joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d3155
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
test di, 0x1af5
mov qword [rax + 0x10], rbp
test sil, r15b
jmp 0x1404d316e
mov qword [rax + 0x18], rsi
cmp r15w, 0x184f
jmp 0x1404d317d
mov qword [rax + 0x20], rdi
stc
jmp 0x1404d3189
push r14
cmp r13, 0x10882830
test r13d, esi
sub rsp, 0x40
jmp 0x1404d319e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
sal bl, 0x21
mov rbx, rax
test r15w, r11w
test rax, rax
je 0x1404d3323
mov rsi, rax
jmp 0x1404d31c5
cmp word [rax], r14w
jmp 0x1404d31ce
je 0x1404d3215
or rax, 0xffffffffffffffff
jmp 0x1404d31dd
inc rax
test dil, dil
cmp word [rsi + rax*2], r14w
jmp 0x1404d31ed
jne 0x1404d31dd
lea rsi, [rsi + rax*2]
stc
cmp bpl, bl
add rsi, 2
clc
jmp 0x1404d3206
cmp word [rsi], r14w
jmp 0x1404d320f
jne 0x1404d31d4
mov qword [rsp + 0x38], r14
shl r9d, 0x86
add r9, 0x6c5b47c5
btr r9, 0x1c
sub rsi, rbx
mov qword [rsp + 0x30], r14
sar r9w, cl
btc r8w, dx
add rsi, 2
jmp 0x1404d3247
sar rsi, 1
setne r8b
sub r8b, cl
ror r8b, 0xa
mov r8, rbx
mov r9d, esi
clc
jmp 0x1404d3261
mov dword [rsp + 0x28], r14d
xor edx, edx
stc
jmp 0x1404d326e
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1404c368a
movsxd rbp, eax
test eax, eax
jmp 0x1404d3284
je 0x1404d3323
mov rcx, rbp
jmp 0x1404d3292
call fcn.1404c35e2
mov rdi, rax
test bp, 0x3493
clc
test rax, rax
jmp 0x1404d32a8
je 0x1404d3302
mov qword [rsp + 0x38], r14
mov r9d, esi
movzx r8w, r14b
bsr r8, r12
movsx r8w, r15b
mov qword [rsp + 0x30], r14
jmp 0x1404d32ce
mov r8, rbx
clc
cmp ah, bl
mov dword [rsp + 0x28], ebp
cmp r9b, dil
sub edx, edx
cmc
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1404c368a
test eax, eax
je 0x1404d3302
mov rsi, rdi
mov rdi, r14
jmp 0x1404d32fd
jmp 0x1404d3311
mov rsi, r14
jmp 0x1404d3311
mov rcx, rdi
jmp 0x1404d3319
call fcn.1404c3583
jmp 0x1404d332b
mov rsi, r14
stc
cmp dl, sil
clc
test rbx, rbx
je 0x1404d3342
mov rcx, rbx
jmp 0x1404d333c
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
add rsi, 0x6a90269
sbb r14, 0x2eca0d1a
mov rsi, qword [rsp + 0x60]
not r14b
shld di, cx, 0x83
cmp r9b, 0xb2
mov rbp, qword [rsp + 0x58]
xchg r14w, di
sal r14w, cl
ror dil, 0x5c
mov rdi, qword [rsp + 0x68]
xor r14b, r8b
sar r14b, 0x57
movsx r14, r15w
add rsp, 0x40
movsx r14w, dl
movzx r14d, r13w
pop r14
jmp 0x1404d339e
ret
Function at 0x1404d339f
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
stc
cmp r12b, 0xed
clc
mov qword [rsp + 0x10], rbp
test r8b, 0xad
mov qword [rsp + 0x18], rsi
push rdi
cmp r9w, 0x2cbc
sub rsp, 0x20
jmp 0x1404d33c8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
cmp r14b, r13b
clc
jmp 0x1404d33dc
test rax, rax
jmp 0x1404d33e4
je 0x1404d34af
mov rbp, rax
cmp word [rax], si
jmp 0x1404d33f5
je 0x1404d3434
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d340c
jne 0x1404d33ff
lea rbp, [rbp + rax*2]
test r9d, 0x2bde68e4
cmp r8, r9
add rbp, 2
cmp word [rbp], si
jmp 0x1404d342e
jne 0x1404d33fb
sub rbp, rbx
mov rcx, rdi
add rbp, 2
sar rbp, 1
movsx cx, dl
add rbp, rbp
movzx cx, bl
movsx cx, r8b
