joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402665d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movdqa xmmword [rsp + 0x50], xmm6
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov r15d, 0x12
xor r13d, r13d
lea r14, [0x140387e60]
mov r12d, 0x12
jmp 0x14026661c
mov r12, r15
sub r15, r13
jbe 0x140266790
shr r15, 1
add r15, r13
mov rsi, r15
shl rsi, 5
mov rcx, qword [rsi + r14]
mov r8, qword [rsi + r14 + 8]
mov rbp, r8
sub rbp, rdi
cmovae r8, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne rbp, rax
xor eax, eax
test rbp, rbp
setne al
mov ecx, 0xff
cmovs eax, ecx
cmp al, 1
je 0x140266610
movzx eax, al
cmp eax, 0xff
jne 0x14026667d
inc r15
mov r13, r15
mov r15, r12
sub r15, r13
ja 0x14026661c
jmp 0x140266790
mov rdi, qword [rsi + r14 + 0x18]
test rdi, rdi
je 0x14026674c
js 0x14026684f
mov r14, qword [rsi + r14 + 0x10]
lea rbx, [rdi*8]
movzx eax, byte [0x1403ce430]
mov rcx, qword [0x1403cdf08]
test rcx, rcx
jne 0x1402666ca
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140266839
mov rcx, rax
mov qword [0x1403cdf08], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140266839
lea rcx, [r14 + rdi*8]
lea rdx, [rdi - 1]
movabs r9, 0x1fffffffffffffff
and r9, rdx
cmp r9, 9
jb 0x14026670f
cmp rax, rcx
jae 0x1402667b4
lea rdx, [rax + rdi*8]
cmp r14, rdx
jae 0x1402667b4
xor edx, edx
mov r8, r14
nop word cs:[rax + rax]
mov r9d, dword [r8]
mov r10d, dword [r8 + 4]
cmp r9d, r10d
mov r11d, r10d
cmovb r11d, r9d
cmova r10d, r9d
mov dword [rax + rdx*8], r11d
mov dword [rax + rdx*8 + 4], r10d
inc rdx
add r8, 8
cmp r8, rcx
jne 0x140266720
jmp 0x140266753
mov eax, 4
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x28]
call fcn.140260ef0
mov rax, qword [rsp + 0x28]
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
test rax, rax
je 0x140266790
movaps xmm0, xmmword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
movups xmmword [rcx + 8], xmm0
jmp 0x14026679b
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 8], 1
xor eax, eax
mov qword [rcx], rax
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
inc r9
mov rdx, r9
and rdx, 0xfffffffffffffffe
lea r8, [r14 + rdx*8]
xor r10d, r10d
movdqa xmm0, xmmword [0x1402f9750]
nop dword [rax]
movdqu xmm1, xmmword [r14 + r10*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + r10*8], xmm5
add r10, 2
cmp rdx, r10
jne 0x1402667d0
cmp r9, rdx
jne 0x140266720
jmp 0x140266753
shr rdi, 0x3a
not edi
and edi, 4
mov rcx, rdi
mov rdx, rbx
call fcn.1402e6e10
ud2
call fcn.1400f7020
ud2
Function at 0x14026ff60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14026ffbb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14026ffbb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14026ffd6
cmp eax, 0x42
jne 0x14026ffbb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140270086
cmp byte [r9 + r11], 0x5f
jne 0x140270086
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1402700ee
mov rcx, rsi
xor edx, edx
call fcn.14026b5a0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14026b5a0
test al, al
jne 0x140270181
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140270012
lea rdx, [0x14038d763]
mov r8d, 1
call fcn.140141730
test al, al
jne 0x140270181
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14026ffca
xor r14d, r14d
lea rbx, [0x14038e348]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140270044
cmp byte [rax + rcx], 0x45
je 0x1402701aa
sub r14, 1
jb 0x140270069
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140270069
mov r8d, 2
mov rdx, rbx
call fcn.140141730
test al, al
jne 0x140270181
mov rcx, rsi
call fcn.1402701c0
test al, al
jne 0x140270181
mov rax, qword [rsi]
test rax, rax
jne 0x140270030
jmp 0x14026ffca
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140270148
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x1402700e2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1402700cc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1402700bb
add dl, 0xa9
jmp 0x1402700ca
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140270148
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140270148
movzx edx, bl
add rax, rdx
jae 0x140270090
jmp 0x140270148
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140270148
cmp rax, rcx
jae 0x140270145
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x140270189
cmp qword [rsi + 0x20], 0
je 0x1402701b6
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14026ff60
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14026ffcc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140270198
lea rax, [0x14038db11]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.140141730
test al, al
je 0x140270198
mov dil, 2
jmp 0x14026ffca
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x140270153
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14026ffca
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14026ffca
xor edi, edi
jmp 0x14026ffca
Function at 0x140282370
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140282500
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea r14, [rcx + 0x28]
movzx r12d, byte [rcx + 0x68]
mov rax, qword [rcx + 0x20]
shl rax, 9
lea r15, [r12*8]
or r15, rax
mov byte [rcx + r12 + 0x28], 0x80
mov r8, r12
xor r8, 0x3f
je 0x14028254f
lea rcx, [r12 + r14]
inc rcx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
bswap r15
xor r12d, 0x38
cmp r12d, 8
jae 0x14028259d
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.140274f70
