joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400140b0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
test rcx, rcx
je 0x140014296
cmp word [rcx], 0
je 0x140014296
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov edi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400141ab
test ax, ax
je 0x1400141ea
cmp word [rbx + 2], 0x3a
jne 0x1400141ea
cmp word [rbx + 4], 0x5c
jne 0x1400141ea
mov edx, 0x5c
mov rcx, rbx
call fcn.140018b10
test rax, rax
je 0x1400141e5
cmp rax, rbx
jbe 0x1400141ce
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rbx
lea r8, [rax + 2]
sar r8, 1
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140015fe0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140014200
cmp qword [rsp + 0x68], rdi
je 0x140014247
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x140014247
cmp word [rdi], 0
je 0x140014247
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140014247
cmp word [rdi], 0
je 0x140014228
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x140014253
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x140014253
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140014278
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x140014298
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140017400
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001ccc8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14001cb5b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001cb5b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001cb5b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001cb5b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001cb5b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001cb5b
cmp dword [rcx + 0xf8], 0
je 0x14001cb5b
mov ecx, ebx
call fcn.14001cbfc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14001c9ec
cmp dword [rbp + 0x20], 0
je 0x14001cba8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001cbb0
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001caf4
Function at 0x140001140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140005650], rbx
je 0x14000118c
cmp rax, rbx
jne 0x14000117f
mov ebx, 1
mov esi, ebx
jmp 0x140001191
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001164
mov ebx, 1
mov eax, dword [0x140005658]
cmp eax, ebx
jne 0x1400011a7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140001216
mov eax, dword [0x140005658]
test eax, eax
jne 0x140001210
mov dword [0x140005658], ebx
lea r15, [0x1400033f8]
lea rdi, [0x1400033e0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001202
test eax, eax
jne 0x140001206
cmp qword [rdi], 0
je 0x1400011f7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [vtable.LI_IsIUIkH.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400011ce
test eax, eax
je 0x140001216
mov eax, 0xff
jmp 0x1400012fc
mov dword [0x140005064], ebx
mov eax, dword [0x140005658]
cmp eax, ebx
jne 0x14000123d
lea rdx, [0x1400033d8]
lea rcx, [0x1400033c8]
call sub.msvcrt.dll__initterm
mov dword [0x140005658], 2
test esi, esi
jne 0x14000124a
xor eax, eax
xchg qword [0x140005650], rax
cmp qword [0x140005660], 0
je 0x140001288
lea rcx, [0x140005660]
call fcn.140001510
test eax, eax
je 0x140001288
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140005660]
mov r9, qword [vtable.LI_IsIUIkH.0]
call r9
mov r8, qword [0x140005078]
mov rdx, qword [0x140005070]
mov ecx, dword [0x140005068]
call fcn.140001b00
mov dword [0x140005060], eax
cmp dword [0x140005080], 0
jne 0x1400012b8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140005064], 0
jne 0x1400012cd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140005060]
jmp 0x1400012fc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140096000
add rsp, 0x28
jmp 0x140001140

Function at 0x1400013fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001448
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001440
cmp dword [rcx + 0x3c], edx
jl 0x140001440
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001440
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001448
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140002160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rdi, [0x140046a70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x1400021b0
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000a660
nop
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400021e0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.14000a660
nop
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x140002240
lea rax, [rcx + 0xc]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x28]
add rbx, rcx
mov r8d, 0xc
lea rdx, str.libjvm.cfg
mov rcx, rbx
call fcn.1400107d0
mov byte [rbx + 0xc], 0
jmp 0x14000225e
mov qword [rsp + 0x20], 0xc
lea r9, str.libjvm.cfg
mov edx, 0xc
lea rcx, [rbp - 0x28]
call fcn.14000bde0
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1f
jb 0x1400022a5
lea rax, [rcx + 0x1f]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x48]
add rbx, rcx
mov r8d, 0x1f