movsxd rcx, r14d
mov rcx, rbp
jmp 0x1404d345c
call fcn.1404c35e2
mov rdi, rax
test cl, bpl
test rax, rax
jmp 0x1404d346f
je 0x1404d3495
mov r8, rbp
cdq
jmp 0x1404d347e
mov rdx, rbx
movzx rcx, si
mov rcx, rax
jmp 0x1404d348d
call fcn.14049d8a6
mov rsi, rdi
xor ecx, ecx
jmp 0x1404d349c
call fcn.1404c3583
mov rcx, rbx
jmp 0x1404d34a9
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
sub ebp, 0x6e0015e5
mov rsi, qword [rsp + 0x40]
movsx di, spl
bt bp, 0xf2
bsf ebp, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov di, dx
cmovle edi, esi
pop rdi
jmp 0x1404d34e4
ret
Function at 0x1404d63f3
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
bswap ax
not ah
push rdi
push r14
jmp 0x1404d6423
mov eax, 0x1450
call fcn.140442855
sub rsp, rax
movsx ebp, si
or ax, 0x31a1
mov rax, qword [0x1400b7288]
rcr si, cl
rcr si, 0x47
xor rax, rsp
movsx edi, dx
mov qword [rsp + 0x1440], rax
add dil, r14b
xchg r14b, bpl
movsxd r10, edx
bts rsi, r10
jmp 0x1404d6465
mov rdi, rcx
setns ch
bts rdx, r13
xadd dl, r14b
mov rax, r10
mov ebp, r9d
rol edx, cl
xor sil, 0xf0
adc sil, spl
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
neg si
add rbp, r8
and esi, 0x2b8614d0
mov rsi, r8
and r14d, 0x47ac5e6b
or dx, 0x6ed7
mov rax, qword [rcx + rax*8]
bts r14d, r15d
btr dx, 0x8b
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
cmp al, r8b
cmp r8b, 0x7f
sub eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
jmp 0x1404d64da
cmp r8, rbp
jmp 0x1404d64e2
jae 0x1404d65d8
lea rbx, [rsp + 0x40]
cmc
cmp rsi, rbp
jmp 0x1404d64f6
jae 0x1404d6550
mov al, byte [rsi]
jmp 0x1404d6503
inc rsi
stc
test r15, r13
cmp al, 0xa
jne 0x1404d6525
inc dword [rdi + 8]
jmp 0x1404d651a
mov byte [rbx], 0xd
jmp 0x1404d6522
inc rbx
mov byte [rbx], al
not ax
mov ax, r13w
inc rbx
xadd eax, eax
lea rax, [rsp + 0x143f]
cmc
jmp 0x1404d6542
cmp rbx, rax
jmp 0x1404d654a
jb 0x1404d64ee
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
mov r9b, r11b
setne r9b
movzx dx, r13b
lea r9, [rsp + 0x30]
movzx r8w, cl
cqo
movsx rcx, r9w
mov r8d, ebx
movzx rdx, si
movsx rdx, r11w
movzx dx, dil
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d6596
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d65a3
je 0x1404d65d0
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d65b7
jb 0x1404d65d8
cmp rsi, rbp
jmp 0x1404d65c5
jb 0x1404d64e8
jmp 0x1404d65d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
shr cx, cl
test edi, ecx
sub cx, dx
mov rcx, qword [rsp + 0x1440]
clc
test dl, 0xb
xor rcx, rsp
call fcn.140499d06
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx r14w, r13b
movsxd rsi, r14d
movsx r14, r14w
mov rbp, qword [r11 + 0x30]
movsx esi, di
mov rsp, r11
not dil
movsxd rsi, r11d
movsx r14, si
pop r14
pop rdi
pop rsi
ret
Function at 0x1404d6628
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx ax, r14b
push rsi
mov al, dil
movsx ax, r8b
movsx rax, r8w
push rdi
movsx rax, r8w
push r14
cdqe
movzx rax, bp
mov eax, 0x1450
jmp 0x1404d665b
call fcn.140442855
sub rsp, rax
cdqe
bt bp, 0x5c
shr r14b, cl
mov rax, qword [0x1400b7288]