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r15
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rbx
jmp 0x1402825ad
mov qword [rbx + 0x60], r15
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.140274f70
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [0x14038e988]
movups xmmword [rbx], xmm2
movdqu xmm2, xmmword [0x14038e998]
movdqu xmmword [rbx + 0x10], xmm2
mov qword [rbx + 0x20], 0
mov byte [rbx + 0x68], 0
cmp rdi, 0x1f
jbe 0x140282647
pxor xmm2, xmm2
movdqa xmm3, xmm1
punpckhbw xmm3, xmm2
pshuflw xmm3, xmm3, 0x1b
pshufhw xmm3, xmm3, 0x1b
punpcklbw xmm1, xmm2
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm1, xmm3
movdqa xmm3, xmm0
punpckhbw xmm3, xmm2
pshuflw xmm3, xmm3, 0x1b
pshufhw xmm3, xmm3, 0x1b
punpcklbw xmm0, xmm2
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm3
movdqu xmmword [rsi], xmm0
movdqu xmmword [rsi + 0x10], xmm1
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_snow_0.9.3_src_resolversdefault.rs
mov ecx, 0x20
mov rdx, rdi
call fcn.1402ea400
ud2
Function at 0x140282c80
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea r14, [rcx + 0x50]
movzx r13d, byte [rcx + 0xd0]
mov rax, qword [rcx + 0x40]
mov r15, qword [rcx + 0x48]
shld r15, rax, 0xa
shl rax, 0xa
lea r12, [r13*8]
or r12, rax
mov byte [rcx + r13 + 0x50], 0x80
mov r8, r13
xor r8, 0x7f
je 0x140282ce0
lea rcx, [r14 + r13]
inc rcx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
bswap r12
bswap r15
xor r13d, 0x70
cmp r13d, 0x10
jae 0x140282d4a
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.1402781b0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r15
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rbx
jmp 0x140282d64
mov qword [rbx + 0xc0], r15
mov qword [rbx + 0xc8], r12
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.1402781b0
mov r14, qword [rbx]
mov r11, qword [rbx + 8]
mov r10, qword [rbx + 0x10]
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
movups xmm0, xmmword [0x14038e9a8]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [0x14038e9b8]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [0x14038e9c8]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [0x14038e9d8]
movups xmmword [rbx + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbx + 0x40], xmm0
mov byte [rbx + 0xd0], 0
cmp rdi, 0x3f
jbe 0x140282e11
bswap rax
bswap rcx
bswap rdx
bswap r8
bswap r9
bswap r10
bswap r11
bswap r14
mov qword [rsi], r14
mov qword [rsi + 8], r11
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r9
mov qword [rsi + 0x20], r8
mov qword [rsi + 0x28], rdx
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], rax
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_snow_0.9.3_src_resolversdefault.rs
mov ecx, 0x40
mov rdx, rdi
call fcn.1402ea400
ud2
Function at 0x140290db0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x140290e40
jmp 0x140290e2f
jae 0x140290efd
cmp r8, 0x201
jae 0x140290e40
lea r15, [rbp - 0x58]
mov r12d, 0x200
mov r13, r8
jmp 0x140290e98
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x140290e6f
lea rcx, [rbp + 0x3c8]
mov rdx, r14
call fcn.1402f2e40
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x3d8], r14
mov rbx, rdi
mov r15, qword [rbp + 0x3e8]
mov r12, r14
mov r13, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r13d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x140290ebf
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140290f61
mov r8d, esi
cmp r13, r8
jne 0x140290e20
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x140290f83
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x140290e2f
jmp 0x140290e40
cmp r12, r8
jb 0x140290f9d
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140291910
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3e0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x140290f4c
mov rcx, qword [0x1403cdf08]
xor edx, edx
mov r8, qword [rbp + 0x3e8]
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e0]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x140290f36
jmp 0x140290f4c
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1402ea480
jmp 0x140290fb2
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.1402ea400
ud2
Function at 0x140292ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140292f20
test ecx, ecx
jne 0x140292f70
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140292f2c
test ecx, ecx
jne 0x140292f70
mov rcx, rdi
call fcn.140292dd0
movzx eax, al
test bpl, bpl
jne 0x140292f77
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140292f63.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x1402930e8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140292f63.2
xor eax, eax
test bpl, bpl
je 0x140292f3c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1402930c9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140292faa
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140293029
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140292ff0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14029300b
inc rax
dec rdi
cmp rax, 1
jne 0x140292fd0
jmp 0x140293029
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14029300b
cmp ebx, 0x5c
je 0x14029300b
inc rax
dec rdi
cmp rax, 1
jne 0x140292ff0
jmp 0x140293029
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x1402930d7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140293053
mov al, 9
cmp rdx, 2
je 0x140293057
cmp rdx, 1
jne 0x140293067
cmp byte [r8], 0x2e
jne 0x140293067
