joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400614f0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r9
call fcn.1400acfa0
cmp eax, 0x52474220
jne 0x140061696
xor ecx, ecx
call fcn.1400b13f0
test rax, rax
je 0x140061758
mov r14, rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x4001a
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x4001a
mov r9, rax
call fcn.1400b0bb0
test rax, rax
je 0x1400616a8
mov r12, rax
test rbx, rbx
je 0x1400616b7
movabs rax, 0x1555555555555555
cmp rbx, rax
ja 0x140061786
lea rax, [rbx + rbx]
lea rbp, [rax + rax*2]
movzx eax, byte [0x14019b098]
xor ecx, ecx
mov rdx, rbp
call fcn.1400a8e60
test rax, rax
je 0x14006178b
mov r13, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
cmp rbx, 2
jb 0x1400616de
lea rbp, [rbx - 1]
lea rdx, [rbx - 2]
mov eax, ebp
and eax, 7
mov rcx, r13
cmp rdx, 7
jb 0x140061661
mov rdx, rbp
and rdx, 0xfffffffffffffff8
mov rcx, r13
nop dword [rax + rax]
mov word [rcx + 4], 0
mov dword [rcx], 0
mov word [rcx + 0xa], 0
mov dword [rcx + 6], 0
mov word [rcx + 0x10], 0
mov dword [rcx + 0xc], 0
mov word [rcx + 0x16], 0
mov dword [rcx + 0x12], 0
mov word [rcx + 0x1c], 0
mov dword [rcx + 0x18], 0
mov word [rcx + 0x22], 0
mov dword [rcx + 0x1e], 0
mov word [rcx + 0x28], 0
mov dword [rcx + 0x24], 0
mov word [rcx + 0x2e], 0
mov dword [rcx + 0x2a], 0
add rcx, 0x30
add rdx, 0xfffffffffffffff8
jne 0x1400615f0
test rax, rax
je 0x140061685
nop word cs:[rax + rax]
mov word [rcx + 4], 0
mov dword [rcx], 0
add rcx, 6
dec rax
jne 0x140061670
mov rdx, r15
test rbx, rbx
je 0x140061753
mov r13, rcx
jmp 0x1400616e3
movabs rax, 0x8000000000000000
mov qword [rdi], rax
jmp 0x14006173b
movabs rax, 0x8000000000000000
mov qword [rdi], rax
jmp 0x140061733
mov rdx, r15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r13d, 2
xor r15d, r15d
xor ebp, ebp
jmp 0x1400616ff
mov rdx, r15
xor ebp, ebp
mov word [r13], 0
mov dword [r13 + 2], 0
inc rbp
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
cmp rbx, rbp
cmovae rbx, rbp
mov eax, 0xffffffff
cmp rbx, rax
cmovae rbx, rax
mov rcx, r12
mov r8, r13
mov r9d, ebx
call fcn.1400b0ca0
mov qword [rdi], r15
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], rbp
mov rcx, r12
call fcn.1400b0c10
mov rcx, r14
call fcn.1400acda0
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400acda0
xor r15d, r15d
jmp 0x1400616ff
mov byte [rsp + 0x40], 0
lea rax, [0x1400f0df0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f0738]
lea r8, [rsp + 0x40]
mov edx, 0x2b
call fcn.1400db5b0
call fcn.140002630
mov ecx, 2
mov rdx, rbp
call fcn.1400daf80
int3
Function at 0x140062900
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r9
call fcn.1400acfa0
cmp eax, 0x52474220
jne 0x140062aa6
xor ecx, ecx
call fcn.1400b13f0
test rax, rax
je 0x140062b68
mov r14, rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x4001a
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x40019
mov r9, rax
call fcn.1400b0bb0
test rax, rax
je 0x140062ab8
mov r12, rax
test rbx, rbx
je 0x140062ac7
movabs rax, 0x1555555555555555
cmp rbx, rax
ja 0x140062b96
lea rax, [rbx + rbx]
lea rbp, [rax + rax*2]
movzx eax, byte [0x14019b098]
xor ecx, ecx
mov rdx, rbp
call fcn.1400a8e60
test rax, rax
je 0x140062b9b
mov r13, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
cmp rbx, 2
jb 0x140062aee
lea rbp, [rbx - 1]
lea rdx, [rbx - 2]
mov eax, ebp
and eax, 7
mov rcx, r13
cmp rdx, 7
jb 0x140062a71
mov rdx, rbp
and rdx, 0xfffffffffffffff8
mov rcx, r13
nop dword [rax + rax]
mov word [rcx + 4], 0
mov dword [rcx], 0
mov word [rcx + 0xa], 0
mov dword [rcx + 6], 0
mov word [rcx + 0x10], 0
mov dword [rcx + 0xc], 0
mov word [rcx + 0x16], 0
mov dword [rcx + 0x12], 0
mov word [rcx + 0x1c], 0
mov dword [rcx + 0x18], 0
mov word [rcx + 0x22], 0
mov dword [rcx + 0x1e], 0
mov word [rcx + 0x28], 0
mov dword [rcx + 0x24], 0
mov word [rcx + 0x2e], 0
mov dword [rcx + 0x2a], 0
add rcx, 0x30
add rdx, 0xfffffffffffffff8
jne 0x140062a00
test rax, rax
je 0x140062a95
nop word cs:[rax + rax]
mov word [rcx + 4], 0
mov dword [rcx], 0
add rcx, 6
dec rax
jne 0x140062a80
mov rdx, r15
test rbx, rbx
je 0x140062b63
mov r13, rcx
jmp 0x140062af3
movabs rax, 0x8000000000000000
mov qword [rdi], rax
jmp 0x140062b4b
movabs rax, 0x8000000000000000
mov qword [rdi], rax
jmp 0x140062b43
mov rdx, r15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r13d, 2
xor r15d, r15d
xor ebp, ebp
jmp 0x140062b0f
mov rdx, r15
xor ebp, ebp
mov word [r13], 0
mov dword [r13 + 2], 0
inc rbp
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
cmp rbx, rbp
cmovae rbx, rbp
mov eax, 0xffffffff
cmp rbx, rax
cmovae rbx, rax
mov rcx, r12
mov r8, r13
mov r9d, ebx
call fcn.1400b0ca0
mov qword [rdi], r15
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], rbp
mov rcx, r12
call fcn.1400b0c10
mov rcx, r14
call fcn.1400acda0
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400acda0
xor r15d, r15d
jmp 0x140062b0f
mov byte [rsp + 0x40], 0
lea rax, [0x1400f0df0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f0738]
lea r8, [rsp + 0x40]
mov edx, 0x2b
call fcn.1400db5b0
call fcn.140002630
mov ecx, 2
mov rdx, rbp
call fcn.1400daf80
int3
Function at 0x140069aa0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r9
call fcn.1400acfa0
cmp eax, 0x434d594b
jne 0x140069c46
xor ecx, ecx
call fcn.1400b13f0
test rax, rax
je 0x140069d08
mov r14, rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x4001a
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x62021
mov r9, rax
call fcn.1400b0bb0
test rax, rax
je case.0x14004ab28.475
mov r12, rax
test rbx, rbx
je 0x140069c67
movabs rax, 0x1555555555555555
cmp rbx, rax
ja 0x140069d36
lea rax, [rbx + rbx]
lea rbp, [rax + rax*2]
movzx eax, byte [0x14019b098]
xor ecx, ecx
mov rdx, rbp
call fcn.1400a8e60
test rax, rax
je 0x140069d3b
mov r13, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
cmp rbx, 2
jb 0x140069c8e
lea rbp, [rbx - 1]
lea rdx, [rbx - 2]
movabs rax, 0x8000000000000000
mov rdx, r15
mov rdx, r15

Function at 0x14006caa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
Function at 0x140072840
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, rdx
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
mov rax, qword [0x14019b240]
test rax, rax
je 0x140072bb3
mov r12b, 1
test al, 2
je 0x14007288a
mov rax, qword [0x14019b240]
test rax, rax
je 0x140072be2
test eax, 0x400
sete r12b
mov rcx, qword [rsi]
sub rcx, rdi
mov rax, rdi
cmp rcx, 3
jbe 0x140072bc8
mov qword [rsp + 0x60], rdi
mov r13, qword [rsi + 8]
mov dword [r13 + rax], 0
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
add rbx, 4
mov qword [rsi + 0x10], rbx
mov rcx, rax
sub rcx, rbx
cmp rcx, 3
ja 0x14007295d
xor ebp, ebp
mov rcx, rbx
add rcx, 4
jb 0x140072992
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 9
mov r15d, 8
cmovae r15, rcx
mov rdx, r15
not rdx
shr rdx, 0x3f
test rax, rax
je 0x14007291a
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], rax
jmp 0x140072923
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
lea r9, [rsp + 0x30]
mov r8, r15
call fcn.14009dbd0
cmp qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x50]
je 0x140072953
movabs rcx, 0x8000000000000001
cmp rax, rcx
je 0x14007295d
jmp 0x140072992
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov r13, rax
mov dword [r13 + rbx], 0x534e5274
mov rbx, qword [rsi + 0x10]
add rbx, 4
mov qword [rsi + 0x10], rbx
mov ebp, 0x36b970cc
test r12b, r12b
jne 0x140072992
lea rdx, [0x140179808]
mov r8d, 4
xor ecx, ecx
call fcn.14000b8a0
mov ebp, eax
mov eax, dword [r14]
test rax, rax
je 0x140072a0d
cmp eax, 2
je 0x140072a8c
cmp eax, 3
jne 0x140072f26
mov rax, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
test rax, rax
sete cl
cmp rdx, 0x101
setae r8b
or r8b, cl
lea r15, [0x140180c38]
cmove r15, rax
jne 0x140072f26
test rdx, rdx
je 0x140072f26
lea r14, [rdx*4]
neg r14
mov rcx, rdx
cmp byte [r15 + rcx*4 - 1], 0xff
jne 0x140072b1c
dec rcx
add r14, 4
test rcx, rcx
jne 0x1400729f0
jmp 0x140072f26
cmp dword [r14 + 0x18], 0
je 0x140072f26
movzx r15d, word [r14 + 0x1c]
rol r15w, 8
mov word [rsp + 0x2c], r15w
mov rax, qword [rsi]
mov rcx, rax
sub rcx, rbx
cmp rcx, 1
ja 0x140072c7c
mov rcx, rbx
add rcx, 2
jb 0x140072f26
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 9
mov r14d, 8
cmovae r14, rcx
mov rdx, r14
not rdx
shr rdx, 0x3f
test rax, rax
je 0x140072bec
invalid
mov qword [rsp + 0x30], r13
cmp dword [r14 + 0x18], 0
je 0x140072f26
movzx edx, word [r14 + 0x20]
movzx edi, word [r14 + 0x24]
movzx eax, word [r14 + 0x1c]
rol ax, 8
mov word [rsp + 0x2c], ax
mov r15, qword [rsi]
mov rax, r15
sub rax, rbx
cmp rax, 1
ja 0x140072c93
mov rax, rbx
add rax, 2
jb 0x140072c64
mov word [rsp + 0x2e], dx
lea rcx, [r15 + r15]
cmp rcx, rax
cmova rax, rcx
cmp rax, 9
mov r14d, 8
or byte [rax], al
add byte [rax], al
cmp rcx, rdx
ja 0x140072fc3
neg r14
add r15, 3
jmp 0x140072b52
call fcn.1400e1dd0
mov r12b, 1
test al, 2
jne 0x140072871
jmp 0x14007288a
mov r8d, 4
mov rcx, rsi
mov rdx, rdi
call fcn.1400e1240
mov rax, qword [rsi + 0x10]
jmp 0x14007289d
call fcn.1400e1dd0
jmp 0x140072881
mov qword [rsp + 0x38], 0
Function at 0x1400797d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov r15, r9
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rsp + 0x100]
mov r14, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xf0]
movzx ecx, byte [rcx + 0x78]
mov r12, qword [rbx + 8]
mov r13, qword [rbx + 0x10]
mov byte [rsp + 0x4f], cl
mov byte [rsp + 0x30], cl
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov byte [rsp + 0x38], 0
mov rcx, r12
mov rdx, r13
mov r8, r9
mov r9, rdi
call fcn.140077fd0
test r13, r13
je 0x14007985f
mov eax, r13d
and eax, 7
cmp r13, 8
jae 0x140079863
xor ebp, ebp
xor ecx, ecx
jmp 0x1400798c0
xor ebp, ebp
jmp 0x1400798e0
and r13, 0xfffffffffffffff8
xor ebp, ebp
xor ecx, ecx
nop dword [rax + rax]
movzx edx, byte [r12 + rcx]
add rdx, rbp
movzx r8d, byte [r12 + rcx + 1]
movzx r9d, byte [r12 + rcx + 2]
add r9, r8
add r9, rdx
movzx edx, byte [r12 + rcx + 3]
movzx r8d, byte [r12 + rcx + 4]
add r8, rdx
movzx edx, byte [r12 + rcx + 5]
add rdx, r8
add rdx, r9
movzx r8d, byte [r12 + rcx + 6]
movzx ebp, byte [r12 + rcx + 7]
add rbp, r8
add rbp, rdx
add rcx, 8
cmp r13, rcx
jne 0x140079870
test rax, rax
je 0x1400798e0
add r12, rcx
xor ecx, ecx
nop word [rax + rax]
movzx edx, byte [r12 + rcx]
add rbp, rdx
inc rcx
cmp rax, rcx
jne 0x1400798d0
mov r12, qword [rbx + 0x20]
mov r13, qword [rbx + 0x28]
movzx eax, byte [rsp + 0x4f]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov byte [rsp + 0x38], 1
mov rcx, r12
mov rdx, r13
mov r8, r15
mov r9, rdi
call fcn.140077fd0
test r13, r13
mov qword [rsp + 0x68], rsi
je 0x14007992f
cmp r13, 4
jae 0x140079936
xor esi, esi
xor eax, eax
jmp 0x140079a42
xor esi, esi
jmp 0x140079a5c
mov rax, r13
and rax, 0xfffffffffffffffc
pxor xmm1, xmm1
xor ecx, ecx
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [rax + rax]
movzx edx, word [r12 + rcx]
movd xmm3, edx
movzx edx, word [r12 + rcx + 2]
movd xmm4, edx
pxor xmm5, xmm5
pcmpgtb xmm5, xmm3
pxor xmm6, xmm6
pcmpgtb xmm6, xmm4
pxor xmm5, xmm3
pxor xmm6, xmm4
punpcklbw xmm5, xmm1
punpcklwd xmm5, xmm1
punpckldq xmm5, xmm1
paddq xmm2, xmm5
punpcklbw xmm6, xmm1
punpcklwd xmm6, xmm1
punpckldq xmm6, xmm1
paddq xmm0, xmm6
add rcx, 4
cmp rax, rcx
jne 0x140079950
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rsi, xmm1
jmp 0x140079a57
Function at 0x14007f6c0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14007f6f5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14007f6fa
call fcn.1400a8970
mov ecx, dword [0x14019b338]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov byte [rcx + 0xe0], 1
mov qword [rcx + 0xe8], rax
mov qword [rcx + 0xf0], rdx
add rsp, 0x38
ret
Function at 0x1400897a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x30], rax
movzx eax, byte [rdx + 0x30]
mov byte [rsp + 0x27], al
movzx eax, byte [0x14019b098]
mov edx, 0x5f0
xor ecx, ecx
call fcn.1400a8e60
test rax, rax
je 0x1400899f9
mov rbx, rax
lea r15, [rsi + 0x38]
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
nop
mov ebp, 1
lock xadd qword [0x14019b080], rbp
mov r14, rbp
xor r14, rcx
lea r12, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r12
lea r13, [rax + r8]
rol rax, 0x15
add r14, r9
mov r12, r14
xor r12, r10
rol r14, 0x20
xor rbp, r13
add rbp, r12
rol r12, 0xd
xor r13, r11
xor r12, rbp
rol rbp, 0x20
xor r13, rax
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r13, rbp
xor r12, r14
rol r14, 0x20
xor rbp, r11
add rbp, r12
rol r12, 0xd
xor r12, rbp
rol rbp, 0x20
xor r14, 0xff
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r12, r14
rol r14, 0x20
xor r13, rbp
add rbp, r12
rol r12, 0xd
xor r12, rbp
rol rbp, 0x20
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r12, r14
rol r14, 0x20
xor r13, rbp
add rbp, r12
rol r12, 0xd
add r14, r13
rol r13, 0x10
xor r13, r14
rol r13, 0x15
xor r12, rbp
add r14, r12
rol r12, 0x11
mov rbp, r14
rol rbp, 0x20
xor rbp, r12
xor rbp, r13
xor rbp, r14
je 0x140089840
mov rax, qword [rsi + 0x58]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x138], rcx
movzx ecx, byte [rsp + 0x27]
mov byte [rdi + 0x140], cl
mov qword [rdi], 0
mov qword [rdi + 8], rbx
mov qword [rdi + 0x80], 0
mov qword [rdi + 0x88], rbx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x100], rcx
mov qword [rdi + 0x108], rbp
mov qword [rdi + 0x110], rax
mov rax, qword [rsi + 0x10]
shl rax, 1
test rax, rax
jne 0x1400899d5
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsi + 0x18]
mov rcx, qword [0x14019b1c8]
xor edx, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 8
mov edx, 0x5f0
call fcn.1400daf80
int3
Function at 0x140099530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140003500
cmp rax, rcx
je 0x140099555
cmp rdx, 4
jae 0x140099558
xor eax, eax
xor r8d, r8d
jmp 0x1400995f0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400e3540]
movdqa xmm3, xmmword [0x1400e3550]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140099580
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140099607
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400995f0
ret

Function at 0x14009e8e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140182ab0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14009e953
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14009e98a
test eax, eax
js 0x14009e964
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14009e97d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14009da20
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14009ce40
mov ecx, 7
int 0x29
ud2
Function at 0x1400a2cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx r9d, byte [rdx + 0x38]
movzx eax, byte [rdx + 0x3a]
test al, al
setne r8b
cmp r9b, 1
ja 0x1400a2d64
test al, al
jne 0x1400a2d49
movzx esi, byte [rdx + 0x10]
lea eax, [rsi - 5]
cmp al, 1
ja 0x1400a2d49
mov r10, qword [rdx]
mov rax, qword [rdx + 8]
xor r11d, r11d
test r9b, r9b
jne 0x1400a2d40
cmp sil, 6
je 0x1400a2d40
mov r11d, 2
cmp rax, 2
jb 0x1400a2f56
cmp r11, rax
jne 0x1400a2e97
xor eax, eax
xor r8d, r8d
xor eax, eax
xor r10d, r10d
add rax, r10
lea rsi, [r10 + r11]
inc rsi
cmp rsi, rax
sete al
movzx r10d, byte [r10 + r11]
test al, 1
jne 0x1400a2ecc
invalid
cmp r10b, 0x2e
jne 0x1400a2ecc
movzx eax, byte [rsi]
cmp al, 0x5c
sete r10b
cmp al, 0x2f
sete al
cmp r10b, 0x2e
sete r10b
and al, r10b
jmp 0x1400a2d4b

Function at 0x1400a3c60
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.14009f5b0
mov rax, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400a3cb6
lea rcx, [rbp - 0x50]
call fcn.14009cd40
mov qword [rsi], rdi
jmp 0x1400a3e9f
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x408], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3f8], 2
mov qword [rbp + 0x400], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400a3d40
jmp 0x1400a3d2f
jae 0x1400a3e07
cmp r8, 0x201
jae 0x1400a3d40
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400a3d98
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400a3d6f
lea rcx, [rbp + 0x3f0]
mov rdx, r12
call fcn.1400e1870
mov rdi, qword [rbp + 0x3f0]
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x418], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x400], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x418]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x1400a3dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a3ed5
mov r8d, r14d
cmp r15, r8
jne 0x1400a3d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a3f10
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400a3d2f
jmp 0x1400a3d40
cmp rsi, r8
jb case.0x1400943f5.697
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.internal_error:_entered_unreachable_code_rustc_7cf61ebde7b22796c69757901dd346d0fe70bd97library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
add eax, 0xdf55a

Function at 0x1400a5c30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
sub esp, 0xa8
Function at 0x1400a8660
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14019b098]
mov edx, 0x10
xor ecx, ecx
call fcn.1400a8e60
test rax, rax
je 0x1400a8753
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400a8810]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400a8745
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400a871e
cmp qword [rax + 0x10], 0x11
jae 0x1400a8707
mov r8, qword [rbp - 0x10]
jmp 0x1400a870f
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x14019b1c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x14019b1c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400daf80
ud2

Function at 0x1400a8970
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400a89b3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x1400a48a0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400db0d0
ud2