joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066220
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov r12, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov edi, 4
test rsi, rsi
mov qword [rbp - 0x10], rcx
je 0x140066292
mov rax, rsi
shr rax, 0x3d
jne 0x1400663d1
lea r15, [rsi*4]
test r15, r15
je 0x140066292
movzx eax, byte [0x14019d171]
mov edx, 4
mov rcx, r15
call fcn.140007cc0
test rax, rax
je 0x1400663d8
mov rdi, rax
jmp 0x140066295
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [rbx + 0x30]
movzx ecx, byte [rbx + 0x158]
shr r8, cl
test r8, r8
je 0x140066331
xor eax, eax
jmp 0x1400662d8
inc rax
cmp rax, r8
je 0x140066331
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x1400663ac
mov edx, dword [rdi + rax*4]
cmp edx, r9d
je 0x1400662d0
nop word [rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x140066398
mov edx, dword [rdi + rdx*4]
cmp edx, r9d
jne 0x140066300
mov rdx, qword [r12 + 0x10]
cmp rax, rdx
jae 0x1400663c0
mov rcx, qword [r12]
mov dword [rcx + rax*4], r10d
jmp 0x1400662d0
lea r8, [r12 + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.14001a320
test rsi, rsi
je 0x14006635b
shl rsi, 2
mov r8d, 4
mov rcx, rdi
mov rdx, rsi
call fcn.140007cd0
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140066388
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140007cd0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rdx
mov rdx, rsi
call fcn.140109360
jmp 0x1400663e5
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rsi
mov rdx, rsi
call fcn.140109360
jmp 0x1400663e5
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rax
call fcn.140109360
jmp 0x1400663e5
call fcn.1400fbd70
jmp 0x1400663e5
mov ecx, 4
mov rdx, r15
call fcn.1401090d0
ud2
Function at 0x140076870
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov r12, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov edi, 4
test rsi, rsi
mov qword [rbp - 0x10], rcx
je 0x1400768e2
mov rax, rsi
shr rax, 0x3d
jne 0x140076a11
lea r15, [rsi*4]
test r15, r15
je 0x1400768e2
movzx eax, byte [0x14019d171]
mov edx, 4
mov rcx, r15
call fcn.140007cc0
test rax, rax
je 0x140076a18
mov rdi, rax
jmp 0x1400768e5
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x140076971
xor eax, eax
jmp 0x140076918
inc rax
cmp rax, r8
je 0x140076971
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x1400769ec
mov edx, dword [rdi + rax*4]
cmp edx, r9d
je 0x140076910
nop word [rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x1400769d8
mov edx, dword [rdi + rdx*4]
cmp edx, r9d
jne 0x140076940
mov rdx, qword [r12 + 0x10]
cmp rax, rdx
jae 0x140076a00
mov rcx, qword [r12]
mov dword [rcx + rax*4], r10d
jmp 0x140076910
lea r8, [r12 + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.140082a00
test rsi, rsi
je 0x14007699b
shl rsi, 2
mov r8d, 4
mov rcx, rdi
mov rdx, rsi
call fcn.140007cd0
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400769c8
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140007cd0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, [0x1401172d0]
mov rcx, rdx
mov rdx, rsi
call fcn.140109360
jmp 0x140076a25
lea r8, [0x1401172b8]
mov rcx, rsi
mov rdx, rsi
call fcn.140109360
jmp 0x140076a25
lea r8, [0x1401172e8]
mov rcx, rax
call fcn.140109360
jmp 0x140076a25
call fcn.1400fbd70
jmp 0x140076a25
mov ecx, 4
mov rdx, r15
call fcn.1401090d0
ud2
Function at 0x1400c7540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400b6390
cmp eax, 0x5c
jne 0x1400c7590
mov rcx, rsi
mov rdx, rdi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.1400c35c0
mov r14, qword [rdi]
mov rbx, qword [r14 + 0xa0]
mov rcx, rdi
call fcn.1400b6390
mov ecx, 1
cmp eax, 0x80
jb 0x1400c75c8
mov ecx, 2
cmp eax, 0x800
jb 0x1400c75c8
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rbx, rcx
jb 0x1400c7692
mov r15, qword [r14 + 0xb0]
inc r15
je 0x1400c76ac
mov r12, qword [r14 + 0xa8]
add r14, 0xa0
mov rcx, rdi
call fcn.1400b6390
xor ecx, ecx
cmp eax, 0xa
sete cl
mov eax, 1
cmove r15, rax
add rcx, r12
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], r15
mov rcx, rdi
call fcn.1400b6390
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x2c], 0
mov byte [rbp + 8], 2
mov rcx, rdi
call fcn.1400b64c0
movaps xmm0, xmmword [rbp]
movups xmmword [rsi + 0x68], xmm0
movaps xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x58], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x48], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
movaps xmm2, xmmword [rbp - 0x40]
movaps xmm3, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x38], xmm3
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov dword [rsi], 0x22
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14011f398]
lea r8, [0x14011f498]
mov edx, 0x2b
call fcn.1401092c0
ud2
lea rcx, [0x14011f398]
lea r8, [0x14011f4b0]
mov edx, 0x2b
call fcn.1401092c0
ud2
Function at 0x1400da1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x14019d171]
mov ecx, 0x1818
mov edx, 4
call fcn.140007cc0
test rax, rax
je 0x1400da2de
xor ecx, ecx
lea rdx, [0x140135a28]
movdqa xmm0, xmmword [0x140110520]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400da210
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x303
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400dc4a0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e3a10
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.1401090d0
ud2

