joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003698
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
lea esi, [r9 - 0x96a]
mov rbx, r8
lea ebp, [rcx + 0x26c]
add r9d, 0xfffffe92
xor ecx, 0x7b4
cmp r9d, esi
jl 0x1400038d0
mov edi, dword [rsp + 0x70]
lea rdx, [0x1400d1010]
mov r9d, edi
mov r8d, esi
xor r9d, 0x798
xor r8d, 0xe0f
lea eax, [rdi + 0x101]
lea ecx, [rdi - 0x84b]
mov dword [rsp + 0x20], eax
call fcn.140001a04
cmp dword [rbx + 0x118], 0x27e0
mov r14d, eax
ja 0x140003754
mov rcx, qword [section..data]
mov r8d, dword [0x1400d1100]
mov r9d, dword [rbx + 0x74]
add r8d, 0x3000
add r9d, 0xd2c6f
mov edx, dword [rcx + 0x5c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1000
mov qword [rbx + 0xd8], rax
jmp 0x14000376c
mov eax, dword [rbx + 0x54]
mov ecx, dword [0x1400d1090]
xor eax, dword [0x1400d1094]
imul ecx, eax
mov dword [0x1400d1090], ecx
mov rcx, qword [section..data]
lea r9d, [rsi - 0x20f]
mov eax, dword [rbx + 0xfc]
lea r8d, [rdi - 0x325]
mov r10d, edi
lea edx, [r14 + 0x627]
xor r10d, 0x101
sub eax, dword [rcx + 0x80]
add eax, 0x25
mov dword [rsp + 0x30], r10d
mov dword [rcx + 0x9c], eax
lea eax, [rsi + 0xa04]
mov dword [rsp + 0x28], eax
lea ecx, [rbp + 0x983]
mov rax, qword [section..data]
mov qword [rsp + 0x20], rax
call fcn.140001b0c
lea rax, [0x140046ad0]
xor r10d, r10d
mov qword [0x1400d10c0], rax
mov rax, qword [rbx + 0xb0]
mov r9d, dword [r10 + rax]
add r10, 4
imul r9d, dword [0x1400d10a4]
mov eax, dword [rbx + 0xfc]
dec eax
xor dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x58]
movsxd rdx, dword [rbx + 0x9c]
mov r8d, r9d
shr r8d, 8
lea eax, [rax*2 + 0x10fe78]
sub eax, dword [rbx + 0x3c]
mov dword [rbx + 0x58], eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xb8]
mov byte [rdx + rcx], r8b
inc dword [rbx + 0x9c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xfc]
add ecx, 0xfffeb54f
add ecx, dword [rbx + 0x58]
xor dword [rbx + 0xec], ecx
mov eax, dword [0x1400d1090]
add eax, 0xffffffda
add dword [rbx + 0x14], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x9c]
mov rax, qword [rbx + 0xb8]
mov byte [rcx + rax], r9b
mov rax, qword [section..data]
inc dword [rax + 0x9c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x3c]
mov eax, dword [rbx + 0x8c]
xor ecx, 0x124929
imul eax, ecx
mov dword [rbx + 0x8c], eax
mov ecx, dword [rbx + 0x108]
mov eax, dword [rbx + 0x24]
imul eax, ecx
add ecx, 0xfffeb550
mov dword [rbx + 0x24], eax
add ecx, dword [rbx + 0x58]
mov dword [rbx + 0x108], ecx
cmp r10, 0x87cd8
jl 0x1400037de
jmp 0x1400038e8
lea eax, [rbp + 0xfea]
add dword [r8 + 0x1c], eax
sub ecx, dword [r8 + 0xc0]
sub ecx, r9d
add dword [r8 + 0x7c], ecx
mov rbx, qword [rsp + 0x50]
lea eax, [rbp + 0x503]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000495c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
lea ebx, [rcx - 0xe03]
movsxd rbp, r9d
mov esi, ecx
mov r14d, ebp
xor esi, 0x15cf
xor r14d, 0x1fec
mov rdi, rdx
lea r12d, [rax - 0xe03]
lea r13d, [rax - 0x2fd]
mov eax, ebp
xor eax, 0x1f83
cmp esi, eax
jge 0x140004a16
mov ecx, dword [rdx + 0x14]
mov r10d, ebx
mov eax, dword [0x1400d1090]
mov r9d, ebx
add eax, 0x73137
xor r10d, 0x14e1
imul ecx, eax
xor r9d, 0xe97
lea eax, [r12 + 0x254]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebp
mov dword [r11 - 0x48], r10d
mov dword [rdx + 0x14], ecx
mov edx, ebx
mov r8, qword [section..data]
lea ecx, [r13 - 0x9d]
xor edx, 0x151e
call fcn.140005f50
mov r14d, eax
jmp 0x140004a46
mov eax, dword [rdx + 0x8c]
mov r15d, esi
add eax, ebx
and eax, 0x1040
cmp esi, eax
jae 0x140004a46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rdi + 0x8c]
add r15d, 4
add eax, ebx
and eax, 0x1040
cmp r15d, eax
jb 0x140004a2a
mov eax, dword [rsp + 0x80]
add eax, 0xffffff48
cmp ebx, eax
jg 0x140004ade
lea eax, [rbp - 0x68]
cmp r13d, eax
je 0x140004b02
cmp dword [0x1400d1044], 0xc2a
jae 0x140004a7c
add dword [0x1400d1084], 0xfff2d3d1
mov eax, dword [rdi + 0x80]
lea r8d, [r14 + 0x36e]
mov ecx, dword [rdi + 0x98]
add eax, 0x84409
add ecx, eax
mov edx, esi
xor dword [0x1400d1108], ecx
mov eax, esi
xor eax, 0x12d2
lea ecx, [rsi + 0x1040]
mov dword [rsp + 0x28], eax
xor ebx, 0x140b
xor edx, 0xfea
mov qword [rsp + 0x20], rdi
mov r9d, ebx
call fcn.1400020e8
mov ecx, dword [rdi + 0x10]
mov rax, qword [section..data]
xor ecx, 0xd050f
mov dword [rax + 0xe8], ecx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
lea eax, [rbp + 0x96a]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xec]
imul eax, r13d
cmp esi, eax
jne 0x140004ade
mov r8d, dword [rdi + 0xd0]
mov ecx, dword [0x1400d1024]
add ecx, 0xffffe898
mov dword [rsp + 0x80], r8d
add ecx, r12d
cmp r8d, ecx
jne 0x140004ade
movsxd r15, ebx
xor r15, rbp
mov eax, dword [rdi + 0x24]
mov r8d, ebx
mov edx, dword [rdx + 0xfc]
imul r10d, dword [rdi + 0x7c], 0xf23
mov ecx, dword [rdi + 0x84]
sub r8d, dword [rdi + 0xf4]
imul edx, r13d
add r8d, r12d
