joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fe2b0
Capabilities:
Check if file exists
Delete file

Disassembly:
jmp 0x140109ea0
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x140109ecc
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x140109f1f
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140109f1a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140109f1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x140109f4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140109f4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
Function at 0x1400fe710
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
call fcn.140109f70
mov edi, eax
test eax, eax
je 0x1400fe799
call fcn.140101900
mov ecx, dword [0x1404672c4]
mov edx, 1
mov r8, qword [rax]
call r8
test eax, eax
je 0x1400fe799
call fcn.140101900
cmp qword [rbx + 0x18], 0x10
mov r10, qword [rax + 8]
mov rax, rbx
jb 0x1400fe760
mov rax, qword [rbx]
mov edx, dword [0x1404672c4]
lea r9, str.xfileMove
mov dword [rsp + 0x38], edi
lea r8, str.C:code_app_playerhdSourcexplXfile.cpp
mov qword [rsp + 0x30], rax
mov ecx, 1
lea rax, str.Error_in_flushing_file__s_to_disk._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9f
call r10
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14010a0b0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400ff560
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x14010a0e3
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a0fa
mov rax, qword [rax]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14010a156
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a151
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14010a1b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a1ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a1ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x14010a1c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
jmp 0x14010a1c5
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010eb10
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x1400fe990
Capabilities:
Delete directory

Disassembly:
jmp 0x14010a430
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a45c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x14010a4af
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a4aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a4aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x14010a4d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret

Function at 0x1401013a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov ecx, 1
call fcn.14010e9b8
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400ffc70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140101410
cmp dword [rsp + 0x38], 0
je 0x140101423
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140101408
add rsp, 0x58
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140102d60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140102e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov ebx, eax
call fcn.140101900
mov r8, qword [rax]
xor edx, edx
mov ecx, dword [0x1404672d0]
call r8
test eax, eax
je 0x140102e52
call fcn.140101900
mov rdi, qword [rax + 8]
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140108670
nop
cmp qword [rax + 0x18], 0x10
jb 0x140102dd7
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
lea r9, str.xprocKill
mov qword [rsp + 0x30], r9
lea rax, str._s:_TerminateProcess_failed_err_d___s_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9e
lea r8, str.C:code_app_playerhdSourcexplXprocWinnt.cpp
mov edx, dword [0x1404672d0]
xor ecx, ecx
call rdi
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140102e52
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140102e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140102e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010eb10
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x140103830
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov esi, edx
mov rdi, rcx
mov dword [rcx + 0xc0], edx
xor ebp, ebp
mov dword [rcx + 0xc4], ebp
mov dword [rcx + 0xc8], edx
mov ebx, ebp
test edx, edx
jle 0x1401038da
mov ecx, 8
call fcn.14010e9b8
test rax, rax
je 0x140103877
mov qword [rax], rdi
jmp 0x14010387a
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140103360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401038fc
cmp dword [rsp + 0x38], 0
je 0x1401038f1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14010390b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
inc ebx
cmp ebx, esi
jl 0x140103863
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x140108cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
xor r14d, r14d
mov qword [rbp - 0x21], r14
lea rcx, [rbp + 0xf]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x140108d34
mov rax, qword [rax]
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140108d97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108d92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test edi, edi
jne 0x140108e6e
mov rdx, rsi
lea rcx, [rbp - 0x11]
call fcn.1400ff560
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x29]
xor r8d, r8d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140108e1a
cmp dword [rbp - 0x29], 4
jne 0x140108e1a
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140108e1a
mov ebx, dword [rbp - 0x15]
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140108e5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108e58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108e58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
mov qword [rbp - 1], r14
mov qword [rbp + 7], 7
mov word [rbp - 0x11], r14w
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140108e7e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140109ea0
Capabilities:
Check if file exists
Delete file

Disassembly:
jmp 0x140109ea0
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x140109ecc
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x140109f1f
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140109f1a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140109f1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x140109f4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140109f4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret

Function at 0x140109fe0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a00c
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x14010a061
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a05c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a05c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x14010a092
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14010a092
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
Function at 0x14010a0b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
call fcn.140109f70
mov edi, eax
test eax, eax
je 0x1400fe799
call fcn.140101900
mov ecx, dword [0x1404672c4]
mov edx, 1
mov r8, qword [rax]
call r8
test eax, eax
je 0x1400fe799
call fcn.140101900
cmp qword [rbx + 0x18], 0x10
mov r10, qword [rax + 8]
mov rax, rbx
jb 0x1400fe760
mov rax, qword [rbx]
mov edx, dword [0x1404672c4]
lea r9, str.xfileMove
mov dword [rsp + 0x38], edi
lea r8, str.C:code_app_playerhdSourcexplXfile.cpp
mov qword [rsp + 0x30], rax
mov ecx, 1
lea rax, str.Error_in_flushing_file__s_to_disk._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9f
call r10
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14010a0b0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400ff560
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x14010a0e3
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a0fa
mov rax, qword [rax]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14010a156
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a151
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14010a1b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a1ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a1ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x14010a1c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
jmp 0x14010a1c5
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010eb10
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14010a320
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a34c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x14010a39c
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a397
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
cmp ebx, 0xffffffff
jne 0x14010a3c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret

Function at 0x14010a3e0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14010a417
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
add rsp, 0x30
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14010a430
Capabilities:
Delete directory

Disassembly:
jmp 0x14010a430
push rbx
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ff560
cmp qword [rax + 0x18], 8
jb 0x14010a45c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x14010a4af
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a4aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010a4aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010e9f4
test bl, bl
je 0x14010a4d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop rbx
ret

Function at 0x14010a650
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14010a687
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140107da0
add rsp, 0x30
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401c9770]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1401c9780]
mov dword [rax], 1
mov rax, qword [0x1401c9790]
mov dword [rax], 1
mov rax, qword [0x1401c9760]
mov dword [rax], 1
mov rax, qword [0x1401c9640]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1401c9750]
mov dword [0x1401ec00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1401c9730]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1401c9710]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1401c8e90]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067
Function at 0x140012590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14001261a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140012610
cmp r11, r10
ja 0x140012696
cmp r10, rdx
ja 0x1400126a8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140012612
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400125f0
jmp 0x140012677
ja 0x14001261a
mov r11, r10
cmp rax, r8
jne 0x1400125b7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14001267b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140012650
mov r8, r10
sub ecx, r9d
jns 0x14001266e
jmp 0x14001267d
cmp r10, rdx
je 0x14001268a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001267d
xor al, 1
cmp r8, rdx
jne 0x140012630
jmp 0x14001267d
xor eax, eax
jmp 0x14001267d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call sym.core::option::unwrap_failed::h9762a13207486022
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::h6c569a63597ac0ca
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::h4c376ee8536a9e87
int3

Function at 0x140014dca
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14001d5c8
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x14001d632
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x14001d5e4
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x14001d5e4
and ebp, 0x7fffffff
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14003b0d8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14003b0fe
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14003b0e8
mov qword [rcx], rax
ret

Function at 0x14003bce0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14003bd06
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14003bcf0
mov qword [rcx], rax
ret

Function at 0x14004e315
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14004e33b
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14004e325
mov qword [rcx], rax
ret