joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e400
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
mov rax, qword [0x140110040]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 1
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xe0], rax
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], 0x400000
mov dword [rsp + 0x38], 2
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xd0]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x14009e575
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
lea rdx, str.NtMapViewOfSection_failed:_0x_X__Base__0x_IX__Offset__0x_IX__Size__0x_IX__n
lea rcx, [rsp + 0x80]
call fcn.14009e5a0
mov rcx, rax
call fcn.14009fe00
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
call fcn.140099b70
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400a30c0
add rsp, 0xf0
pop rdi
ret
Function at 0x14009f270
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x24], 1
lea rdx, str.Validating_remapped_image_protection._n
lea rcx, [rsp + 0x38]
call fcn.1400826c0
mov rcx, rax
call fcn.140083030
mov rcx, rax
call fcn.140099b70
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14009f30d
lea rdx, str.RtlImageNtHeader_failed.__BaseAddress__0x_IX__n
lea rcx, [rsp + 0x60]
call fcn.140099ed0
mov rcx, rax
call fcn.1400a0260
mov rdx, qword [rsp + 0x110]
mov rcx, rax
call fcn.140099b70
mov dword [rsp + 0x24], 0
jmp 0x14009f3e6
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x30], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x14009f33b
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x14009f3aa
movzx eax, word [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14009fc10
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14009f3a8
lea rdx, [0x1400fa6f0]
lea rcx, [rsp + 0x90]
call fcn.14009f400
mov rcx, rax
call fcn.14009fd90
mov rcx, rax
call fcn.140099b70
jmp 0x14009f3e6
jmp 0x14009f32e
mov rcx, qword [rsp + 0x110]
call fcn.14009fc10
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14009f3e6
lea rdx, str.RmppValidateRemappedPeSectionProtection_failed._n
lea rcx, [rsp + 0xc8]
call fcn.14009f400
mov rcx, rax
call fcn.14009fd90
mov rcx, rax
call fcn.140099b70
mov eax, dword [rsp + 0x24]
add rsp, 0x108
ret

Function at 0x1400a02d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp + 4], 0xffffffff
mov dword [rsp], 0
jmp 0x1400a02f6
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x1400a0332
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp]
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
mov edx, dword [rsp + 4]
xor edx, ecx
mov ecx, edx
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1400fa7e0]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400a02ee
mov eax, dword [rsp + 4]
not eax
add rsp, 0x18
ret
Function at 0x1400a03f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140110040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0xc], 0
je 0x1400a041a
xor eax, eax
jmp 0x1400a0581
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
and eax, 2
test eax, eax
je 0x1400a057f
mov edx, 8
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400a057f
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400a046c
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400a0476
mov eax, 2
jmp 0x1400a0581
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.imagehlp.dll_ImageNtHeader]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400a049b
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400a04a5
mov eax, 2
jmp 0x1400a0581
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov rcx, rax
call fcn.1400a06f0
mov qword [rsp + 0x38], 0
jmp 0x1400a04e6
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
cmp qword [rsp + 0x38], rax
jae 0x1400a057f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x1400a056c
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
and eax, 0x80000000
test eax, eax
jne 0x1400a056c
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
add rax, qword [rcx]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 8]
mov dword [rsp + 0x50], eax
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400a02d0
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.1400a0760
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov qword [rsp + 0x20], rax
jmp 0x1400a04d9
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a30c0
add rsp, 0x68
ret
Function at 0x1400b3f44
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400b3dd7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b3dd7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b3dd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b3dd7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b3dd7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b3dd7
cmp dword [rcx + 0xf8], 0
je 0x1400b3dd7
mov ecx, ebx
call fcn.1400b3e78
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400b3c68
cmp dword [rbp + 0x20], 0
je 0x1400b3e24
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400b3e2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400b3d70

Function at 0x1400c1acc
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400c1aa9
call fcn.1400b624c
mov dword [rax], 0x16
call fcn.1400a9d3c
or eax, 0xffffffff
jmp 0x1400c1ac6
sub dword [rcx + 0x10], 1
jns 0x1400c1ab8
add rsp, 0x28
jmp fcn.1400c18b0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400c1a88

