joyce8/EMBER2024-capa huggingface dataset:
Function at 0x607940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x607bf4
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x38]
lea rbx, [0x006a4e76]
mov ecx, 7
mov rax, rdx
call fcn.005d2ce0
test rbx, rbx
jne 0x607a91
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x00693760]
lea rcx, [0x006a815b]
mov edi, 0x11
call fcn.004129c0
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
je 0x607a29
cmp rbx, 1
jg 0x6079e2
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
nop dword [rax]
test r8, r8
je 0x607a29
cmp r8, 7
jne 0x6079e2
cmp dword [rsi], 0x6e756863
jne 0x6079e2
cmp word [rsi + 4], 0x656b
jne 0x6079e2
cmp byte [rsi + 6], 0x64
nop
je 0x607a29
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040b060
lea rdx, [0x00654d80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006b573d]
mov ebx, 0x33
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x00693760]
lea rcx, [0x006a5978]
mov edi, 0xa
call fcn.004129c0
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
je 0x607b04
nop
cmp rbx, 1
jg 0x607b12
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
test rsi, rsi
je 0x607b04
nop word [rax + rax]
cmp rsi, 5
jne 0x607b99
xor eax, eax
jmp 0x607b61
movups xmmword [rsp + 0x28], xmm15
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x00693760]
lea rcx, [0x006a4e76]
mov edi, 7
call fcn.004129c0
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0040b060
lea rdx, [0x00654d80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006b296e]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
nop dword [rax + rax]
call fcn.0040b060
lea rdx, [0x00654d80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006b36ab]
mov ebx, 0x2c
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rax
cmp rax, 5
jge 0x607b04
movzx r8d, byte [rax + rdi]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x607b7a
add r8d, 0x20
lea r9, [0x006a4811]
movzx r9d, byte [r9 + rax]
lea r10d, [r9 - 0x41]
cmp r10b, 0x19
ja 0x607b94
add r9d, 0x20
cmp r8b, r9b
je 0x607b5e
nop dword [rax]
cmp rsi, 0xa
jne 0x607b12
xor eax, eax
jmp 0x607bb1
inc rax
cmp rax, 0xa
jge 0x607b04
movzx esi, byte [rax + rdi]
lea r8d, [rsi - 0x41]
cmp r8b, 0x19
ja 0x607bcc
add esi, 0x20
lea r8, [0x006a5c48]
movzx r8d, byte [r8 + rax]
lea r9d, [r8 - 0x41]
nop dword [rax]
cmp r9b, 0x19
ja 0x607bea
add r8d, 0x20
cmp sil, r8b
je 0x607bae
jmp 0x607b12
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.00607940
Function at 0x60c960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60ca95
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
cmp byte [0x008f2850], 0
je 0x60ca51
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, rbx
mov rbx, rcx
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [0x006b2411]
mov ebx, 0x28
lea rcx, [rsp + 0x30]
mov edi, 2
mov rsi, rdi
call fcn.005d0ba0
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov rax, qword [rax + 0x178]
mov rbx, qword [rsp + 0x50]
xor r8d, r8d
call fcn.005ed1c0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0060c960
Function at 0x60e4c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60e742
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
test byte [rbx], al
mov ecx, dword [rcx + 8]
mov ebx, ecx
call fcn.00610bc0
test rax, rax
je 0x60e734
mov qword [rsp + 0x18], rax
cmp byte [rax + 0x166], 0
jne 0x60e69d
cmp byte [rax + 0x162], 0
jne 0x60e539
mov rsi, qword [rax + 0x20]
test rsi, rsi
je 0x60e532
nop
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x60e532
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x18]
mov byte [rax + 0x162], 1
cmp byte [rax + 0x163], 0
jne 0x60e681
mov byte [rax + 0x163], 1
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x20]
call fcn.0060e780
nop
test rbx, rbx
je 0x60e5e2
lea rdx, [0x00719ac0]
cmp rbx, rdx
jne 0x60e581
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov edx, dword [rdx + 8]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rax, [0x0068d860]
lea rbx, [rsp + 0x28]
call fcn.0040ad40
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x167], 1
lea rbx, [0x00719b00]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00603dc0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rax, rax
je 0x60e673
lea rcx, [rax + 0x78]
cmp dword [0x008f2cf0], 0
jne 0x60e60d
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x170], rcx
mov qword [rdx + 0x100], rax
jmp 0x60e634
mov rdi, qword [rsp + 0x18]
lea rdx, [rdi + 0x170]
mov rbx, rdi
mov rdi, rdx
nop
call fcn.004655a0
lea rdi, [rbx + 0x100]
call fcn.004654a0
mov rdx, rbx
mov rax, qword [rdx + 0xf8]
nop dword [rax + rax]
call fcn.00406160
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
movzx ecx, byte [rcx + 2]
test cl, 1
je 0x60e665
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
call fcn.006109e0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x20]
call fcn.0060f540
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x28
lea rcx, [0x006b2551]