cmp si, 0x5c70
xor rax, rsp
dec r14w
jmp 0x1404d6685
mov qword [rsp + 0x1440], rax
movsxd r10, edx
rcr bpl, 0xfc
rcr di, cl
mov rdi, rcx
mov rax, r10
bsr cx, r8w
stc
mov ebp, r9d
xor dh, 0x92
sar dh, 0x4a
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
mov sil, 0x1a
bsr si, dx
bt rsi, r10
lea rbp, [rbp + r8]
bts dx, bp
mov rsi, r8
mov rax, qword [rcx + rax*8]
movsx rdx, r9w
test r11, rcx
lea rdx, [r10 + r10*8]
rol r14b, 0x11
clc
neg r14b
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test r8, r14
clc
cmp dil, r11b
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d6705
jae 0x1404d6834
lea rbx, [rsp + 0x40]
clc
cmp rsi, rbp
jmp 0x1404d6719
jae 0x1404d6785
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jmp 0x1404d672f
jne 0x1404d675f
add dword [rdi + 8], 2
btr rcx, rbp
xchg cx, cx
mov ecx, 0xd
clc
jmp 0x1404d674b
mov word [rbx], cx
add rbx, 2
cmp r9w, di
jmp 0x1404d675f
mov word [rbx], ax
bts eax, ebp
add rbx, 2
lea rax, [rsp + 0x143e]
cmc
jmp 0x1404d6777
cmp rbx, rax
jmp 0x1404d677f
jb 0x1404d6711
and qword [rsp + 0x20], 0
movsxd r9, r9d
dec ax
lea rax, [rsp + 0x40]
dec dl
sar r8, 0x91
movsx r9d, bp
sub rbx, rax
cmp sp, 0x47f8
lea r9, [rsp + 0x30]
shld r8, rax, 0xcb
bt cx, dx
sar rbx, 1
xadd cx, r8w
lea rdx, [rsp + 0x40]
neg r8w
add ebx, ebx
movsx rcx, r10w
mov r8w, 0x6d2c
mov rcx, r14
movsx r8w, r13b
mov r8w, r15w
mov r8d, ebx
jmp 0x1404d67e6
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d67f3
je 0x1404d6828
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
jmp 0x1404d6808
cmp eax, ebx
jmp 0x1404d680f
jb 0x1404d6834
cmp rsi, rbp
jmp 0x1404d681d
jb 0x1404d670b
jmp 0x1404d6834
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xadd ax, cx
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
cmc
stc
xor rcx, rsp
jmp 0x1404d6849
call fcn.140499d06
lea r11, [rsp + 0x1450]
mov rdi, rdi
not ebp
jmp 0x1404d6860
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
xchg dil, sil
pop rdi
movsx esi, r11w
movzx rsi, bx
movzx si, r14b
pop rsi
jmp 0x1404d6884
ret
Function at 0x1404da398
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sbb r8d, esi
shrd r9d, edx, 0xe1
cmp cx, 0x1468
push rdi
rcr bh, cl
sub rsp, 0x20
jmp 0x1404da3b6
mov rbx, rdx
mov r8b, 0x84
jmp 0x1404da3c1
lea r9, [0x1400c8ea8]
movsx edx, r14w
cqo
mov edi, ecx
lea rdx, [0x1400cf748]
movsx rcx, cx
cmovge r8w, di
mov cx, r8w
mov ecx, 3
bswap r8
not r8w
lea r8, [0x1400c8ea0]
jmp 0x1404da3fc
call fcn.1404da4fc
mov rdx, rbx
mov ecx, edi
test r10w, r14w
clc
test rax, 0x5cd233db
test rax, rax
jmp 0x1404da419
je 0x1404da42a
call qword [case.0x1404c5688.0]
jmp 0x1404da430
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add dil, dil
cmp dh, 0xc4
clc
add rsp, 0x20
bswap rdi
setb dil
pop rdi
jmp 0x1404da44d
ret
Function at 0x1404db6fa
Capabilities:
Encrypt data using speck

Disassembly:
mov qword [rsp + 0x10], rbx
test r12w, bx
test spl, 0x65
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sar bpl, 0x8b
cmc
bt r12w, r12w
push r14
push r15
btc r15w, sp
sub rsp, 0x20
inc r12b