Function at 0x1400c1bd4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400c1bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b61dc
or eax, 0xffffffff
jmp 0x1400c1bf6
xor eax, eax
add rsp, 0x28
ret
Function at 0x180008540
Capabilities:
Read file via mapping

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
add r8, rdx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], r8
mov word [rbp - 0x38], 0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x48]
call fcn.180008990
mov rdx, qword [rbp - 0x20]
cmp rdx, qword [rbp - 0x28]
jne 0x180008593
lea rcx, [rbp - 0x30]
call fcn.1800072c0
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x30]
mov word [rax + rdx*2], 0
inc qword [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1800085ef
mov rcx, qword [rbp - 0x30]
add rdx, rdx
mov r8d, 2
call fcn.180008430
cmp rbx, 0xffffffffffffffff
je 0x18000868b
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingW
mov rdi, rax
mov rcx, rbx
call fcn.18003275e
test rdi, rdi
je 0x18000868b
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
test rax, rax
je 0x1800086b2
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov r8d, 0x30
mov rcx, rax
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdi
mov qword [rsi], 0
jmp 0x1800086a3
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 8], rax
mov rcx, rdi
call fcn.18003275e
mov rax, qword [rbp + 8]
jmp 0x180008698

Function at 0x180008770
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
mov r8d, pe_nt_image_headers64
mov eax, 1
cmp rdx, 0x40
jb 0x18000886c
test cl, 3
je 0x180008797
mov r8d, 0x400
jmp 0x18000886c
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x180008866
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x18000878c
cmp r9d, 0x1000000
jbe 0x1800087c6
mov r8d, 0x700
jmp 0x18000886c
lea r11, [r9 + 0x78]
cmp r11, rdx
ja 0x18000886c
cmp dword [rcx + r9], 0x4550
jne 0x180008866
movzx esi, word [rcx + r9 + 0x18]
cmp esi, 0x20b
je 0x1800087f7
cmp esi, 0x10b
jne 0x180008866
mov edi, dword [rcx + r9 + 0x54]
cmp rdi, rdx
ja 0x18000886c
mov r10d, dword [rcx + r9 + 0x50]
cmp edi, r10d
ja 0x1800087bb
movzx esi, si
cmp esi, 0x10b
jne 0x180008872
mov esi, dword [rcx + r9 + 0x74]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x18000886c
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x1800087bb
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x18000886c
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x18000886c
mov r8d, 0x500
or rax, r8
pop rdi
pop rsi
ret
mov r8d, 0x600
jmp 0x18000886c
Function at 0x180008880
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
mov r8d, pe_nt_image_headers64
mov eax, 1
cmp rdx, 0x40
jb 0x180008982
test cl, 3
je 0x1800088a7
mov r8d, 0x400
jmp 0x180008982
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x18000897c
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x18000889c
cmp r9d, 0x1000000
jbe 0x1800088d6
mov r8d, 0x700
jmp 0x180008982
lea r11, [r9 + 0x88]
cmp r11, rdx
ja 0x180008982
cmp dword [rcx + r9], 0x4550
jne 0x18000897c
movzx esi, word [rcx + r9 + 0x18]
cmp esi, 0x20b
je 0x18000890a
cmp esi, 0x10b
jne 0x18000897c
mov edi, dword [rcx + r9 + 0x54]
cmp rdi, rdx
ja 0x180008982
mov r10d, dword [rcx + r9 + 0x50]
cmp edi, r10d
ja 0x1800088cb
movzx esi, si
cmp esi, 0x20b
jne 0x180008988
mov esi, dword [rcx + r9 + 0x84]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x180008982
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x1800088cb
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x180008982
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x180008982
mov r8d, 0x500
or rax, r8
pop rdi
pop rsi
ret
mov r8d, 0x600
jmp 0x180008982
Function at 0x18000ec20
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
sub rsp, 0x70
mov qword [rsp + 0x28], r9
cmp r9, 0xf
jae 0x18000ec8e
mov eax, 0x5545
bt eax, r9d
jae 0x18000ec8e
mov rsi, rcx
lea rax, [0x18003e420]
mov eax, dword [rax + r9*4]
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov rcx, rdx
mov rdx, r8
mov r8d, eax
call sub.KERNEL32.dll_VirtualProtect
mov ecx, 5
test eax, eax
jne 0x18000ec83
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov ecx, 3
mov dword [rsi], ecx
mov rax, rsi
add rsp, 0x70
pop rsi
ret
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [0x18000edd0]
mov qword [rsp + 0x38], rax
lea rax, str.internal_error:_entered_unreachable_code:_Protection:
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rdx, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_region_3.0.0_srcoswindows.rs
lea rcx, [rsp + 0x40]
call fcn.180034870
ud2
Function at 0x18001a160
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x18001a1f0
jmp 0x18001a1df
jae 0x18001a2b0
cmp r8, 0x201
jae 0x18001a1f0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x18001a248
