joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140197650
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x1402556f8]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1401976e6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x140197713
test eax, eax
js 0x1401976f2
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x140197709
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, [0x140255760]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.140191160
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14018c530
mov ecx, 7
int 0x29
ud2

Function at 0x140197770
Capabilities:
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov edi, edx
cmp byte [rcx], 0
mov eax, 0x17
mov r14d, 2
cmovne r14d, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, r14d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140197850
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1401977d7
mov esi, eax
cmp eax, 0x2726
jne 0x140197843
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, r14d
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x14019783b
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x140197850
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x140197850
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140198200
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
invalid
dec dword [rcx + rcx*4 - 0x39]
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1402b5001]
mov ecx, 0x10
mov edx, 8
Function at 0x140199820
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov eax, dword [0x1402b5118]
cmp eax, 3
jne 0x14019994f
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x140199975
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.1401a5be0
test byte [rbp + 0x158], 1
je 0x1401998be
lea rax, [0x140254c10]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140199940
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140199921
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140199939
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1401b6470
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x140199875
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1401b64e0
jmp 0x140199940
Function at 0x140199ac0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140199b4a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 0x17
je 0x140199b5a
cmp ecx, 2
jne 0x140199b98
cmp eax, 0xf
jbe 0x140199bb2
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x140199ba8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x140199b9f
cmp eax, 0x1b
jbe 0x140199bca
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x140199ba8
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in___std_src_sys_common_net.rs
lea r8, [0x140256020]
mov edx, 0x39
call fcn.1401b76f0
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, [0x140256078]
mov edx, 0x3a
call fcn.1401b76f0
int3
Function at 0x1401afe00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401afe4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401afe4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401afe4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401afe4a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401afe4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401afe4c
xor al, al
add rsp, 0x28
ret

Function at 0x1401b64e0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1401a1550
mov rdx, qword [rbp - 0x28]
mov rax, rdx
neg rax
jno 0x1401b6562
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401b6592
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401b65a6
lea rax, [0x140254c10]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jae 0x1401b65c6
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.14000bc70
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401b65c6
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14000bc70
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140054850]
mov dword [rax], 1
mov rax, qword [0x140054860]
mov dword [rax], 1
mov rax, qword [0x140054870]
mov dword [rax], 1
mov rax, qword [0x1400547a0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001a7c0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140037550
sub rsp, rax
xor eax, eax
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.14002a5b0
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14001a819
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x140036230
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400477e0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400477e0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140036f02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14005d608]
test eax, eax
je 0x140036f9a
lea rax, [0x14005d5e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14005d610]
mov qword [rbp - 8], rax
jmp 0x140036f7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140036f72
cmp qword [rbp - 0x10], 0
je 0x140036f72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140036f38
lea rax, [0x14005d5e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140036f9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400370a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400370c8
mov eax, 0
jmp 0x140037116
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400370f1
mov eax, 0
jmp 0x140037116
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140037111
mov eax, 0
jmp 0x140037116
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14003711c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14003719a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140037191
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140037191
mov rax, qword [rbp - 8]
jmp 0x1400371af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140037164
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002399
Capabilities:
Get system information on windows

Disassembly:
mov edx, 0x10101
jmp fcn.1400c8282
Function at 0x14003191d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, dword [0x1400d51a0]
test esi, esi
je 0x1400319e6
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x1400319d9
je 0x1400319d7
test rbx, rbx
je 0x14003196c
mov al, byte [rbx]
and qword [rbx], 0
test al, 1
je 0x14003196c
mov r14, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
jmp 0x14003198b
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov edx, 0x10
mov rcx, rdi
call sub.bcryptprimitives.dll_ProcessPrng
mov r14, qword [rdi]
mov rbx, qword [rdi + 8]
mov al, byte [0x140124138]
mov edx, 0x18
xor ecx, ecx
call fcn.1400c3830
test rax, rax
je 0x1400319f9
mov rdi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov dword [rax + 0x10], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rbx, rbx
je 0x1400319d9
mov edx, 8
mov rcx, rbx
call fcn.14002a960
jmp 0x1400319d9
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400d5188]
call fcn.1400a0130
mov esi, eax
jmp 0x140031939
mov ecx, 8
mov edx, 0x18
call fcn.140029260
int3
xor ecx, ecx
jmp 0x14003191d

Function at 0x140036fc4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, dword [0x1400d5018]
test esi, esi
je 0x140037031
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x140037026
je 0x140037024
mov ecx, 0x20
call fcn.140040432
mov rdi, rax
and qword [rax], 0
mov byte [rax + 0x10], 3
mov dword [rax + 0x18], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rbx, rbx
je 0x140037026
mov rcx, rbx
call fcn.1400372b1
jmp 0x140037026
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, section..data
call fcn.1400a0130
mov esi, eax
jmp 0x140036fd7
Function at 0x1400377d2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, rcx
mov esi, dword [0x1400d5088]
test esi, esi
je 0x14003786e
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rax, 1
ja 0x140037863
je 0x140037861
test rdi, rdi
je 0x140037813
mov al, byte [rdi]
and qword [rdi], 0
test al, 1
je 0x140037813
mov rdi, qword [rdi + 8]
jmp 0x140037826
mov edi, 1
lock xadd qword [0x1400d5068], rdi
test rdi, rdi
je 0x140037881
mov ecx, 0x10
mov edx, 8
call fcn.140007895
mov rbx, rax
mov qword [rax], rdi
mov dword [rax + 8], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140037863
mov rcx, rdi
call fcn.14003f554
jmp 0x140037863
xor ebx, ebx
mov rax, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400d5070]
call fcn.1400a0130
mov esi, eax
jmp 0x1400377ec
lea rax, str.regex:_thread_ID_allocation_space_exhausted
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.9_src_util_pool.rs
call fcn.14002ac90
int3

Function at 0x14003d662
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400400e6
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [0x1400d51c0]
test esi, esi
je 0x140040174
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rax, 1
ja 0x140040167
je 0x140040127
test rdi, rdi
je 0x14004012b
mov r14, qword [rdi]
and qword [rdi], 0
test r14, r14
je 0x14004012e
mov r14, qword [rdi + 8]
jmp 0x14004012e
xor ebx, ebx
jmp 0x140040167
xor r14d, r14d
mov ecx, 0x10
mov edx, 8
call fcn.140007895
mov rbx, rax
mov qword [rax], r14
mov dword [rax + 8], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140040167
mov rcx, rdi
call fcn.14003f554
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400d51a8]
call fcn.1400a0130
mov esi, eax
jmp 0x1400400fe
Function at 0x14003fa27
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, dword [0x1400d5048]
test esi, esi
je 0x14003faa1
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x14003fa96
je 0x14003fa94
call fcn.140030f77
call fcn.1400314cf
mov rbx, rax
mov ecx, 0x10
mov edx, 8
call fcn.140007895
mov rdi, rax
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rbx, rbx
je 0x14003fa96
mov rcx, rbx
call fcn.1400311b3
jmp 0x14003fa96
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400d5030]
call fcn.1400a0130
mov esi, eax
jmp 0x14003fa3a

Function at 0x1400400e6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400400e6
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [0x1400d51c0]
test esi, esi
je 0x140040174
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rax, 1
ja 0x140040167
je 0x140040127
test rdi, rdi
je 0x14004012b
mov r14, qword [rdi]
and qword [rdi], 0
test r14, r14
je 0x14004012e
mov r14, qword [rdi + 8]
jmp 0x14004012e
xor ebx, ebx
jmp 0x140040167
xor r14d, r14d
mov ecx, 0x10
mov edx, 8
call fcn.140007895
mov rbx, rax
mov qword [rax], r14
mov dword [rax + 8], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140040167
mov rcx, rdi
call fcn.14003f554
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400d51a8]
call fcn.1400a0130
mov esi, eax
jmp 0x1400400fe
Function at 0x14005d4a2
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r14, r9
mov rdi, r8
mov r12, rdx
movabs r10, 0x100000001b3
mov rbx, qword [r9 + 8]
mov rsi, qword [r9 + 0x10]
lea rdx, [rsi*8]
movabs rax, 0xcbf29ce484222325
mov r8, rbx
test rdx, rdx
je 0x14005d516
movzx r11d, byte [r8 + 4]
xor rax, r11
imul rax, r10
movzx r11d, byte [r8 + 5]
xor r11, rax
mov eax, dword [r8]
add r8, 8
imul r11, r10
xor rax, r11
imul rax, r10
add rdx, 0xfffffffffffffff8
jmp 0x14005d4e5
mov r8, qword [rdi + 0x10]
test r8, r8
je 0x14005d66f
xor edx, edx
div r8
mov r13, rdx
mov rax, qword [rdi + 8]
mov rbp, rdx
shl rbp, 5
movzx edx, word [rax + rbp + 0x1c]
cmp dx, word [rdi + 0x20]
jne 0x14005d582
add rax, rbp
cmp qword [rax + 0x10], rsi
jne 0x14005d582
mov r10, qword [rax + 8]
xor edx, edx
cmp rsi, rdx
je 0x14005d65a
mov r8b, byte [r10 + rdx*8 + 4]
cmp r8b, byte [rbx + rdx*8 + 4]
jne 0x14005d582
mov r8b, byte [r10 + rdx*8 + 5]
cmp r8b, byte [rbx + rdx*8 + 5]
jne 0x14005d582
mov r8d, dword [r10 + rdx*8]
lea r11, [rdx + 1]
cmp r8d, dword [rbx + rdx*8]
mov rdx, r11
je 0x14005d550
mov r15, rcx
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r8, rsi
call fcn.140087ba5
lea rcx, [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rdx, r12
call fcn.1400638c9
movabs rcx, 0x8000000000000008
mov rax, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x40]
cmp rax, rcx
jne 0x14005d625
mov r14, qword [r14]
mov rdx, qword [rdi + 0x10]
cmp rdx, r13
jbe 0x14005d67d
movzx r13d, word [rdi + 0x20]
mov rdi, qword [rdi + 8]
mov rcx, qword [rdi + rbp]
mov rdx, qword [rdi + rbp + 8]
call fcn.140063462
mov qword [rdi + rbp], r14
mov qword [rdi + rbp + 8], rbx
mov qword [rdi + rbp + 0x10], rsi
mov dword [rdi + rbp + 0x18], r12d
mov word [rdi + rbp + 0x1c], r13w
mov dword [r15 + 8], r12d
movabs rax, 0x8000000000000008
mov qword [r15], rax
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x44]
lea rdi, [r15 + 0xc]
mov ecx, 0x1d
rep movsd dword [rdi], dword [rsi]
mov qword [r15], rax
mov dword [r15 + 8], r12d
mov rcx, qword [r14]
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140063462
mov eax, dword [rax + 0x18]
mov dword [rcx + 8], eax
movabs rax, 0x8000000000000008
mov qword [rcx], rax
jmp 0x14005d63c
lea rcx, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.9_src_nfa_thompson_map.rs
call fcn.1400303e0
jmp 0x14005d68c
lea r8, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.9_src_nfa_thompson_map.rs
mov rcx, r13
call fcn.14002ab00
ud2
Function at 0x14008eb13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, r8
call fcn.14008e8ae
add rbx, 8
lea rdx, [rsi + 8]
mov rcx, rbx
call fcn.14008e8ae
mov edx, 8
mov rcx, rsi
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14008eb52

Function at 0x14008eb52
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
shr r11, 1
mov r9, rdx
and r9, 0xfffffffffffffffe
lea rax, [rcx + r9]
lea r10, [rcx + r9]
add r10, 0xfffffffffffffffe
lea r9, [rcx + rdx*2]
add r9, 0xfffffffffffffffe
lea rsi, [r8 + rdx*2]
add rsi, 0xfffffffffffffffe
neg r11
xor edi, edi
cmp r11, rdi
je 0x14008ec0b
mov bl, byte [rax]
cmp bl, byte [rcx]
setb bl
jne 0x14008eba3
mov bl, byte [rax + 1]
cmp bl, byte [rcx + 1]
setb bl
mov r14, rax
test bl, bl
jne 0x14008ebad
mov r14, rcx
movzx ebp, word [r14]
mov word [r8], bp
mov bpl, byte [r9]
cmp bpl, byte [r10]
setb bpl
jne 0x14008ebcd
mov bpl, byte [r9 + 1]
cmp bpl, byte [r10 + 1]
setb bpl
mov r14, r10
test bpl, bpl
jne 0x14008ebd8
mov r14, r9
movzx r15d, bl
xor bl, 1
lea rax, [rax + r15*2]
movzx ebx, bl
lea rcx, [rcx + rbx*2]
add r8, 2
movzx ebx, word [r14]
mov word [rsi + rdi*2], bx
movzx ebx, bpl
add ebx, ebx
add r9, rbx
add r9, 0xfffffffffffffffe
sub r10, rbx
dec rdi
jmp 0x14008eb8c
add r10, 2
test dl, 1
je 0x14008ec39
xor edx, edx
xor r11d, r11d
cmp rcx, r10
setae dl
setb r11b
mov rsi, rax
cmovb rsi, rcx
movzx esi, word [rsi]
mov word [r8], si
lea rcx, [rcx + r11*2]
lea rax, [rax + rdx*2]
cmp rcx, r10
jne 0x14008ec54
add r9, 2
cmp rax, r9
jne 0x14008ec54
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14002ef60
int3

Function at 0x14009b060
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x14009b073
pop rbp
jmp fcn.14002f010
nop
pop rbp
jmp fcn.14002af60