lea rdx, str._binwindowsaccessbridge_32.dll
mov rcx, rbx
call fcn.1400107d0
mov byte [rbx + 0x1f], 0
jmp 0x1400022c3
mov qword [rsp + 0x20], 0x1f
lea r9, str._binwindowsaccessbridge_32.dll
mov edx, 0x1f
lea rcx, [rbp - 0x48]
call fcn.14000bde0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400022f9
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400022f9
mov bl, 1
jmp 0x1400022fb
xor bl, bl
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140002332
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000232d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400023a4
call fcn.14000ec04
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000237a
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002375
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000239e
call fcn.14000ec04
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000ebe0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400158ec
nop
call fcn.1400158ec
nop
int3
Function at 0x1400023b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140002402
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000a660
nop
lea r8, str._bin_serverjvm.dll
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000ac50
nop
mov esi, 1
mov dword [rsp + 0x20], esi
cmp qword [rax + 0x18], 0x10
jb 0x140002444
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000248a
lea r8, str._binclientjvm.dll
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000ac50
mov esi, 3
cmp qword [rax + 0x18], 0x10
jb 0x140002477
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000248a
xor dil, dil
jmp 0x14000248d
mov dil, 1
test sil, 2
je 0x1400024e3
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400024d0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025a7
call fcn.14000ec04
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x140002524
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000251e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025ad
call fcn.14000ec04
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000255d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002558
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025a1
call fcn.14000ec04
test dil, dil
je 0x14000257a
mov r8, rbx
mov edx, 0x103
lea rcx, [0x140046a70]
call fcn.14001554c
mov al, 1
jmp 0x14000257c
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14000ebe0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400158ec
nop
call fcn.1400158ec
nop
call fcn.1400158ec
int3
Function at 0x140002b80
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x38]
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140002bda
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000ebe0
add rsp, 0x168
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.JavaHome
lea rax, [rsp + 0x40]
mov qword [rsp + 0x160], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x103
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002c29
lea rcx, [rsp + 0x40]
call fcn.1400023b0
movzx ebx, al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000ebe0
add rsp, 0x168
ret
Function at 0x140003c00
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x4a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rdx
mov r9d, 0x104
lea r8, [rsp + 0x280]
mov edx, ecx
mov rcx, qword [0x140046a30]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140003d86
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movdqa xmm0, xmmword [0x14003e4e0]
movdqu xmmword [rsp + 0x38], xmm0
xor edi, edi
mov word [rsp + 0x28], di
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x140003c90
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14000a330
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140001e20
nop
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140003cf0
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
add qword [rbx + 8], 0x20
jmp 0x140003cfc
mov r8, rax
mov rcx, rbx
call fcn.14000b5c0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003d35
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003dad
call fcn.14000ec04
movdqa xmm0, xmmword [0x14003e4f0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140003d86
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003da7
call fcn.14000ec04
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14000ebe0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x4a0
pop rdi
ret
call fcn.1400158ec
nop
call fcn.1400158ec
nop
int3
Function at 0x14001a2d0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a034

Function at 0x14001e64c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14001e629
call fcn.1400165f8
mov dword [rax], 0x16
call fcn.1400158cc
or eax, 0xffffffff
jmp 0x14001e646
sub dword [rcx + 0x10], 1
jns 0x14001e638
add rsp, 0x28
jmp 0x140027ecc
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14001e608
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140027d6c
call fcn.1400165f8
mov dword [rax], 0x16
call fcn.1400158cc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140027d54