rcr dil, 0x3f
mov rdi, qword [rdx]
sbb bpl, 0xa4
xor r13d, r13d
clc
rcl r14, cl
mov r12, r9
bts bp, r9w
rol r15w, 0x7e
mov rbp, r8
sbb r15, rsi
mov r14, rdx
bt r15w, r10w
sub r15w, ax
mov r15, rcx
cmc
test bpl, r14b
test rcx, rcx
je 0x1404db97c
mov rbx, rcx
clc
cmp r14b, r13b
test r8, r8
jmp 0x1404db77b
je 0x1404db8e3
cmp byte [rdi], r13b
jmp 0x1404db789
jne 0x1404db79a
mov r8d, 1
jmp 0x1404db7e1
cmp byte [rdi + 1], r13b
jmp 0x1404db7a3
jne 0x1404db7b9
mov r8d, 2
jmp 0x1404db7b4
jmp 0x1404db7e1
mov al, byte [rdi + 2]
bt dx, 0xba
movsxd rdx, eax
neg al
movzx ecx, r11w
movsx rcx, dx
sbb r8, r8
sete cl
neg r8
mov dl, r15b
add r8, 3
xchg r9b, dl
mov r9, r12
movzx rcx, r13w
cmovg dx, r14w
movsx rdx, si
lea rcx, [rsp + 0x50]
mov rdx, rdi
jmp 0x1404db7fe
call fcn.1404e05e8
mov rdx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404db80f
je 0x1404db912
test rax, rax
jmp 0x1404db81d
je 0x1404db8fc
mov ecx, dword [rsp + 0x50]
stc
cmc
cmp r12b, 0x1c
cmp ecx, 0xffff
jmp 0x1404db838
jbe 0x1404db8b4
cmp rbp, 1
jbe 0x1404db8e3
add ecx, 0xffff0000
mov r8d, 0xd800
bts eax, r12d
rcl ax, cl
mov eax, ecx
cmp r10b, 0x1a
jmp 0x1404db866
mov dword [rsp + 0x50], ecx
test r15, r10
test r13, 0x6f9e1aab
shr eax, 0xa
jmp 0x1404db87c
dec rbp
test r8w, r15w
or ax, r8w
cmp r10w, 0x2fc7
mov word [rbx], ax
test al, r9b
mov eax, 0x3ff
stc
and cx, ax
sub al, 0x98
add rbx, 2
mov eax, 0xdc00
jmp 0x1404db8ad
or cx, ax
stc
cmp dl, 0x85
mov word [rbx], cx
stc
jmp 0x1404db8bd
add rdi, rdx
test ax, cx
add rbx, 2
test rdi, 0x74dd259b
cmp bl, 0x34
cmp al, spl
sub rbp, 1
jmp 0x1404db8dd
jne 0x1404db781
sub rbx, r15
add al, r15b
mov qword [r14], rdi
sar rbx, 1
mov rax, rbx
jmp 0x1404db8f7
jmp 0x1404db93f
mov rdi, r13
jmp 0x1404db904
mov word [rbx], r13w
jmp 0x1404db90d
jmp 0x1404db8e3
mov qword [r14], rdi
jmp 0x1404db91a
call fcn.1404af716
mov dword [rax], 0x2a
movzx r12, sp
bts r15w, bp
or rax, 0xffffffffffffffff
xor di, ax
shl r14w, cl
xor ebp, 0x66f361ee
mov rbx, qword [rsp + 0x58]
movzx di, dl
neg rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
movzx r14d, bx
pop r15
pop r14
movsx r12, bp
bswap r12d
jmp 0x1404db968
pop r13
movzx rdi, r14w
movsx r12w, dil
pop r12
pop rdi
jmp 0x1404db97b
ret
mov rbx, r13
cmp dl, spl
stc
cmp byte [rdi], r13b
jmp 0x1404db98b
jne 0x1404db9a1
mov r8d, 1
jmp 0x1404db99c
jmp 0x1404db9e6
cmp byte [rdi + 1], r13b
jmp 0x1404db9aa
jne 0x1404db9c0
mov r8d, 2
jmp 0x1404db9bb
jmp 0x1404db9e6
mov al, byte [rdi + 2]
shl r9d, cl
neg al
sbb r8, r8
cmovs dx, cx
neg r8
bts r9, r10
add r8, 3
bsf r9d, r10d
sal dl, 0xda
movzx dx, r13b
mov r9, r12
sbb rdx, 0xca74f3c
test r11w, 0x4751
shr dh, cl
mov rdx, rdi
cmc
xor ecx, ecx
call fcn.1404e05e8
cmp rax, 0xffffffffffffffff
jmp 0x1404dba0c
je 0x1404db91a
test rax, rax
jmp 0x1404dba1a
je 0x1404db8ef
cmp rax, 4
jmp 0x1404dba29
jne 0x1404dba32
inc rbx
add rdi, rax
jmp 0x1404dba3a
inc rbx
jmp 0x1404dba42
jmp 0x1404db983
Function at 0x1404e0135
Capabilities:
Encrypt data using speck

Disassembly:
mov qword [rsp + 0x18], rbx
clc
push rbp
shrd ax, bp, 0xae
push rsi