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140293067
mov al, 0xa
jmp 0x140293067
cmp byte [r8], 0x2e
jne 0x140293067
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140292f63.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140292f63.2
mov ecx, 2
jmp case.0x140292f63.2
lea r8, str.library_std_srcpath.rs
call fcn.1402ea380
ud2
lea r8, str.library_std_srcpath.rs
call fcn.1402ea380
ud2
Function at 0x1402934e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.140290170
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x140293665
mov qword [rbp + 0x3c8], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3f0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f8], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1402935a0
jmp 0x14029358f
jae 0x140293677
cmp r8, 0x201
jae 0x1402935a0
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x1402935f8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1402935cf
lea rcx, [rbp + 0x3f0]
mov rdx, r13
call fcn.1402f2e40
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f8]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x400], r13
mov rbx, rdi
mov r12, qword [rbp + 0x418]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r12
mov r8d, r15d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140293627
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x14029373c
mov r8d, r14d
cmp r15, r8
jne 0x140293580
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x14029376c
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14029358f
jmp 0x1402935a0
lea rcx, [rbp - 0x50]
call fcn.14028d910
mov byte [rsi + 0x18], 2
jmp 0x140293706
cmp rsi, r8
jb 0x140293786
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140291910
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3e0], xmm1
movaps xmmword [rbp + 0x3d0], xmm0
test rdi, rdi
mov rsi, qword [rbp + 0x3c8]
je 0x1402936cd
mov rcx, qword [0x1403cdf08]
xor edx, edx
mov r8, qword [rbp + 0x418]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp byte [rbp + 0x3e8], 2
jne 0x14029371b
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3d0]
call fcn.14028d910
cmp qword [rbp + 0x408], 0
je 0x140293706
mov rcx, qword [0x1403cdf08]
xor edx, edx
mov r8, qword [rbp + 0x410]
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmm1, xmmword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x408], 0
jne 0x1402936f0
jmp 0x140293706
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3d0], rax
mov byte [rbp + 0x3e8], 2
test rdi, rdi
mov rsi, qword [rbp + 0x3c8]
jne 0x1402936b7
jmp 0x1402936cd
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1402ea480
jmp 0x14029379b
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1402ea400
ud2
Function at 0x140296c70
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140391c30]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140296cdc
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140296ceb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140296d23
cmp eax, 0x103
je 0x140296d2d
test eax, eax
js 0x140296d08
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140296d23
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x140391c98]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14028e340
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14028e3e0
mov ecx, 7
int 0x29
ud2
Function at 0x14029c450
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1403ce430]
mov rcx, qword [0x1403cdf08]
test rcx, rcx
jne 0x14029c49c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14029c569
mov rcx, rax
mov qword [0x1403cdf08], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14029c569
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14029c600]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14029c55b
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x14029c535
cmp qword [rax + 0x10], 0x11
jae 0x14029c51e
mov r8, qword [rbp - 0x20]
jmp 0x14029c526
mov r8, qword [rbp - 0x20]
mov r8, qword [r8 - 8]
mov rcx, qword [0x1403cdf08]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1403cdf08]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1402e6e10
ud2

Function at 0x14029c730
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14029c773
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.140294030]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1402ea2c0
ud2
Function at 0x1402a06b0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x1402a06db
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x1403cdf10]
cmp rax, 3
jne 0x1402a0860
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1402a0751
cmp word [rbx], 0
je 0x1402a07cb
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x1402a07e0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1402a076c
mov r14d, eax
cmp eax, 0x2726
jne 0x1402a084f
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1402a0846
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x1402a0729
call sub.kernel32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1402a084f
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r9w, 2
rol cx, 8
mov word [rsp + 0x30], r9w
mov word [rsp + 0x32], cx
mov dword [rsp + 0x34], eax
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1402a081f
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1402a06d0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1402a06d0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x1402a06c9
call fcn.1402f3d60
jmp 0x1402a06ec