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140027d54
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140027d9e
lock or dword [rax + 0x14], 0x10
jmp 0x140027d54
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140027dbb
mov rcx, qword [rbp + 0x10]
call fcn.14002a14c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001d1ac
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14002939c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140027e12
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140027d54
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140027e7e
mov rcx, qword [rbp + 0x10]
call fcn.14001d1ac
cmp eax, 0xffffffff
je 0x140027e65
mov rcx, qword [rbp + 0x10]
call fcn.14001d1ac
cmp eax, 0xfffffffe
je 0x140027e65
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001d1ac
movsxd rdi, eax
lea rsi, [0x140046330]
mov rcx, rbx
sar rdi, 6
call fcn.14001d1ac
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140027e6c
lea rax, [0x140044430]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140027e7e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140027eb4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140027eb0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140027eb0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140027d57
jmp 0x140027d24
Function at 0x140008570
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1400085e2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x1400085a8
add rdi, rbx
sub rsi, rbx
je 0x1400085e2
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x1400085a0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x1400085a0
add ebp, 0x80000000
jmp 0x1400085e4
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400086c0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
sub rsp, 0x20
mov eax, 4
lea r11, str.expand_16_byte_kexpand_32_byte_k
cmp r8, 0x10
je 0x1400086e8
cmp r8, 0x20
jne 0x140008808
lea r11, [0x14002db90]
cmp rax, 4
jne 0x1400087ee
mov eax, dword [r11]
mov r10d, dword [r11 + 4]
movq xmm1, qword [r11 + 8]
movdqu xmm0, xmmword [rdx]
movdqa xmm2, xmm0
cmp r8, 0x10
je 0x14000874c
cmp r8, 0x13
jbe 0x140008822
cmp r8, 0x17
jbe 0x14000883b
cmp r8, 0x1b
jbe 0x140008854
cmp r8, 0x1f
jbe 0x14000886d
movq xmm3, qword [rdx + 0x18]
movd xmm4, dword [rdx + 0x14]
movd xmm2, dword [rdx + 0x10]
punpckldq xmm2, xmm4
punpcklqdq xmm2, xmm3
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xc
je 0x140008772
cmp rdx, 0x10
jne 0x14000878a
mov edx, dword [r9]
lea rsi, [r9 + 4]
mov r8d, 0xc
mov r11d, 8
jmp 0x140008783
xor edx, edx
mov r8d, 8
mov r11d, 4
mov rsi, r9
mov esi, dword [rsi]
add r11, r9
jmp 0x1400087ab
cmp rdx, 3
jbe 0x140008886
cmp rdx, 7
jbe 0x140008899
xor edx, edx
mov r8d, 4
xor esi, esi
mov r11, r9
mov r11d, dword [r11]
mov r8d, dword [r9 + r8]
mov dword [rcx], eax
mov dword [rcx + 4], r10d
punpcklqdq xmm1, xmm0
movdqu xmmword [rcx + 8], xmm1
pshufd xmm1, xmm0, 0xee
movd dword [rcx + 0x18], xmm1
pshufd xmm0, xmm0, 0xff
movd dword [rcx + 0x1c], xmm0
movdqu xmmword [rcx + 0x20], xmm2
mov dword [rcx + 0x30], edx
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], r11d
mov dword [rcx + 0x3c], r8d
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14002dd80]
lea r8, str.C:Users_nithi.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rust_crypto_0.2.36_srccryptoutil.rsassertion_failed:_input.len____4
mov edx, 0x22
call fcn.14002b920
ud2
lea rcx, [0x14002dc30]
lea r8, [0x14002dc58]
mov edx, 0x28
call fcn.14002b920
ud2
lea rax, [0x14002dba0]
mov ecx, 0x14
mov rdx, r8
mov r8, rax
call fcn.14002bd70
ud2
lea rax, [0x14002dbb8]
mov ecx, 0x18
mov rdx, r8
mov r8, rax
call fcn.14002bd70
ud2
lea rax, [0x14002dbd0]
mov ecx, 0x1c
mov rdx, r8
mov r8, rax
call fcn.14002bd70
ud2
lea rax, [0x14002dbe8]
mov ecx, 0x20
mov rdx, r8
mov r8, rax
call fcn.14002bd70
ud2
lea r8, [0x14002dc00]
mov ecx, 4
call fcn.14002bd70
ud2
lea r8, [0x14002dc18]
mov ecx, 8
call fcn.14002bd70
ud2
Function at 0x14000bf50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14000bfe0
jmp 0x14000bfcf
jae 0x14000c0a0
cmp r8, 0x201
jae 0x14000bfe0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000c038
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14000c00f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14002a580
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000c061
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x14000c108
mov r8d, r14d
cmp r15, r8
jne 0x14000bfc0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x14000c12b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000bfcf
jmp 0x14000bfe0
cmp rsi, r8
jb 0x14000c145
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000f8f0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14000c0f1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140005700
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14000c0d9
jmp 0x14000c0f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002b920
jmp 0x14000c15a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002bd70
ud2