joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401de700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14024e1b0]
test ecx, ecx
je 0x1401de7e0
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x1401de734
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1401de734
add rdi, 0x10
jmp 0x1401de7d6
mov ecx, dword [0x14024e1b0]
test ecx, ecx
je 0x1401de7f3
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1401de7d4
mov rsi, rax
test rax, rax
jne 0x1401de7a3
movzx eax, byte [0x14039c1d0]
mov ecx, 0x18
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x1401de816
mov rsi, rax
lea rax, [0x14024e198]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14024e1b0]
test ecx, ecx
je 0x1401de806
dec ecx
mov rdx, rsi
call fcn.140241dc0
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1401de7d6
test rcx, rcx
je 0x1401de7d6
lock dec qword [rcx]
jne 0x1401de7d6
call fcn.1401de0d0
jmp 0x1401de7d6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14024e198]
call fcn.1401de120
mov ecx, eax
jmp 0x1401de716
lea rcx, [0x14024e198]
call fcn.1401de120
mov ecx, eax
jmp 0x1401de744
lea rcx, [0x14024e198]
call fcn.1401de120
mov ecx, eax
jmp 0x1401de79b
mov ecx, 8
mov edx, 0x18
call fcn.14003eff0
int3

Function at 0x1401dedf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14024e1d0]
test ecx, ecx
je 0x1401dee8f
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x1401dee19
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1401dee7e
mov ecx, dword [0x14024e1d0]
test ecx, ecx
je 0x1401deea2
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1401dee84
mov rsi, rax
test rax, rax
jne 0x1401dee78
movzx eax, byte [0x14039c1d0]
mov ecx, 0x10
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x1401deec5
mov rsi, rax
lea rax, [0x14024e1b8]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x14024e1d0]
test ecx, ecx
je 0x1401deeb5
dec ecx
mov rdx, rsi
call fcn.140241dc0
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1401dee86
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14024e1b8]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dee05
lea rcx, [0x14024e1b8]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dee25
lea rcx, [0x14024e1b8]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dee70
mov ecx, 8
mov edx, 0x10
call fcn.14003eff0
int3
Function at 0x1401df430
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140318b10]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1401df4a1
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1401df4d7
test eax, eax
js 0x1401df4b2
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401df4ca
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140318b78]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401de520
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1401dd9e0
mov ecx, 7
int 0x29
ud2

Function at 0x1401dfac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14024e190]
test ecx, ecx
je 0x1401dfb7d
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x1401dfaf0
cmp qword [rax + 8], 0
je 0x1401dfaf0
add rax, 0x10
jmp 0x1401dfb77
mov ecx, dword [0x14024e190]
test ecx, ecx
je 0x1401dfb90
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1401dfb75
mov rsi, rax
test rax, rax
jne 0x1401dfb5b
movzx eax, byte [0x14039c1d0]
mov ecx, 0x20
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x1401dfbb3
mov rsi, rax
lea rax, [0x14024e178]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14024e190]
test ecx, ecx
je 0x1401dfba3
dec ecx
mov rdx, rsi
call fcn.140241dc0
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x1401dfb77
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14024e178]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dfad5
lea rcx, [0x14024e178]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dfb00
lea rcx, [0x14024e178]
call fcn.1401de120
mov ecx, eax
jmp 0x1401dfb53
mov ecx, 8
mov edx, 0x20
call fcn.14003eff0
int3
Function at 0x1401e3360
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.1401fbce0
mov rdi, rdx
test rax, rax
je 0x1401e33f4
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.1401dd940
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1401fbf30
cmp dword [rsp + 0x38], 2
jne 0x1401e3423
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1401e346f
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x1401e349b
lea rcx, [rsp + 0x88]
call fcn.1401dd940
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x1401e34f9
mov qword [rsp + 0x80], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1401e3575
mov rbx, qword [rsp + 0x80]
jmp 0x1401e34fb
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1401e3564
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x1401e3564
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x1401e35a1
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x1401e35a1
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1401dd940
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
jmp 0x1401e33e3
Function at 0x1401fc680
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.1401e0020
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
jne 0x1401fc6cf
lea rcx, [rsp + 0xb0]
call fcn.1401dd940
mov qword [rsi], rdi
jmp 0x1401fc8ab
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x1401fc760
jmp 0x1401fc73f
jae 0x1401fc807
cmp r8, 0x201
jae 0x1401fc760
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x1401fc7a7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x1401fc787
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1401e04a0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x1401fc7ce
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1401fc846
mov r8d, r15d
cmp r12, r8
jne 0x1401fc730
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401fc8db
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x1401fc73f
jmp 0x1401fc760
cmp rdi, r8
jb 0x1401fc8f5
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.1401e2240
movabs rdi, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x1401fc867
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x60], rdi
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x1401fc880
mov edx, 2
mov rcx, qword [rsp + 0x28]
call fcn.14001eca0
cmp qword [rsp + 0x60], rdi
jne 0x1401fc8c0
mov qword [rsi], rdi
lea rcx, [rsp + 0x68]
call fcn.1401dd940
cmp qword [rsp + 0x40], 0
je 0x1401fc8ab
mov edx, 2
mov rcx, qword [rsp + 0x30]
call fcn.14001eca0
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x1401fc89c
jmp 0x1401fc8ab
lea rcx, str.internal_error:_entered_unreachable_code_home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rustls_webpki_0.101.7_src_calendar.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400be6a0
jmp 0x1401fc90a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.1400be300
ud2
Function at 0x1401ff000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14024e230]
test ecx, ecx
je 0x1401ff0e0
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x1401ff034
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1401ff034
add rdi, 0x10
jmp 0x1401ff0d6
mov ecx, dword [0x14024e230]
test ecx, ecx
je 0x1401ff0f3
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1401ff0d4
mov rsi, rax
test rax, rax
jne 0x1401ff0a3
movzx eax, byte [0x14039c1d0]
mov ecx, 0x18
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x1401ff116
mov rsi, rax
lea rax, [0x14024e218]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14024e230]
test ecx, ecx
je 0x1401ff106
dec ecx
mov rdx, rsi
call fcn.140241dc0
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1401ff0d6
test rcx, rcx
je 0x1401ff0d6
lock dec qword [rcx]
jne 0x1401ff0d6
call fcn.1401ff130
jmp 0x1401ff0d6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14024e218]
call fcn.1401de120
mov ecx, eax
jmp 0x1401ff016
lea rcx, [0x14024e218]
call fcn.1401de120
mov ecx, eax
jmp 0x1401ff044
lea rcx, [0x14024e218]
call fcn.1401de120
mov ecx, eax
jmp 0x1401ff09b
mov ecx, 8
mov edx, 0x18
call fcn.14003eff0
int3
Function at 0x140200330
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x14039c1d0]
mov ecx, 0x10
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x1402003e8
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140200440]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x1402003db
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x1402003ba
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.14001eca0
mov edx, 8
mov rcx, rsi
call fcn.14001eca0
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.14003eff0
ud2

Function at 0x140200510
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x140200546
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1401fd180]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.1400bd510
ud2

Function at 0x140200740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14024e1f0]
test ecx, ecx
je 0x1402007df
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x140200769
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1402007ce
mov ecx, dword [0x14024e1f0]
test ecx, ecx
je 0x1402007f2
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1402007d4
mov rsi, rax
test rax, rax
jne 0x1402007c8
movzx eax, byte [0x14039c1d0]
mov ecx, 0x10
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x140200815
mov rsi, rax
lea rax, [0x14024e1d8]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x14024e1f0]
test ecx, ecx
je 0x140200805
dec ecx
mov rdx, rsi
call fcn.140241dc0
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1402007d6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14024e1d8]
call fcn.1401de120
mov ecx, eax
jmp 0x140200755
lea rcx, [0x14024e1d8]
call fcn.1401de120
mov ecx, eax
jmp 0x140200775
lea rcx, [0x14024e1d8]
call fcn.1401de120
mov ecx, eax
jmp 0x1402007c0
mov ecx, 8
mov edx, 0x10
call fcn.14003eff0
int3
Function at 0x1402055e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14024e210]
test ecx, ecx
je 0x14020568c
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x140205610
mov rsi, rax
cmp qword [rax + 8], 0
je 0x140205610
add rsi, 0x10
jmp 0x14020562d
mov ecx, dword [0x14024e210]
test ecx, ecx
je 0x14020569f
dec ecx
call fcn.140241db8
cmp rax, 1
jne 0x140205636
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rsi
ret
mov rsi, rax
test rax, rax
jne 0x1402056bc
movzx eax, byte [0x14039c1d0]
mov ecx, 0x18
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x14020570a
mov rsi, rax
lea rax, str.pW__
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14024e210]
test ecx, ecx
jne 0x1402056b2
lea rcx, str.pW__
call fcn.1401de120
mov ecx, eax
jmp 0x1402056b4
lea rcx, str.pW__
call fcn.1401de120
mov ecx, eax
jmp 0x1402055f5
lea rcx, str.pW__
call fcn.1401de120
mov ecx, eax
jmp 0x140205620
dec ecx
mov rdx, rsi
call fcn.140241dc0
call fcn.140200660
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x14020560a
test rcx, rcx
je 0x14020560a
lock dec qword [rcx]
jne 0x14020560a
lea rcx, [rsp + 0x28]
call fcn.140205720
jmp 0x14020560a
mov ecx, 8
mov edx, 0x18
call fcn.14003eff0
int3

Function at 0x140205820
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14024e250]
test ecx, ecx
je 0x140205919
dec ecx
call fcn.140241db8
cmp rax, 2
jb 0x140205850
cmp qword [rax + 8], 0
je 0x140205850
add rax, 0x10
jmp 0x140205913
mov ecx, dword [0x14024e250]
test ecx, ecx
je 0x14020592c
dec ecx
call fcn.140241db8
cmp rax, 1
je 0x1402058f3
mov rsi, rax
test rax, rax
jne 0x1402058c3
movzx eax, byte [0x14039c1d0]
mov ecx, 0x20
mov edx, 8
call fcn.14001ec10
test rax, rax
je 0x140205952
mov rsi, rax
lea rax, [0x14024e238]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14024e250]
test ecx, ecx
je 0x14020593f
dec ecx
mov rdx, rsi
call fcn.140241dc0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1402058f7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1402058ff
xor eax, eax
jmp 0x140205913
call fcn.140200510
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14024e238]
call fcn.1401de120
mov ecx, eax
jmp 0x140205835
lea rcx, [0x14024e238]
call fcn.1401de120
mov ecx, eax
jmp 0x140205860
lea rcx, [0x14024e238]
call fcn.1401de120
mov ecx, eax
jmp 0x1402058bb
mov ecx, 8
mov edx, 0x20
call fcn.14003eff0
int3

Function at 0x140208547
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140208560
dec ecx
add rsp, 0x28
jmp fcn.140241db8
mov rcx, rax
call fcn.1401de120
mov ecx, eax
jmp 0x140208557
Function at 0x14020cca1
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14020cca8
test al, 1
je 0x14020ccc7
test al, 2
jne 0x14020ccdf
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x14031d008]
mov edx, 0x23
call fcn.1400be6a0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x14031d048]
mov edx, 0x25
call fcn.1400be6a0
int3

Function at 0x14020ddc9
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.14020c21c
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14020de04
xor eax, eax
jmp 0x14020de11
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x14020e065
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbp, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rdi, [rsp + 0x3a]
lea r15, [rdx + 0x18]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea r13, [rsp + 0x52]
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
mov rdx, qword [r14 + 0x10]
mov rcx, rsi
mov r8, rbx
call fcn.14020ddc1
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x14020e1d4
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x14020e1e2
mov dl, byte [rsp + 0x38]
movzx r8d, word [rdi + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rdi]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r15
lea rdx, str._home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_io_poll_evented.rs
call fcn.14020c23a
mov rcx, qword [r15]
mov rdx, rbp
mov r8d, r12d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x14020e1f4
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140087089
cmp al, 0xd
jne 0x14020e1a4
mov rax, qword [r15 + 8]
test rax, rax
je 0x14020e1a4
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x14020e226
mov r15, r14
mov r14, rbx
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400fe876
mov rbx, rax
xor ecx, ecx
call fcn.1400fcf71
test rbx, rbx
je 0x14020e199
mov ecx, 1
mov rdx, rsi
call fcn.1400fe99b
mov rsi, rbx
mov rbx, r14
mov r14, r15
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140207902
cmp al, 0xd
jne 0x14020e205
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.14020db8d
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.1402078a2
jmp 0x14020e0bb
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x14020e215
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x14020e215
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14020e215
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x14020e228
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xf0]
lea rbp, [rsp + 0x6a]
lea r15, [rdx + 0x18]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
cmove r15, rcx
mov r13d, 0xffffffff
cmp rax, r13
cmovb r13, rax
xorps xmm6, xmm6
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x40]
mov r8, rbx
mov r9b, 1
call fcn.14020dbf0
mov al, byte [rsp + 0x49]
cmp al, 3
je 0x14020e3b3
mov rcx, qword [rsp + 0x40]
cmp al, 2
je 0x14020e3c1
mov dl, byte [rsp + 0x48]
lea r9, [rsp + 0x4a]
movzx r8d, word [r9 + 4]
mov word [rbp + 4], r8w
mov r8d, dword [r9]
mov dword [rbp], r8d
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x69], al
mov rcx, r15
lea rdx, str._home_r3dlust_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.36.0_src_io_poll_evented.rs
call fcn.14020c23a
mov rcx, qword [r15]
and dword [rsp + 0x54], 0
movups xmmword [rsp + 0x28], xmm6
and dword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, r13d
lea r9, [rsp + 0x54]
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
jne 0x14020e3d3
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140087089
cmp al, 0xd
jne 0x14020e37d
mov rax, qword [r15 + 8]
test rax, rax
je 0x14020e37d
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x14020e41a
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400fe876
mov r12, rax
xor ecx, ecx
call fcn.1400fcf71
test r12, r12
je 0x14020e37d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], 1
mov ecx, 1
mov rdx, rsi
call fcn.1400fe99b
mov rsi, r12
jmp 0x14020e38b
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rsi
mov rcx, rsi
call fcn.140207902
cmp al, 0xd
jne 0x14020e3f1
mov rcx, r14
lea rdx, [rsp + 0x60]
call fcn.14020db8d
lea rcx, [rsp + 0x48]
call fcn.1402078a2
jmp 0x14020e27a
mov rax, qword [rsp + 0x58]
mov qword [rax], 2
jmp 0x14020e401
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x14020e401
mov eax, dword [rsp + 0x54]
and qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x58]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x14020e401
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
mov qword [rax + 8], rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x140215569
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14024e2c8]
test ecx, ecx
je 0x140215582
dec ecx
add rsp, 0x28
jmp fcn.140241db8
lea rcx, [0x14024e2b0]
call fcn.1401de120
mov ecx, eax
jmp 0x140215579