joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063ab0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140063ae1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140082908]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140082918]
lea rdx, [rdi + rdi]
call fcn.140002fd0
mov rax, qword [0x140082908]
lea r9, [rdi - 1]
mov qword [0x140082930], r9
mov qword [0x140082938], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140063c54
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140082918]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140063ba0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140063c15
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140063bdd
mov r10, qword [rdx]
cmp r10, rax
je 0x140063bd7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140063c15
cmp r9, rdx
je 0x140063bf1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140063c29
cmp r9, rdx
jne 0x140063be2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140063c4f
mov r9, qword [0x140082930]
jmp 0x140063b51
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140063c15
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140064cb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.140065950
mov qword [0x140082188], rax
test rax, rax
je 0x140064e6c
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140064d67
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140064d67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x33dac0e0
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140064d62
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140064d40
cmp r8d, 0x34e173ed
je 0x140064d6c
test r9d, r9d
jne 0x140064d20
mov rax, qword [rax]
jmp 0x140064cf0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x140082198]
mov rcx, qword [0x140082188]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140064e27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140064e27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x38dd0756
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140064e22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140064e00
cmp r8d, 0xb6297bc3
je 0x140064e2c
test r9d, r9d
jne 0x140064de0
mov rax, qword [rax]
jmp 0x140064db0
mov ecx, dword [rbx + 0x24]
lea r8, [0x140082198]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x140082188]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x1400820f1], 1
add rsp, 0x28
ret
Function at 0x140065950
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov dword [rsp + 0x40], ecx
movabs rdx, 0x342ee34b3c6b9b7d
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0xbd3b6a2e7b318db6
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140065a00
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x140065a32
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x48], di
jmp 0x140065a3c
lea r9, [rsp + 0x30]
call fcn.1400666f0
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140065ad6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140065ad6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xbec3fbcf
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140065ad1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140065ab0
cmp r8d, 0x5ea821fb
je 0x140065adb
test r9d, r9d
jne 0x140065a90
mov rax, qword [rax]
jmp 0x140065a60
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [0x1400655e0]
call r8
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140065b4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065b47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065b47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067894
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400675f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x140067030
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14006706a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006706f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400670b8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14006ba50]
cmp byte [rcx + rax], 0
je 0x1400670b8
dec r8
sub rdx, 1
jne 0x14006709e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400683a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400683ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400683ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400683ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400683ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400683ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400683f0
xor al, al
add rsp, 0x28
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14003e860]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rdi
xor eax, eax
lock cmpxchg qword [rbx], rsi
jne 0x1400011b0
mov rsi, qword [0x14003e870]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140044008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x14003e7d0]
mov rax, qword [rax]
test rax, rax
je 0x14000121f
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140035ef0
mov rcx, qword [0x14003e8f0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x14003e850]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140035d00
mov ebx, dword [0x140044028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r12, qword [0x140044020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r12 + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140044020], rbp
call fcn.140035b00
mov rax, qword [0x14003e7e0]
mov r8, qword [0x140044018]
mov ecx, dword [0x140044028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140044020]
call fcn.140002630
mov ecx, dword [0x14004400c]
mov dword [0x140044010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140044008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x14003e870]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011dd
mov ecx, 0x1f
call fcn.1400357f0
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011fc
mov rdx, qword [0x14003e890]
mov rcx, qword [0x14003e880]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001204
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001204
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140044010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x14003e8b0]
mov rcx, qword [0x14003e8a0]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f1
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
sub rsp, 0x28
mov rax, qword [0x14003e800]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret
Function at 0x140002630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x78
lea rbp, [rsp + 0x70]
call fcn.140035b00
lea rdx, [0x140010ca0]
xor ecx, ecx
call sub.KERNEL32.dll_AddVectoredExceptionHandler
mov dword [rbp - 0x40], 0x5000
lea rcx, [rbp - 0x40]
call sub.KERNEL32.dll_SetThreadStackGuarantee
call sub.KERNEL32.dll_GetCurrentThread
mov r8, qword [0x140037008]
lea rdx, str.main
mov rcx, rax
call r8
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x140002685
dec ecx
jmp 0x140002693
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1400026a2
call fcn.140010e40
mov rsi, rax
movzx eax, byte [0x140044030]
mov ecx, 0x38
call fcn.1400320b0
test rax, rax
je 0x1400027f1
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov qword [rax + 0x28], rsi
mov byte [rax + 0x30], 0
mov qword [rbp - 0x40], rax
mov ecx, dword [0x1400440f8]
test ecx, ecx
je 0x1400026f0
dec ecx
jmp 0x1400026fe
lea rcx, [0x1400440e0]
call fcn.14000f4b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140002802
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x14000271a
dec ecx
jmp 0x140002728
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140002741
mov rsi, qword [rbp - 0x40]
cmp qword [rsi + 0x28], rax
je 0x140002771
jmp 0x140002806
mov rax, qword [rbp - 0x40]
mov rsi, qword [rax + 0x28]
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x140002757
dec ecx
jmp 0x140002765
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rsi, qword [rbp - 0x40]
mov rax, qword [0x140047038]
mov ecx, dword [0x1400440f8]
test ecx, ecx
je 0x140002786
dec ecx
jmp 0x140002794
lea rcx, [0x1400440e0]
call fcn.14000f4b0
mov ecx, eax
add rsi, 0x10
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rcx, [0x14000197f]
call fcn.1400014b6
mov eax, dword [0x140044034]
cmp eax, 3
je 0x1400027e8
mov byte [rbp - 0x10], 1
lea rax, [rbp - 0x10]
mov qword [rbp - 0x40], rax
lea rax, str.std_src_rt.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140044034]
lea r9, [0x14003d170]
lea r8, [rbp - 0x40]
xor edx, edx
call fcn.140010eb0
xor eax, eax
add rsp, 0x78
pop rsi
pop rbp
ret
mov ecx, 8
mov edx, 0x38
call fcn.140002aed
ud2
mov rsi, qword [rbp - 0x40]
mov qword [rbp - 0x48], rsi
mov dword [rbp - 8], 0
mov byte [rbp - 4], 0
lea rax, str.fatal_runtime_error:_code_running_before_main_must_not_use_thread::current_n
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov rax, rbp
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x40]
call fcn.14000f680
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
call fcn.14000f790
mov ecx, 7
int 0x29
ud2
Function at 0x14000c030
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000c055
cmp rax, rcx
je 0x14000c05b
cmp rdx, 4
jae 0x14000c062
xor eax, eax
xor r8d, r8d
jmp 0x14000c100
pop rbp
jmp fcn.1400037d0
xor eax, eax
jmp 0x14000c117
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140038380]
movdqa xmm3, xmmword [0x140038390]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000c090
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000c117
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000c100
pop rbp
ret

Function at 0x14000f4b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x14000f545
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x14000f584
cmp dword [rbp], 0
je 0x14000f568
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000f599
mov edi, eax
mov rax, qword [0x140047038]
mov rax, qword [0x1400440b8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400440b8], rsi
jne 0x14000f520
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14000f579
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x14000f5db
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14000f56d
mov edi, dword [rbp + 4]
jmp 0x14000f579
mov edi, dword [rsi + 0x18]
jmp 0x14000f577
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.140010593
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call fcn.140003510
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.1400105da
int3
Function at 0x140010470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140037058]
test esi, esi
je 0x1400104f8
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400104ef
je 0x1400104ed
movzx eax, byte [0x140044030]
mov ecx, 0x18
call fcn.1400320b0
test rax, rax
je 0x140010508
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400104e8
mov edx, 8
mov rcx, rdi
call fcn.1400072b0
mov rax, rsi
jmp 0x1400104ef
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140037040]
call fcn.14000f4b0
mov esi, eax
jmp 0x140010489
mov ecx, 8
mov edx, 0x18
call fcn.140002aed
int3

Function at 0x140010e40
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400440a8]
nop word cs:[rax + rax]
cmp rax, 0xffffffffffffffff
je 0x140010ea3
lea rsi, [rax + 1]
lock cmpxchg qword [0x1400440a8], rsi
jne 0x140010e60
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x140010e93
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
jmp 0x140010e81
call fcn.140011760
int3
Function at 0x140011080
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [rcx]
cmp byte [rax], 0
mov byte [rax], 0
je 0x1400111e8
mov byte [rbp + 7], 0
mov eax, dword [0x140044070]
cmp eax, 3
jne 0x1400111b1
cmp byte [rbp + 7], 0
jne 0x1400111c4
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x1400111cb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400111de
mov rcx, qword [0x140044038]
cmp rax, rcx
jne 0x1400110f4
mov eax, dword [0x140044040]
cmp eax, 0xffffffff
je 0x1400111c4
inc eax
jmp 0x140011115
mov rcx, rax
mov dl, 1
xor eax, eax
lock cmpxchg byte [0x140044044], dl
jne 0x1400111c4
mov qword [0x140044038], rcx
mov eax, 1
mov dword [0x140044040], eax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 1
mov qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
mov byte [rbp - 3], 0
mov dword [rbp - 7], 0
cmp qword [0x140044048], 0
jne 0x1400111f4
mov qword [0x140044048], 0xffffffffffffffff
lea rcx, [0x140044050]
call fcn.1400112e0
movups xmm0, xmmword [rbp - 0x20]
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x140044060], xmm1
movups xmmword [0x140044050], xmm0
inc qword [0x140044048]
dec dword [0x140044040]
jne 0x1400111c4
mov qword [0x140044038], 0
xor eax, eax
xchg byte [0x140044044], al
cmp al, 2
jne 0x1400111c4
lea rcx, [0x140044044]
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
jmp 0x1400111c4
lea rcx, [rbp + 7]
call fcn.14001124a
cmp byte [rbp + 7], 0
je 0x1400110b7
add rsp, 0x48
pop rsi
pop rbp
ret
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
jmp 0x1400110c7
call fcn.140010e40
jmp 0x1400110d5
lea rcx, str.std_src_synconce.rs
call fcn.140005350
lea rcx, str.std_srcio_stdio.rs
call fcn.1400049a0
ud2
Function at 0x140011820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
test rcx, rcx
jne 0x140011928
mov ecx, dword [0x1400440f8]
test ecx, ecx
je 0x1400118f5
dec ecx
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [0x1400440d8]
test ecx, ecx
je 0x140011908
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x14001191b
movzx eax, byte [0x140044030]
mov ecx, 0x38
call fcn.1400320b0
test rax, rax
je 0x140011960
mov rsi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 2
mov qword [rax + 0x28], rdi
mov byte [rax + 0x30], 0
mov qword [rbp - 0x40], rax
mov rax, qword [0x140047038]
lock inc qword [rsi]
jle 0x14001196f
mov ecx, dword [0x1400440f8]
test ecx, ecx
je 0x1400118cf
dec ecx
jmp 0x1400118dd
lea rcx, [0x1400440e0]
call fcn.14000f4b0
mov ecx, eax
add rsi, 0x10
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rbp - 0x40]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400440e0]
call fcn.14000f4b0
mov ecx, eax
jmp 0x140011845
lea rcx, [0x1400440c0]
call fcn.14000f4b0
mov ecx, eax
jmp 0x14001185f
call fcn.140010e40
mov rdi, rax
jmp 0x140011870
cmp rcx, 1
je 0x140011971
lea rax, str.use_of_std::thread::current___is_not_possible_after_the_threads_n_________local_data_has_been_destroyed
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.std_src_threadcurrent.rs
lea rcx, [rbp - 0x40]
call fcn.140003510
mov ecx, 8
mov edx, 0x38
call fcn.140002aed
ud2
mov dword [rbp - 0x10], 0
mov byte [rbp - 0xc], 0
lea rax, str.fatal_runtime_error:__n_n____________Attempted_to_access_thread_local_data_while_allocating_said_data._n_n____________Do_not_access_functions_that_allocate_in_the_global_allocator__n_n____________This_is_a_bug_in_the_global_allocator._n_n_________n
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [rbp - 8]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.14000f680
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call fcn.14000f790
mov ecx, 7
int 0x29
ud2

Function at 0x140013530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x14001359e
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]