cmp ch, 0x1b
push rdi
push r12
or bp, 0x30f1
rcr ax, 0xe2
push r13
ror r13d, 0x71
push r14
neg sil
cmovle si, ax
adc ah, 0x91
push r15
sub rsp, 0x40
and al, r11b
cdqe
and ah, 4
mov rax, qword [0x1400b7288]
test bp, 0x5d7c
xor si, 0x513e
xor rax, rsp
sbb r13, rsp
cmp r13b, 0x73
mov qword [rsp + 0x30], rax
mov rsi, qword [rdx]
ror rbp, 0x40
mov rbp, r9
shr r13d, cl
bts r14d, esp
mov qword [rsp + 0x20], r9
mov r13, r8
mov r14, rdx
movsx r15w, r8b
mov r15, rcx
test r12w, 0x2d12
test rcx, rcx
jmp 0x1404e01c3
je 0x1404e0304
mov rbx, rcx
jmp 0x1404e01d7
mov rdi, rsi
cmp r8, r13
dec dh
shr r12w, 0x23
movzx edx, word [rsi]
sub r8w, r13w
rol r8b, 0x53
movsx rcx, r10w
lea r12, [rsp + 0x28]
cmp r13, 4
xchg r8, rcx
movsx ecx, r10w
jmp 0x1404e0208
mov r8, rbp
cmovae r12, rbx
movzx cx, r14b
mov ch, 0x81
mov rcx, r12
jmp 0x1404e021f
call fcn.1404e1024
mov rbp, rax
cmc
cmp rax, 0x63e52593
cmp rax, 0xffffffffffffffff
jmp 0x1404e0238
je 0x1404e02f0
cmp r12, rbx
jmp 0x1404e0246
je 0x1404e0273
cmp r13, rax
jmp 0x1404e0254
jb 0x1404e02d6
mov r8, rax
mov rdx, r12
bswap cx
movsxd rcx, r14d
mov rcx, rbx
jmp 0x1404e026e
call fcn.14049d8a6
test rbp, rbp
jmp 0x1404e027b
je 0x1404e0298
lea rax, [rbx + rbp]
stc
cmp spl, r13b
cmp byte [rax - 1], 0
jmp 0x1404e0292
je 0x1404e02c0
add rsi, 2
stc
clc
test rbp, rbp
jmp 0x1404e02a6
cmovne rdi, rsi
stc
sub r13, rbp
add rbx, rbp
mov rbp, qword [rsp + 0x20]
jmp 0x1404e02bb
jmp 0x1404e01e4
sub edi, edi
sub bl, 0xcf
or bl, r8b
btr bx, bp
lea rbx, [rax - 1]
cmp r9w, 0x2848
sub rbx, r15
xchg al, al
mov qword [r14], rdi
cbw
movzx eax, cx
mov rax, rbx
jmp 0x1404e02eb
jmp 0x1404e037a
mov qword [r14], rdi
cmc
cmp esp, ebx
or rax, 0xffffffffffffffff
jmp 0x1404e02ff
jmp 0x1404e037a
xor ebx, ebx
movzx edx, word [rsi]
movzx ecx, r12w
bswap cx
cmovs r8w, si
lea rcx, [rsp + 0x28]
movsx r8d, bx
movzx r8w, bpl
mov r8, rbp
jmp 0x1404e032b
call fcn.1404e1024
cmp rax, 0xffffffffffffffff
je 0x1404e037a
test rax, rax
jmp 0x1404e0342
je 0x1404e0358
cmp byte [rsp + rax + 0x27], 0
jmp 0x1404e0352
je 0x1404e0369
add rbx, rax
add rsi, 2
jmp 0x1404e0364
jmp 0x1404e0306
dec rax
bts ecx, edi
xchg cx, cx
bt rcx, rdx
lea rax, [rax + rbx]
mov rcx, qword [rsp + 0x30]
cmc
xor rcx, rsp
jmp 0x1404e0388
call fcn.140499d06
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
movzx r12d, di
movzx bp, r9b
pop r15
mov bpl, 0xb4
bswap r13
jmp 0x1404e03af
pop r14
pop r13
mov bp, r14w
pop r12
movsx rbp, r11w
movzx di, bl
pop rdi
bswap bp
pop rsi
movsx ebp, ax
pop rbp
jmp 0x1404e03cf
ret
Function at 0x18000dca8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000dcd8
xor eax, eax
jmp 0x18000dd9b
mov rbp, rbx
cmp word [rax], si
je 0x18000dcfd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000dce4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000dce0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000dbf8
movsxd r14, eax
test eax, eax
jne 0x18000dd3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000dcd1
mov rcx, r14
call fcn.18000eb94
mov rdi, rax
test rax, rax
jne 0x18000dd54
xor ecx, ecx