mov r9d, ebx
xor r9, rax
mov qword [rsp + 0x20], r10
mov eax, ebx
xor r9, 0x12d2
and rcx, rax
mov eax, dword [0x1400d1040]
sub edx, ebp
or rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rdi + 8]
mov ecx, esi
mov r8d, dword [rdi + 0x118]
add r9d, ebx
sub ecx, dword [0x1400d10fc]
or r8d, ebx
mov eax, r12d
or r8d, r14d
and r9, rax
mov qword [rsp + 0x20], r15
mov rax, qword [section..data]
sub ecx, ebx
mov edx, dword [rax + 0x6c]
mov eax, r12d
and rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x80]
mov ecx, dword [0x1400d1024]
inc edx
add ecx, 0xffffe898
mov dword [rsp + 0x80], edx
add ecx, r12d
cmp edx, ecx
jne 0x140004ade
mov rdx, qword [section..data]
jmp 0x140004b40
Function at 0x140005f50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov edi, dword [rsp + 0x78]
lea ebp, [rdx - 0x30f]
mov r10d, dword [rsp + 0x80]
xor r9d, 0x95b
add r10d, 0xfffff5e0
mov rbx, r8
lea r8d, [rdx - 0x9d]
lea esi, [rdi - 0x9c3]
xor edi, 0x1a04
lea eax, [rdi - 0x387]
cmp r10d, eax
jg 0x1400060d6
lea eax, [rbp + 0x59b]
cmp r9d, eax
jg 0x140006004
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xf0]
cmp dword [rdx + 0x8c], eax
je 0x140005ff1
mov ecx, dword [rdx + 0xc8]
mov eax, dword [0x1400d109c]
sub ecx, dword [rdx + 0x98]
add eax, 0x10e1ce
add ecx, eax
mov dword [0x1400d109c], ecx
mov eax, dword [0x1400d1118]
mov ecx, dword [rbx + 0x24]
add eax, 0x179d5a
add ecx, eax
add dword [rdx + 0x1c], ecx
mov eax, r8d
xor eax, 0x1b6e
cmp ebp, eax
jle 0x140006028
mov eax, dword [rbx + 0x3c]
xor esi, 0x7cc
lea eax, [rax*2 + 0x124926]
mov dword [rbx + 0x3c], eax
jmp 0x1400060d6
mov eax, dword [rbx + 0xf4]
or eax, edi
cmp r9d, eax
jbe 0x1400060d6
mov rcx, qword [section..data]
mov eax, dword [rbx + 0xe8]
mov r14d, dword [0x1400d108c]
xor eax, ebp
sub eax, dword [rcx + 0x70]
cmp r14d, eax
jb 0x1400060d6
imul r12d, r8d, 0x7b4
or edi, r9d
movsxd r15, r8d
movsxd rax, r10d
or r15, rax
mov r10d, dword [rbx + 0x34]
imul r10d, dword [0x1400d10a8]
mov eax, dword [rbx + 0xf4]
mov r9d, dword [rbx + 0xec]
mov ecx, dword [rcx + 0x7c]
xor r9d, 0xf8a
mov r8d, dword [rbx + 0xc4]
or ecx, 0xfea
mov dword [rsp + 0x28], r10d
mov edx, r12d
or rdx, rax
mov qword [rsp + 0x20], rdx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rcx, qword [section..data]
add r14d, 4
mov eax, dword [rbx + 0xe8]
xor eax, ebp
sub eax, dword [rcx + 0x70]
cmp r14d, eax
jae 0x14000606a
mov rbx, qword [rsp + 0x50]
lea eax, [rsi + 0xb06]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180041b90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x180041bd2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x180041bda
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x180041beb
jmp 0x180041c02
xor r10d, r10d
jmp 0x180041c8d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x180041c02
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x180041c19
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x180041c39
add r11, r8
jmp 0x180041d6b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x180041d02
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180041cb0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x180041d20
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x180041d32
jmp 0x180041d4d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x180041d4d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x180041d67
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x18004fc40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x18004fe5d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x18008fb60]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x18004fcb0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x18008fb70]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x18004fdda
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x18004fdb0
movdqa xmm1, xmmword [0x18008fb70]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x18008fb80], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x18004fe7b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.18004f720
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180057ef0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x180057f90
jmp 0x180057f7f
jae 0x18005804f
cmp r8, 0x201
jae 0x180057f90
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x180057fe7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x180057fbf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.180079380
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x180058010
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1800580bb
mov r8d, r13d
cmp r12, r8
jne 0x180057f70
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800580ef
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x180057f7f
jmp 0x180057f90
cmp r14, r8
jb 0x180058109
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.18005c120
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1800580a4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.180006090