Function at 0x1400da410
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x14019d171]
mov ecx, 0x200
mov edx, 4
call fcn.140007cc0
test rax, rax
je 0x1400da51d
xor ecx, ecx
lea rdx, [0x140137290]
movdqa xmm0, xmmword [0x140110520]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400da460
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400dc4a0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e3a10
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.1401090d0
ud2
Function at 0x1400df530
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x1400df591
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x1400df6d4
mov rdi, rdx
movzx eax, byte [0x14019d171]
mov edx, 4
mov rcx, rbx
call fcn.140007cc0
test rax, rax
je 0x1400df6db
cmp rbx, 0x80
jae 0x1400df59d
xor ecx, ecx
jmp 0x1400df63a
xor ecx, ecx
mov eax, 4
jmp 0x1400df6bc
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400df63a
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400df63a
lea rdx, [r14 - 1]
shr rdx, 0x3d
jne 0x1400df63a
mov rcx, r14
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x140110520]
nop
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400df5e0
cmp r14, rcx
je 0x1400df6b9
mov rdx, rcx
or rdx, 1
test bl, 8
je 0x1400df669
mov r8d, dword [rdi + rcx*8]
mov r9d, dword [rdi + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp r14, rdx
je 0x1400df6b9
nop
mov edx, dword [rdi + rcx*8]
mov r8d, dword [rdi + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [rdi + rcx*8 + 8]
mov r8d, dword [rdi + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp r14, rcx
jne 0x1400df670
mov rcx, r14
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400fbd70
ud2
mov ecx, 4
mov rdx, rbx
call fcn.1401090d0
ud2

Function at 0x1400e63d0
Capabilities:
Open clipboard

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x1400e6422
lea rcx, [rbp - 0x28]
call fcn.1400e6df0
lea rcx, [rbp - 9]
call fcn.1400e6d10
mov rax, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
test rax, rax
je 0x1400e6431
mov rcx, qword [rbp - 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rcx
jmp 0x1400e6469
call fcn.1400f20c0
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp - 0x28], rdi
movzx eax, byte [0x14019d171]
mov ecx, 8
mov edx, 8
call fcn.140007cc0
test rax, rax
je 0x1400e6474
mov qword [rax], rdi
mov qword [rsi + 8], rax
lea rax, fcn.1400e61f0
mov qword [rsi + 0x10], rax
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 8
mov edx, 8
call fcn.1401090d0
ud2
Function at 0x1400e6df0
Capabilities:
Read clipboard data