mov qword [rax], rcx
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov ecx, dword [rcx + 8]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], 1
lea rcx, [0x007191c0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x0068d860]
lea rbx, [rsp + 0x28]
nop
call fcn.0040ad40
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x167], 1
lea rbx, [0x00719b00]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00603dc0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
jmp fcn.0060e4c0
Function at 0x610d60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x610f1a
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
test byte [rax], al
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x00633c60]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov edx, dword [rax + 0x68]
test edx, edx
jne 0x610dcf
mov qword [rsp + 0x30], rax
lea rcx, [rax + 0x68]
lea rbx, [rsp + 0x58]
mov rax, rcx
nop dword [rax]
call fcn.0046e5e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rax + 0x78]
mov rdx, qword [rdx + 0x20]
mov rax, qword [rax + 0x80]
mov rbx, rcx
call rdx
mov rbx, qword [rsp + 0x90]
cmp dword [rbx + 0x10], 0
je 0x610f02
movups xmmword [rsp + 0x48], xmm15
mov eax, dword [rbx + 0x10]
nop
call fcn.0040aec0
lea rcx, [0x006653c0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
nop
cmp byte [0x008f2850], 0
nop
je 0x610e45
nop
lea rax, [0x006b2bfe]
mov ebx, 0x29
lea rcx, [rsp + 0x48]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.005d0ba0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x58]
test rdx, rdx
je 0x610efa
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x90]
mov ecx, dword [rdx + 0x10]
mov dword [rsp + 0x2c], ecx
mov rbx, qword [0x0089c7d8]
lea rax, [0x00663500]
nop dword [rax]
call fcn.00410bc0
mov rdx, qword [rax]
mov rsi, qword [rax + 8]
test bl, bl
jne 0x610ed4
movups xmmword [rsp + 0x68], xmm15
mov eax, dword [rsp + 0x2c]
call fcn.0040aec0
lea rcx, [0x00657820]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006a6f88]
mov ebx, 0xe
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004f8500
mov rsi, rbx
mov rdx, rax
xor eax, eax
lea rbx, [0x006a6867]
mov ecx, 0xc
mov rdi, rdx
call fcn.0044e760
mov rdx, qword [rsp + 0x38]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
call fcn.006068e0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00610d60
Function at 0x622c00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x622cf1
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], r8
mov rdx, qword [rax + 0x80]
test rdx, rdx
jne 0x622ccf
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x622cb5
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
nop dword [rax]
test rax, rax
jne 0x622cab
test rcx, rcx
jne 0x622cab
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x0066df60]
nop dword [rax]
call fcn.0040d960
mov qword [rax + 8], 0x31
lea rcx, [0x006b4f77]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x007191c0]
mov rdi, rax
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0089e800]
nop dword [rax]
call fcn.00552ec0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00622c00
Function at 0x622d60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x622f09
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov r13, 0
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x17], 0
mov byte [rsp + 0x16], 0
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x90], esi
sete sil
lea rax, [rdx + 0x90]
test sil, sil
jne 0x622df1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
call fcn.0046e200
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00622f40]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x17], 1
cmp qword [rdx + 0x98], 0
nop
jne 0x622e2c
cmp qword [rdx + 0xa0], 0
je 0x622e51
mov byte [rsp + 0x16], 0
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx]
nop
call rax
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp dword [0x008f2cf0], 0
jne 0x622e63
mov qword [rdx + 0x98], rbx
jmp 0x622e78
lea rsi, [rdx + 0x98]
mov rax, rdi
mov rdi, rsi
call fcn.004655e0
mov rdi, rax
mov qword [rdx + 0xa0], rcx
cmp dword [0x008f2cf0], 0
jne 0x622e91
mov qword [rdx + 0xa8], rdi
jmp 0x622ea5
lea rcx, [rdx + 0xa8]
mov rax, rdi
mov rdi, rcx
nop
call fcn.004654a0
test rbx, rbx
jne 0x622eb4
cmp qword [rdx + 0xa0], 0
je 0x622ee1
mov rax, qword [rdx + 0x78]
call fcn.00406160
mov byte [rsp + 0x16], 1
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
lea rax, [0x006576e0]
lea rbx, [0x007187b0]
call fcn.00436420
nop
call fcn.004358c0
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00622d60
Function at 0x6232c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62337c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r8
mov rdx, qword [rax + 0x90]
test rdx, rdx
je 0x623312
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
jmp 0x62332b
mov rdx, qword [rax + 0x98]
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x623372
test rcx, rcx
jne 0x623372
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x41
lea rcx, [0x006b75d9]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x38]
lea rcx, [0x007191c0]
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.006232c0
Function at 0x62a000
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62a1e5
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
cmp qword [rax + 0xe8], 0
jne 0x62a1db
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x68]
mov r8, qword [rdx + 0x30]
sub r8, qword [rdx + 0x28]
test r8, r8
jle 0x62a110
mov rax, rdx
mov rbx, r8
call fcn.005d1060
cmp rbx, 0xc
jl 0x62a08f
cmp dword [rax], 0x50545448
jne 0x62a08f
cmp word [rax + 4], 0x312f
jne 0x62a08f
cmp byte [rax + 6], 0x2e
nop
jne 0x62a08f
cmp dword [rax + 8], 0x38303420
je 0x62a1b9
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
nop dword [rax + rax]
call fcn.0040b060
lea rdx, [0x00655080]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
test rdx, rdx
je 0x62a0cb
mov rbx, qword [rdx + 8]
jmp 0x62a0ce
mov rbx, rdx
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x58], rdx
lea rax, [0x006b8095]
mov ebx, 0x4b
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.005d0ba0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [0x0089d3d8]
nop word [rax + rax]
cmp qword [0x0089d3d0], rbx
jne 0x62a14d
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00403fe0
test al, al
jne 0x62a197
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x28]
movups xmmword [rsp + 0x30], xmm15
test rbx, rbx
je 0x62a15c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rax, [0x006ac731]
mov ebx, 0x1a
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x70]
call fcn.0062c2c0
jmp 0x62a1af
mov rbx, qword [0x0089d820]
mov rcx, qword [0x0089d828]
mov rax, qword [rsp + 0x70]
call fcn.0062c2c0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbx, qword [0x0089d820]
mov rcx, qword [0x0089d828]
mov rax, qword [rsp + 0x70]
call fcn.0062c2c0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0062a000
Function at 0x1400059b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140005a40
cmp r11, r10
ja 0x140005ab6
cmp r10, rdx
ja 0x140005ac8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140005a42
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140005a20
jmp 0x140005aa4
ja 0x140005a4a
mov r11, r10
cmp rax, r8
jne 0x1400059e4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140005a80
mov rdi, r8
sub ecx, edx
jns 0x140005a9b
jmp 0x140005aa6
cmp r8, rsi
je 0x140005ad7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140005aa6
xor al, 1
cmp rdi, rsi
jne 0x140005a60
jmp 0x140005aa6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14003e3a0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14003e120
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14003e520
int3

Function at 0x14000a380
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.1400021e0
cmp rax, rcx
je 0x14000a3a5
cmp rdx, 4
jae 0x14000a3a8
xor eax, eax
xor r8d, r8d
jmp 0x14000a430
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140040570]
movdqa xmm3, xmmword [0x140040580]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
pmovzxbq xmm4, xmm4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
pmovzxbq xmm4, xmm5
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000a3d0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000a447
nop word [rax + rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000a430
ret
Function at 0x140011190
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x140011230
jmp 0x14001121f
jae 0x1400112ef
cmp r8, 0x201
jae 0x140011230
mov r15d, 0x200
lea r12, [rbp - 0x58]
mov r13, r8
jmp 0x140011288
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x14001125f
lea rcx, [rbp + 0x3c8]
mov rdx, r14
call fcn.14003ed70
mov rdi, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x3d8], r14
mov rbx, rdi
mov r15, r14
mov r12, qword [rbp + 0x3e8]
mov r13, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r13d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400112b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001134e
mov r8d, esi
cmp r13, r8
jne 0x140011210
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001137b
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14001121f
jmp 0x140011230
cmp r15, r8
jb 0x140011395
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140011bb0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3e0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x140011339
mov edx, 2
mov rcx, qword [rbp + 0x3e8]
call fcn.1400014a0
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e0]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
test rdi, rdi
jne 0x140011328
jmp 0x140011339
lea rcx, str.internal_error:_entered_unreachable_code_registry_srcindex.crates.io_6f17d22bba15001f_serde_json_1.0.115_src_ser.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.14003e1a0
jmp 0x1400113aa
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14003e120
ud2