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x18005808f
jmp 0x1800580a4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_f21554f7f0ff447b803961c51acafde04553c1edlibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.18007a780
jmp 0x18005811e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.18007ab30
ud2
Function at 0x180058170
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x180058196
mov rdx, rax
add rsp, 0x70
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x20], rax
lea rax, [fcn.18005a330]
mov qword [rbp - 0x18], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x30], 0
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x50]
call fcn.18007a6c0
ud2
Function at 0x180059490
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x1800594a5
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1800594c0
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.180062650
Function at 0x180062650
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.180064800
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1800626b0
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1800650b0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x1800626bc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1800626e8
test rdi, rdi
je 0x180062714
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.180006090
xor eax, eax
jmp 0x1800626b3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x1800626b3
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.180006090
jmp 0x1800626b0
xor eax, eax
jmp 0x1800626b3

Function at 0x180062720
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.180064800
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x180062780
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1800650b0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x18006278c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x1800627b6
test rdi, rdi
je 0x1800627e2
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.180006090
xor eax, eax
jmp 0x180062783
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x180062783
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.180006090
jmp 0x180062780
xor eax, eax
jmp 0x180062783
Function at 0x1800627f0
Capabilities:
Move file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.180064800
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x180062866
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x48]
mov r8b, 1
call fcn.1800650b0
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
cmp rax, rbx
jne 0x180062877
mov rax, rdx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x30]
mov rdx, rdi
mov r8, rsi
call fcn.180064800
mov rax, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
cmp rax, rbx
je 0x1800628c8
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x48]
mov r8b, 1
call fcn.1800650b0
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x58]
cmp rdi, rbx
jne 0x1800628f1
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rax, rsi
test rdx, rdx
je 0x180062869
add rdx, rdx
mov r8d, 2
mov rsi, rax
call fcn.180006090
mov rax, rsi
jmp 0x180062869
mov rcx, qword [rbp - 0x18]
mov rbx, rcx
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
mov rdx, qword [rbp - 0x10]
je 0x18006294b
test rdi, rdi
je 0x18006292e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rsi, rdx
mov rdx, rdi
call fcn.180006090
mov rdx, rsi
test rdx, rdx
je 0x180062944
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.180006090
xor eax, eax
jmp 0x180062869
mov r14, rdx
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x18006297b
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.180006090
mov rax, rsi
mov rcx, rbx
mov rdx, r14
test rdx, rdx
jne 0x1800628d8
jmp 0x180062869
Function at 0x1800631b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x180096a40]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1800631e8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x18006323f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x18006324c
xor edx, edx
xor eax, eax
jmp 0x180063276
cmp eax, 0x103
je 0x180063280
test eax, eax
js 0x18006325f
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x180063276
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.18005bdc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.180055990
mov ecx, 7
int 0x29
ud2

Function at 0x1800632d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x180096a40]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x180063308
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x180063366
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x180063393
test eax, eax
js 0x180063372
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x180063389
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.18005bdc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.180055990
mov ecx, 7
int 0x29
ud2