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x18001a21f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.180033f40
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x18001a271
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001a318
mov r8d, r14d
cmp r15, r8
jne 0x18001a1d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001a33b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x18001a1df
jmp 0x18001a1f0
cmp rsi, r8
jb 0x18001a355
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.18001c480
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x18001a301
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.180008430
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x18001a2e9
jmp 0x18001a301
lea rcx, str.internal_error:_entered_unreachable_code_rustc_1fdfe1234795a289af1088aefa92ef80191cb611library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.180034940
jmp 0x18001a36a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.180034d90
ud2
Function at 0x18001a3c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.180022650
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x18001a546
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x18001a480
jmp 0x18001a46f
jae 0x18001a558
cmp r8, 0x201
jae 0x18001a480
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x18001a4d8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x18001a4af
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.180033f40
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x18001a507
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001a62b
mov r8d, esi
cmp r12, r8
jne 0x18001a460
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001a655
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x18001a46f
jmp 0x18001a480
lea rcx, [rbp - 0x58]
call fcn.1800177e0
mov byte [rsi + 0x18], 2
jmp 0x18001a5ea
cmp r15, r8
jb 0x18001a66f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.18001c480
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x18001a5a9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.180008430
cmp byte [rbp + 0x3d8], 2
jne 0x18001a601
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1800177e0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x18001a5ea
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.180008430
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x18001a5d5
jmp 0x18001a5ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x18001a591
jmp 0x18001a5a9
lea rcx, str.internal_error:_entered_unreachable_code_rustc_1fdfe1234795a289af1088aefa92ef80191cb611library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.180034940
jmp 0x18001a684
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.180034d90
ud2
Function at 0x180020530
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x180041180]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x180020574
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1800205d3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1800205e2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x18002061a
cmp eax, 0x103
je 0x180020624
test eax, eax
js 0x1800205ff
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x18002061a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.18001c260
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.180017b20
mov ecx, 7
int 0x29
ud2
Function at 0x180020690
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x180041180]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1800206d4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x18002073a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x180020771
test eax, eax
js 0x18002074b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x180020764
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.18001c260
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.180017b20
mov ecx, 7
int 0x29
ud2
Function at 0x18002eab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x18002eb2a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x18002eb20
cmp r11, r10
ja 0x18002ebc3
cmp r10, rdx
ja 0x18002ebd7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x18002eb22
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x18002eb00
jmp 0x18002eb97
ja 0x18002eb2a
mov r11, r10
cmp rax, r8
jne 0x18002ead2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x18002eb9b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x18002eb70
mov r8, r10
sub ecx, r9d
jns 0x18002eb8e
jmp 0x18002eb9d
cmp r10, rdx
je 0x18002eba9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x18002eb9d
xor al, 1
cmp r8, rdx
jne 0x18002eb50
jmp 0x18002eb9d
xor eax, eax
jmp 0x18002eb9d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x18004360b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.180034940
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.180034e10
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.180034d90
ud2