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov ecx, 0xd
call sub.USER32.dll_GetClipboardData
test rax, rax
je 0x1400e6eff
mov rdi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x1400e6eff
mov rbx, rax
mov rcx, rdi
call sub.KERNEL32.dll_GlobalSize
and rax, 0xfffffffffffffffe
add rax, rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rax
mov word [rbp - 0x38], 0
lea r14, [rbp - 0x20]
lea rdx, [rbp - 0x48]
mov rcx, r14
call fcn.1400e6a40
mov r15, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x10]
xor r12d, r12d
mov rax, r15
mov r8, rbx
jmp 0x1400e6e96
add r12, rdx
inc r12
lea rax, [r15 + r12]
mov r8, rbx
sub r8, r12
jb 0x1400e6f42
cmp r8, 0x10
jae 0x1400e6ed0
xor edx, edx
test r8, r8
je 0x1400e6ec1
nop word cs:[rax + rax]
cmp byte [rax + rdx], 0
je 0x1400e6ef2
inc rdx
cmp r8, rdx
jne 0x1400e6eb0
mov rdx, r8
xor eax, eax
cmp rax, 1
je 0x1400e6ee0
jmp 0x1400e6f42
xor ecx, ecx
mov rdx, rax
call fcn.1400ffc60
cmp rax, 1
jne 0x1400e6f42
lea rcx, [r12 + rdx]
cmp rcx, rbx
jae 0x1400e6e80
cmp byte [r15 + rcx], 0
jne 0x1400e6e80
jmp 0x1400e6f19
mov eax, 1
cmp rax, 1
je 0x1400e6ee0
jmp 0x1400e6f42
call fcn.1400f20c0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400e6f59
cmp rbx, rcx
jb 0x1400e6f6b
lea rax, [r15 + rcx]
add r15, rbx
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r15
lea rcx, [rbp - 0x48]
call fcn.1400fc640
mov rcx, rdi
call sub.KERNEL32.dll_GlobalUnlock
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_string.rs
mov rdx, rbx
call fcn.140109760
ud2

Function at 0x1400e6fc0
Capabilities:
Write clipboard data

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r8
mov r14, rdx
mov edi, ecx
mov ecx, 0x42
mov rdx, r8
call sub.KERNEL32.dll_GlobalAlloc
test rax, rax
je 0x1400e702a
mov rsi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
mov ecx, edi
mov rdx, rsi
call sub.USER32.dll_SetClipboardData
test rax, rax
je 0x1400e703d
xor eax, eax
jmp 0x1400e7037
call fcn.1400f20c0
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
jmp 0x1400e7056
call fcn.1400f20c0
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
mov rcx, rsi
call sub.KERNEL32.dll_GlobalFree
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400e9c80
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400e9d10
jmp 0x1400e9cff
jae 0x1400e9dd0
cmp r8, 0x201
jae 0x1400e9d10
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400e9d68
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400e9d3f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140108260
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400e9d91
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e9e38
mov r8d, r14d
cmp r15, r8
jne 0x1400e9cf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400e9e5b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400e9cff
jmp 0x1400e9d10
cmp rsi, r8
jb 0x1400e9e75
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400eca90
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400e9e21
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140007cd0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400e9e09
jmp 0x1400e9e21
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1401092c0
jmp 0x1400e9e8a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1401096f0
ud2
Function at 0x1400f1f80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140178e10]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400f1fc4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400f202a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400f2061
test eax, eax
js 0x1400f203b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400f2054
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.1400e74e0
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1400ec890
mov rcx, rax
call fcn.1400e7a40
mov ecx, 7
int 0x29
ud2

Function at 0x1400f2bf0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400f2c28
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400f2c40
nop
add rsp, 0x38
ret

Function at 0x1400f2c40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400f2c83
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x1400eb4a0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140109220
ud2
Function at 0x140101040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1401010ba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401010b0
cmp r11, r10
ja 0x140101153
cmp r10, rdx
ja 0x140101167
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1401010b2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140101090
jmp 0x140101127
ja 0x1401010ba
mov r11, r10
cmp rax, r8
jne 0x140101062
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14010112b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140101100
mov r8, r10
sub ecx, r9d
jns 0x14010111e
jmp 0x14010112d
cmp r10, rdx
je 0x140101139
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14010112d
xor al, 1
cmp r8, rdx
jne 0x1401010e0
jmp 0x14010112d
xor eax, eax
jmp 0x14010112d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1401092c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140109760
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401096f0
ud2

Function at 0x140103494
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401034de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401034de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401034de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401034de
cmp dword [rcx + 0x84], 0xe
jbe 0x1401034de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401034e0
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x14002b078]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
xor edx, edx
mov r8d, 0x208
call fcn.140002b40
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x20a
call fcn.140002b40
mov r8, rbx
lea rdx, str.SOFTWAREWOW6432NodeClassesCLSID_sInprocServer32
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400010e4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x250]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400010d9
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.1400090bc
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140001f40
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret