joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a83d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1400229c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140022a50
cmp r10, r11
jb 0x140022ac6
cmp r10, rdx
ja 0x140022ada
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140022a52
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140022a30
jmp 0x140022ab4
ja 0x140022a5a
mov r11, r10
cmp rax, r8
jne 0x1400229f4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140022a90
mov rdi, r8
sub ecx, edx
jns 0x140022aab
jmp 0x140022ab6
cmp r8, rsi
je 0x140022aeb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140022ab6
xor al, 1
cmp rdi, rsi
jne 0x140022a70
jmp 0x140022ab6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14013fb20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14013f820
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_std_src_threadmod.rs_R
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14013f8a0
ud2

Function at 0x14002c3c0
Capabilities:
Hash data using fnv

Disassembly:
push rax
mov qword [rsp], rcx
mov rax, qword [rdx]
xor ecx, ecx
movabs r8, 0x100000001b3
cmp rcx, 8
je 0x14002c3eb
movzx r9d, byte [rsp + rcx]
inc rcx
xor rax, r9
imul rax, r8
jmp 0x14002c3d4
mov qword [rdx], rax
pop rax
ret
Function at 0x1400353fa
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140037a67
test rax, rax
je 0x140035432
mov edx, 4
mov rcx, rax
call fcn.140012720
jmp 0x14003546b
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.14003485d
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.1400348dd
Function at 0x140037a67
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test r12, r12
je 0x140037afa
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x140037a94
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x140037a94
xor ebx, 0x80000000
je 0x140037afa
mov al, byte [0x14017d5d8]
mov ecx, 4
mov edx, 4
call fcn.140012690
test rax, rax
je 0x140037b0d
mov dword [rax], ebx
jmp 0x140037afc
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.14013f5c0
ud2
Function at 0x14003f070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14003f0cb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14003f0cb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14003f0e6
cmp eax, 0x42
jne 0x14003f0cb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14003f196
cmp byte [r9 + r11], 0x5f
jne 0x14003f196
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14003f1fe
mov rcx, rsi
xor edx, edx
call fcn.14003a920
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14003a920
test al, al
jne 0x14003f291
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f122
lea rdx, [0x14014c41a]
mov r8d, 1
call fcn.14001f720
test al, al
jne 0x14003f291
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14003f0da
xor r14d, r14d
lea rbx, [0x14014c7fe]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14003f154
cmp byte [rax + rcx], 0x45
je 0x14003f2b3
sub r14, 1
jb 0x14003f179
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f179
mov r8d, 2
mov rdx, rbx
call fcn.14001f720
test al, al
jne 0x14003f291
mov rcx, rsi
call fcn.14003f2d0
test al, al
jne 0x14003f291
mov rax, qword [rsi]
test rax, rax
jne 0x14003f140
jmp 0x14003f0da
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14003f258
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14003f1f2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14003f1dc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14003f1cb
add dl, 0xa9
jmp 0x14003f1da
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14003f258
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14003f258
movzx edx, bl
add rax, rdx
jae 0x14003f1a0
jmp 0x14003f258
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14003f258
cmp rax, rcx
jae 0x14003f255
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14003f2ab
cmp qword [rsi + 0x20], 0
je 0x14003f2bf
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14003f070
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14003f0dc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f299
lea rax, [0x14014c7c9]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14001f720
test al, al
je 0x14003f299
mov dil, 2
jmp 0x14003f0da
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14003f0da
mov dil, 1
xor r8d, r8d
jmp 0x14003f25a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14003f0da
xor edi, edi
jmp 0x14003f0da
Function at 0x140049640
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140153890]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400496b3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400496ea
test eax, eax
js 0x1400496c4
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400496dd
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1401538f0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400482a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140048340
mov ecx, 7
int 0x29
ud2
Function at 0x14004ab10
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x14004aba0
jmp 0x14004ab8f
jae 0x14004ac5e
cmp r8, 0x201
jae 0x14004aba0
lea r15, [rbp - 0x58]
mov r12d, 0x200
mov r13, r8
jmp 0x14004abf8
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x14004abcf
lea rcx, [rbp + 0x3c8]
mov rdx, r14
call fcn.140141a40
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x3d8], r14
mov rbx, rdi
mov r15, qword [rbp + 0x3e8]
mov r12, r14
mov r13, r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r13d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x14004ac1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004acbd
mov r8d, esi
cmp r13, r8
jne 0x14004ab80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14004ace0
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14004ab8f
jmp 0x14004aba0
cmp r12, r8
jb 0x14004acfa
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14004b660
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3e0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x14004aca8
mov edx, 2
mov rcx, qword [rbp + 0x3e8]
call fcn.140012720
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e0]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x14004ac97
jmp 0x14004aca8
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14013f8a0
jmp 0x14004ad0f
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.14013f820
ud2
Function at 0x14004cab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14004cae0
test ecx, ecx
jne 0x14004cb30
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14004caec
test ecx, ecx
jne 0x14004cb30
mov rcx, rdi
call fcn.14004c990
movzx eax, al
test bpl, bpl
jne 0x14004cb37
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x14004cb23.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x14004cca8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x14004cb23.2
xor eax, eax
test bpl, bpl
je 0x14004cafc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14004cc89
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14004cb6a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x14004cbe9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x14004cbb0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14004cbcb
inc rax
dec rdi
cmp rax, 1
jne 0x14004cb90
jmp 0x14004cbe9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14004cbcb
cmp ebx, 0x5c
je 0x14004cbcb
inc rax
dec rdi
cmp rax, 1
jne 0x14004cbb0
jmp 0x14004cbe9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x14004cc97
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x14004cc13
mov al, 9
cmp rdx, 2
je 0x14004cc17
cmp rdx, 1
jne 0x14004cc27
cmp byte [r8], 0x2e
jne 0x14004cc27
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14004cc27
mov al, 0xa
jmp 0x14004cc27
cmp byte [r8], 0x2e
jne 0x14004cc27
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x14004cb23.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x14004cb23.2
mov ecx, 2
jmp case.0x14004cb23.2
lea r8, str.library_std_srcpath.rs
call fcn.14013f7a0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14013f7a0
ud2
Function at 0x14004d1a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.14004a0e0
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x14004d326
mov qword [rbp + 0x3c8], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3f0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f8], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14004d260
jmp 0x14004d24f
jae 0x14004d338
cmp r8, 0x201
jae 0x14004d260
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x14004d2b8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14004d28f
lea rcx, [rbp + 0x3f0]
mov rdx, r13
call fcn.140141a40
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f8]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x400], r13
mov rbx, rdi
mov r12, qword [rbp + 0x418]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rbp + 0x410]
mov rdx, r12
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x14004d2e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004d36e
mov r8d, r14d
cmp r15, r8
jne 0x14004d240
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14004d411
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14004d24f
jmp 0x14004d260
lea rcx, [rbp - 0x50]
call fcn.140047830
mov byte [rsi + 0x18], 2
jmp 0x14004d3db
cmp rsi, r8
jb 0x14004d42b
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.14004b660
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3e0], xmm1
movaps xmmword [rbp + 0x3d0], xmm0
jmp 0x14004d38a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3d0], rax
mov byte [rbp + 0x3e8], 2
test rdi, rdi
mov rsi, qword [rbp + 0x3c8]
je 0x14004d3a7
mov edx, 2
mov rcx, qword [rbp + 0x418]
call fcn.140012720
cmp byte [rbp + 0x3e8], 2
jne 0x14004d3f0
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3d0]
call fcn.140047830
cmp qword [rbp + 0x408], 0
je 0x14004d3db
mov edx, 2
mov rcx, qword [rbp + 0x410]
call fcn.140012720
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmm1, xmmword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x408], 0
jne 0x14004d3ca
jmp 0x14004d3db
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14013f8a0
jmp 0x14004d440
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14013f820
ud2
Function at 0x14004fe30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140153890]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14004fe9c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14004feab
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14004fee3
cmp eax, 0x103
je 0x14004feed
test eax, eax
js 0x14004fec8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14004fee3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1401538f0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400482a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140048340
mov ecx, 7
int 0x29
ud2
Function at 0x1400512e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x14005133c
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x140051430
test r15w, r15w
je 0x14005133c
cmp r15w, 0x2e
jne 0x140051430
test r12w, r12w
jne 0x140051430
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140051415
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140051391
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x140051415
cmp word [rsp + 0xac], 0x2e
jne 0x1400513ba
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x140051380
cmp ax, 0x2e
jne 0x1400513ba
cmp word [rsp + 0xb0], 0
je 0x140051380
lock inc qword [r14]
jle 0x140051519
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x14005145b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400514a7
mov qword [rsi], 0
jmp 0x140051507
lock inc qword [r14]
jle 0x140051519
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400514ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2

Function at 0x1400524e0
Capabilities:
Create directory

Disassembly:
test cl, cl
je 0x1400524ef
mov rcx, rdx
mov rdx, r8
jmp fcn.1400525b0
mov rcx, rdx
mov rdx, r8
jmp fcn.140052500
Function at 0x140052500
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14004a0e0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x1400525a5
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.14004ff60
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1400525a5
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140052580
test rsi, rsi
je 0x14005257c
mov edx, 2
mov rcx, rdi
call fcn.140012720
xor esi, esi
jmp 0x1400525a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1400525a2
mov edx, 2
mov rcx, rdi
call fcn.140012720
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005db10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14004a0e0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x14005db86
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14005da00
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14005db94
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005dbb4
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x14005dba5
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
call fcn.140047830
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x14005dba5
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140012720