x180012b6e
mov rbx, rcx
call fcn.18003da10
mov rcx, rbx
test al, al
jne 0x180012bee
mov byte [rdi + 0x61], 1
jmp 0x180012bee
mov rbx, rcx
call fcn.18003da10
mov rcx, rbx
test al, al
jne 0x180012b62
mov byte [rdi + 0x61], 1
jmp 0x180012b62
Function at 0x18001b820
Capabilities:
Create pipe

Disassembly:
push rsi
sub rsp, 0x60
mov r10d, dword [rsp + 0x98]
mov eax, dword [rcx + 0x48]
cmp r10d, 4
jne 0x18001b84c
test eax, eax
jne 0x18001b84c
lea rdx, str.cannot_create_pipe_server_that_has_byte_type_but_receives_messages__have_you_forgotten_to_set_the__mode__field_in__PipeListenerOptions__cannot_set_255_as_the_named_pipe_instance_limit_due_to_255_being_a_reserved_value
mov r8d, 0x8b
jmp 0x18001b8fc
movzx r11d, byte [rsp + 0x90]
movzx edx, dl
shl edx, 0x13
cmp byte [rcx + 0x59], 0
lea esi, [r11 + rdx + 1]
lea r11d, [r11 + rdx - 0x7fffffff]
cmove r11d, esi
lea edx, [r11 + 0x40000000]
test r9b, r9b
cmove edx, r11d
xor r9d, r9d
test r10d, r10d
setne r9b
add r9d, r9d
xor r11d, r11d
cmp r10d, 5
cmovne r11d, r9d
movzx r9d, r8b
or r9d, r11d
or r9d, eax
mov r8d, r9d
or r8d, 8
cmp byte [rcx + 0x5a], 0
cmovne r8d, r9d
mov rax, qword [rcx + 0x18]
lea r9, [rcx + 0x20]
test rax, rax
cmove r9, rax
movzx eax, byte [rcx + 0x5b]
mov qword [rsp + 0x48], 0x18
mov qword [rsp + 0x50], r9
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 0
movzx r9d, byte [rcx + 0x5c]
test r9d, r9d
je 0x18001b911
cmp r9d, 0xff
jne 0x18001b917
lea rdx, [0x1800484f3]
mov r8d, 0x51
mov cl, 0x14
call fcn.180014460
mov rdx, rax
mov eax, 1
add rsp, 0x60
pop rsi
ret
mov r9d, 0xff
mov rax, qword [rcx + 8]
mov r10d, dword [rcx + 0x50]
mov r11d, dword [rcx + 0x4c]
mov ecx, dword [rcx + 0x54]
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x18001b958
mov rdx, rax
xor eax, eax
add rsp, 0x60
pop rsi
ret
call fcn.180026a20
mov edx, eax
shl rdx, 0x20
or rdx, 2
jmp 0x18001b906
Function at 0x180020060
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x180020100
jmp 0x1800200ef
jae 0x1800201bf
cmp r8, 0x201
jae 0x180020100
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x180020157
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x18002012f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.18003d550
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x180020180
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x18002022b
mov r8d, r13d
cmp r12, r8
jne 0x1800200e0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18002025f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1800200ef
jmp 0x180020100
cmp r14, r8
jb 0x180020279
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.180022640
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x180020214
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.180008960
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1800201ff
jmp 0x180020214
lea rcx, str.internal_error:_entered_unreachable_code_rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.18003e500
jmp 0x18002028e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.18003e890
ud2
Function at 0x180026900
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x18004a530]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x180026938
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x180026996
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1800269c3
test eax, eax
js 0x1800269a2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1800269b9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.180022300
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.18001e640
mov ecx, 7
int 0x29
ud2

Function at 0x180027400
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x180070bf9]
mov ecx, 0x10
mov edx, 8
call fcn.180008950
test rax, rax
je 0x1800274df
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x180027590]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1800274d1
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1800274a8
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.180008960
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.180008960
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.18003e2b0
ud2
Function at 0x180038550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1800385da
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1800385d0
cmp r11, r10
ja 0x180038656
cmp r10, rdx
ja 0x180038668
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1800385d2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1800385b0
jmp 0x180038637
ja 0x1800385da
mov r11, r10
cmp rax, r8
jne 0x180038577
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x18003863b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x180038610
mov r8, r10
sub ecx, r9d
jns 0x18003862e
jmp 0x18003863d
cmp r10, rdx
je 0x18003864a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x18003863d
xor al, 1
cmp r8, rdx
jne 0x1800385f0
jmp 0x18003863d
xor eax, eax
jmp 0x18003863d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.18003e400
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.18003e8a0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.18003e890
int3
Function at 0x180001460
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001493
xor eax, eax
jmp 0x18000155c
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1800014c0
xor eax, eax
jmp 0x18000155c
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x1800014ec
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x18000155a
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.18000d7e0
test eax, eax
jne 0x180001558
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax + 8]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
jmp 0x18000155c
jmp 0x1800014e2
xor eax, eax
add rsp, 0x48
ret