joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046e60
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140046f44
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x140046ec6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x140046f5f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140030180
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140046f35

Function at 0x140049300
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.14000d350
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14004936a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14004bf00
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x14004bf5a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140030180
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x14004bfaf
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14004bfcc
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x14004bfe5
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x14004c0bb
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14004c0d2
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x14004bf34
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x14004bf34
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004c0bb
Function at 0x14004c0e0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov r10, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14004c178
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140052540
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14000cf60
test al, al
je 0x140052562
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140053ea0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064d74]
mov ecx, dword [0x1400644c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053f43
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x140053f1f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064d70]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x140053f06
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140030180
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064d74]
call fcn.14002f014
cmp dword [0x140064d74], 0xffffffff
jne 0x140053ee0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064d70], eax
lea rcx, [0x140064d74]
call fcn.14002efb4
jmp 0x140053ee0
Function at 0x1400c6450
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400c645d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400c646d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400c6455
lea eax, [rcx + 1]
jmp 0x1400c647b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400c648e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400c6474
sub eax, 3
jb 0x1400c64ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400c64fd
sar eax, 1
movsxd rbp, eax
jb 0x1400c64e4
jmp 0x1400c64bc
add ebx, ebx
jne 0x1400c64ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400c64e4
inc ecx
add ebx, ebx
jne 0x1400c64ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400c64e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400c64dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400c64cc
add ecx, 2
jmp 0x1400c64e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400c6412
jmp 0x1400c645d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x36a00
mov dl, 0x1e
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400c6549
cmp rsi, rcx
jae 0x1400c6551
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400c6530
cmp al, 0x8f
ja 0x1400c6530
cmp byte [rsi - 2], 0xf
je 0x1400c6536
sub al, 0xe8
cmp al, 1
ja 0x1400c651a
cmp rsi, rcx
jae 0x1400c6551
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400c6520
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400c6551
lodsb al, byte [rsi]
jmp 0x1400c6530
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xc1000]
mov eax, dword [rdi]
or eax, eax
je 0x1400c65ae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc6a74]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400c655e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400c65a8
mov qword [rbx], rax
add rbx, 8
jmp 0x1400c657e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400c65e8
cmp al, 0xef
ja 0x1400c65da
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400c65ba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400c65c9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400c663c
sub rsp, 0xffffffffffffff80
jmp 0x1400368e0
Function at 0x140001080
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x20], 4
mov rbx, rax
jl 0x140001176
mov r9, qword [rax + 8]
lea r8, [0x1400092e8]
lea rcx, [rsp + 0x28]
mov edx, 0xf
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x498], rdi
call section..text
mov r9, qword [rbx + 0x10]
lea r8, [0x1400092e8]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call section..text
mov r9, qword [rbx + 0x18]
lea r8, [0x1400092e8]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call section..text
lea rsi, [rsp + 0x28]
lea rdi, [0x1400092e0]
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
jne 0x140001146
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call sub.FirewallInstallHelper.dll_AddApplicationToExceptionListW
lea rsi, [rsp + 0x28]
lea rdi, str.remove
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
mov rdi, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
jne 0x140001176
lea rcx, [rsp + 0x50]
call sub.FirewallInstallHelper.dll_RemoveApplicationFromExceptionListW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001350
add rsp, 0x480
pop rbx
ret

Function at 0x140002803
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x14000136a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001366
repz ret
ror rcx, 0x10
jmp 0x14000275c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000d360]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000d458]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400027e1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000d360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002803
mov rax, qword [rsp + 0x88]
mov qword [0x14000d458], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000d3f8], rax
mov rax, qword [0x14000d458]
mov qword [0x14000d2d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000d3e0], rax
mov dword [0x14000d2c0], 0xc0000409
mov dword [0x14000d2c4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000c008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000d358], eax
mov ecx, 1
call fcn.140005fc8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400092f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000d358], 0
jne 0x14000288a
mov ecx, 1
call fcn.140005fc8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140002c64
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140002ad4

Function at 0x140006744
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003c10
xor ebx, ebx
cmp qword [0x14000e280], rbx
mov rdi, rax
jne 0x140006857
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000692e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000692e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000e280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000e288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000e290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000e2a0], rax
test rax, rax
je 0x14000684e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000e298], rax
jmp 0x14000685e
mov rax, qword [0x14000e298]
jmp 0x140006865
mov rax, qword [0x14000e298]
mov r11, qword [0x14000e2a0]
cmp rax, rdi
je 0x1400068cc
cmp r11, rdi
je 0x1400068cc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000e2a0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400068cc
test rax, rax
je 0x1400068cc
call rsi
test rax, rax
je 0x1400068c6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400068c6
test byte [rsp + 0x40], 1
jne 0x1400068cc
bts ebp, 0x15
jmp 0x14000690c
mov rcx, qword [0x14000e288]
cmp rcx, rdi
je 0x14000690c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000690c
call rax
mov rbx, rax
test rax, rax
je 0x14000690c
mov rcx, qword [0x14000e290]
cmp rcx, rdi
je 0x14000690c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000690c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000e280]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000692e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140006930
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001350
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140b61108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b6128f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b61139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6111f
add dl, dl
jne 0x140b61146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b611a6
xor eax, eax
add dl, dl
jne 0x140b61155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6125d
add dl, dl
jne 0x140b61166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b61173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b61180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6118d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b6119a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b6112e
mov eax, 1
add dl, dl
jne 0x140b611b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b611c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b611ab
sub eax, ebx
mov ebx, 1
jne 0x140b611fc
mov ecx, 1
add dl, dl
jne 0x140b611de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b611eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b611d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6112e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b61218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b61225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6120d
cmp eax, 0x7d00
jae 0x140b6124b
cmp eax, 0x500
jb 0x140b61246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6112e
cmp eax, 0x7f
ja 0x140b6124e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6112e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b61282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b6112e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140acbb30]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140acbb40]
mov dword [rax], 1
mov rax, qword [0x140acbb50]
mov dword [rax], 1
mov rax, qword [0x140acbb20]
mov dword [rax], 1
mov rax, qword [0x140acba00]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140acbb10]
mov dword [0x140ada00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140acbaf0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140acbad0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140acb9b0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x14000c660
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x14000c6b8
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x14000c6c4
lea rax, [0x14009f8ec]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, [0x140aac328]
call sym.core::option::unwrap_failed::hc0851016c6838662
mov qword [rsp + 0x30], 0
lea rdx, [0x140aad948]
lea r9, [0x140aad950]
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call dbg.assert_failed<i32, i32>
int3
Function at 0x14002b580
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x140aae328]
cmovne rdx, rcx
add rsp, 0x58
ret

Function at 0x14002c980
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor esi, esi
mov edi, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x14002ca10
jmp 0x14002c9ef
jae 0x14002cabe
cmp r8, 0x201
jae 0x14002ca10
mov r14d, 0x200
lea r15, [rsp + 0x98]
mov r12, r8
jmp 0x14002ca56
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x14002ca37
lea rcx, [rsp + 0x28]
mov rdx, rbx
call dbg.do_reserve_and_handle<core::mem::maybe_uninit::MaybeUninit<u16>, alloc::alloc::Global>
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp rsi, rdi
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rsp + 0x38], rbx
mov r13, rsi
mov r14, rbx
mov r15, qword [rsp + 0x48]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x14002ca7b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14002cb2b
mov r8d, ebp
cmp r12, r8
jne 0x14002c9e0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14002cb5a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14002c9ef
jmp 0x14002ca10
cmp r14, r8
jb 0x14002cb74
lea rcx, [rsp + 0x50]
mov rdx, r15
call dbg.from_wide
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14002cb14
mov rcx, qword [rsp + 0x30]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x14002cb01
jmp 0x14002cb14
lea rcx, [0x140aa9c58]
lea r8, [0x140aae578]
mov edx, 0x28
call dbg.panic
jmp 0x14002cb89
lea rax, [0x140aae560]
mov rcx, r8
mov rdx, r14
mov r8, rax
call dbg.slice_end_index_len_fail
ud2
Function at 0x14002cbc0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x70
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x14002cbd8
mov rdx, rax
add rsp, 0x70
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h80d056e31c2ff722]
mov qword [rsp + 0x38], rax
lea rax, [0x140aadb90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rdx, [0x140aadba0]
lea rcx, [rsp + 0x40]
call dbg.panic_fmt
ud2