call fcn.18000c53c
jmp 0x18000dd30
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000dbf8
test eax, eax
jne 0x18000dd85
mov rcx, rdi
call fcn.18000c53c
jmp 0x18000dd8f
xor ecx, ecx
call fcn.18000c53c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180016c4c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180016cc4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180016cc4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180016cc4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180016cb8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180016cd6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180016ca6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180016cc6

Function at 0x180017190
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800171b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800171b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140009d30
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140009d65
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140009d6a
call fcn.140021a40
mov ecx, dword [0x1400b4090]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
add rsp, 0x38
ret

Function at 0x14000c760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000c7f0
cmp r10, r11
jb 0x14000c866
cmp r10, rdx
ja 0x14000c87a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000c7f2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000c7d0
jmp 0x14000c854
ja 0x14000c7fa
mov r11, r10
cmp rax, r8
jne 0x14000c794
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000c830
mov rdi, r8
sub ecx, edx
jns 0x14000c84b
jmp 0x14000c856
cmp r8, rsi
je 0x14000c88b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000c856
xor al, 1
cmp rdi, rsi
jne 0x14000c810
jmp 0x14000c856
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140035e60
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140035c40
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valueinternal_error:_entered_unreachable_code_rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrary_alloc_src_vecmod.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140035c50
ud2
Function at 0x140011710
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140011752
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14001175a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001176b
jmp 0x140011782
xor r10d, r10d
jmp 0x14001180d
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140011782
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140011799
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400117b9
add r11, r8
jmp 0x1400118ea
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140011882
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140011830
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400118a0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400118b2
jmp 0x1400118cc
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400118cc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400118e6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret