joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400305f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov byte [rsp + 0x2f], 0
mov rax, qword [0x140094210]
cmp rax, 3
jne 0x1400307e4
cmp byte [rsp + 0x2f], 0
jne 0x1400307f9
mov ecx, dword [0x14006a038]
test ecx, ecx
je 0x1400307ff
dec ecx
call fcn.140067488
cmp rax, 2
jb 0x14003063e
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1400306da
mov ecx, dword [0x14006a038]
test ecx, ecx
je 0x140030812
dec ecx
call fcn.140067488
test rax, rax
je 0x14003068c
mov rsi, rax
cmp rax, 1
jne 0x1400306d4
lea rax, str.library_std_src_threadlocal.rs
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction
lea r9, [0x140088e08]
lea r8, [rsp + 0x30]
mov edx, 0x46
call fcn.140009c70
ud2
movzx eax, byte [0x140094300]
mov ecx, 0x10
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x140030842
mov rsi, rax
lea rax, [0x14006a020]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x14006a038]
test ecx, ecx
je 0x140030825
dec ecx
mov rdx, rsi
call fcn.140067480
mov word [rsi + 8], 1
add rsi, 9
mov rax, qword [0x1400941d8]
cmp rax, rsi
jne 0x14003070e
mov eax, dword [0x140094208]
inc eax
jne 0x14003072e
lea rcx, str.lock_count_overflow_in_reentrant_mutexlibrary_std_src_sync_remutex.rs
lea r8, [0x140086d38]
mov edx, 0x26
call fcn.14000c150
ud2
lea rcx, [0x1400941d0]
call sub.KERNEL32.dll_TryAcquireSRWLockExclusive
test al, al
je 0x1400307f9
mov qword [0x1400941d8], rsi
mov eax, 1
mov dword [0x140094208], eax
mov qword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x46], 0
cmp qword [0x1400941e0], 0
jne 0x140030838
mov qword [0x1400941e0], 0xffffffffffffffff
cmp byte [0x140094200], 0
jne 0x140030789
lea rcx, [0x1400941e8]
call fcn.140044da0
test rax, rax
je 0x140030789
mov rcx, rax
call fcn.14005cbc0
cmp qword [0x1400941f0], 0
je 0x1400307a4
mov rcx, qword [0x1400941e8]
mov edx, 1
call fcn.140003d40
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x1400941f8], xmm1
movups xmmword [0x1400941e8], xmm0
inc qword [0x1400941e0]
dec dword [0x140094208]
jne 0x1400307f9
mov qword [0x1400941d8], 0
lea rcx, [0x1400941d0]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x1400307f9
lea rcx, [rsp + 0x2f]
call fcn.1400539c0
cmp byte [rsp + 0x2f], 0
je 0x140030616
add rsp, 0x50
pop rsi
ret
lea rcx, [0x14006a020]
call fcn.140053a30
mov ecx, eax
jmp 0x140030626
lea rcx, [0x14006a020]
call fcn.140053a30
mov ecx, eax
jmp 0x14003064e
lea rcx, [0x14006a020]
call fcn.140053a30
mov ecx, eax
jmp 0x1400306cc
call fcn.1400090e0
jmp 0x1400308cd
mov ecx, 8
mov edx, 0x10
call fcn.1400059f0
ud2
ud2
Function at 0x14003a000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1078
call fcn.140067710
sub rsp, rax
movaps xmmword [rsp + 0x1060], xmm6
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x34], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x34]
mov qword [rsp + 0x58], r13
lea rbp, [0x1400311a0]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x14003a19f
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x14003a094
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x14003a1a6
mov r15d, dword [rsp + 0x3c]
test r15, r15
je 0x14003a1e2
cmp r15d, 0x1000
ja 0x14003a222
xor r12d, r12d
nop word cs:[rax + rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x60
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x14003a1c4
nop dword [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x14003a130
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x14003a1cb
mov eax, dword [rsp + 0x3c]
add r12, rax
cmp r12, r15
je 0x14003a161
jbe 0x14003a0e0
jmp 0x14003a20e
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x14003a094
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov rbx, rcx
shl rbx, 0x20
or rbx, 2
call fcn.1400303b0
cmp al, 0xb
jne 0x14003a1da
mov rcx, rbx
call fcn.14005cbc0
jmp 0x14003a1e2
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
shl rcx, 0x20
or rcx, 2
call fcn.14005cbc0
jmp 0x14003a1e2
mov rcx, rbx
call fcn.14005cbc0
mov rcx, rdi
call fcn.1400676d0
mov rcx, rsi
call fcn.1400676d0
movaps xmm6, xmmword [rsp + 0x1060]
add rsp, 0x1078
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14000a9c0
jmp 0x14003a236
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14000a940
ud2
Function at 0x14003a380
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x140094300]
mov ecx, 0x10
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x14003a438
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003a490]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x14003a42b
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x14003a40a
mov rdx, qword [r14 + 0x10]
mov rcx, rbx
call fcn.140003d40
mov edx, 8
mov rcx, rsi
call fcn.140003d40
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400059f0
ud2
Function at 0x14003a6f0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x40], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov dword [rsp + 0x58], 7
mov qword [rsp + 0x5c], 0
mov word [rsp + 0x64], 0
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.1400520d0
mov rdi, rdx
test rax, rax
je 0x14003a767
mov rcx, rdi
call fcn.14005cbc0
mov qword [rsi], 0
jmp 0x14003a8fa
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileInformationByHandle
test eax, eax
je 0x14003a81a
test byte [rsp + 0x41], 4
je 0x14003a7bf
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x78]
mov rcx, rdi
mov edx, 9
mov r9d, 8
call sub.KERNEL32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x14003a81a
mov r12d, dword [rsp + 0x60]
mov r15d, dword [rsp + 0x64]
test rdi, rdi
je 0x14003a856
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x14003a8d9
mov rbx, qword [rsp + 0x40]
jmp 0x14003a858
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, rax
call fcn.14005cbc0
mov qword [rsi], 0
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400676d0
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x14003a8c8
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.1400676d0
test r15, r15
je 0x14003a8c8
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x14003a8f2
mov qword [rsi], 0
mov rcx, rbx
call fcn.1400676d0
jmp 0x14003a8f2
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.14005cbc0
mov qword [rsi], 0
mov rcx, rdi
call fcn.1400676d0
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140049d90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140049dee
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140049dee
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140049dee
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140049dee
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140049e2b
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140049e19
xor eax, eax
jmp 0x140049e26
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x140049e26

Function at 0x140049e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x140049e73
cdqe
jmp 0x140049e81
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x140049e89
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140049e9a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x140049eb0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x140049ee9
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140049eff
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret
Function at 0x14004e2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14005dc30
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rax, rax
je 0x14004e36a
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14004a750
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14004e365
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14004e385
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x14004e376
mov rcx, qword [rsp + 0x30]
call fcn.14005cbc0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x14004e376
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140003d40

Function at 0x14004f710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14006a0e0]
test ecx, ecx
je 0x14004f7cd
dec ecx
call fcn.140067488
cmp rax, 2
jb 0x14004f740
cmp qword [rax + 8], 0
je 0x14004f740
add rax, 0x10
jmp 0x14004f7c7
mov ecx, dword [0x14006a0e0]
test ecx, ecx
je 0x14004f7e0
dec ecx
call fcn.140067488
cmp rax, 1
je 0x14004f7c5
mov rsi, rax
test rax, rax
jne 0x14004f7ab
movzx eax, byte [0x140094300]
mov ecx, 0x20
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x14004f803
mov rsi, rax
lea rax, [0x14006a0c8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14006a0e0]
test ecx, ecx
je 0x14004f7f3
dec ecx
mov rdx, rsi
call fcn.140067480
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x14004f7c7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14006a0c8]
call fcn.140053a30
mov ecx, eax
jmp 0x14004f725
lea rcx, [0x14006a0c8]
call fcn.140053a30
mov ecx, eax
jmp 0x14004f750
lea rcx, [0x14006a0c8]
call fcn.140053a30
mov ecx, eax
jmp 0x14004f7a3
mov ecx, 8
mov edx, 0x20
call fcn.1400059f0
ud2
Function at 0x14004fbd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14006a068]
test ecx, ecx
je 0x14004fcb0
dec ecx
call fcn.140067488
cmp rax, 2
jb 0x14004fc04
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14004fc04
add rdi, 0x10
jmp 0x14004fca6
mov ecx, dword [0x14006a068]
test ecx, ecx
je 0x14004fcc3
dec ecx
call fcn.140067488
cmp rax, 1
je 0x14004fca4
mov rsi, rax
test rax, rax
jne 0x14004fc73
movzx eax, byte [0x140094300]
mov ecx, 0x18
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x14004fce6
mov rsi, rax
lea rax, [0x14006a050]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14006a068]
test ecx, ecx
je 0x14004fcd6
dec ecx
mov rdx, rsi
call fcn.140067480
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14004fca6
test rcx, rcx
je 0x14004fca6
lock dec qword [rcx]
jne 0x14004fca6
call fcn.14004f6c0
jmp 0x14004fca6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14006a050]
call fcn.140053a30
mov ecx, eax
jmp 0x14004fbe6
lea rcx, [0x14006a050]
call fcn.140053a30
mov ecx, eax
jmp 0x14004fc14
lea rcx, [0x14006a050]
call fcn.140053a30
mov ecx, eax
jmp 0x14004fc6b
mov ecx, 8
mov edx, 0x18
call fcn.1400059f0
ud2

Function at 0x14004ff50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x14006a088]
test ecx, ecx
je 0x140050030
dec ecx
call fcn.140067488
cmp rax, 2
jb 0x14004ff84
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14004ff84
add rdi, 0x10
jmp 0x140050026
mov ecx, dword [0x14006a088]
test ecx, ecx
je 0x140050043
dec ecx
call fcn.140067488
cmp rax, 1
je 0x140050024
mov rsi, rax
test rax, rax
jne 0x14004fff3
movzx eax, byte [0x140094300]
mov ecx, 0x18
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x140050066
mov rsi, rax
lea rax, [0x14006a070]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14006a088]
test ecx, ecx
je 0x140050056
dec ecx
mov rdx, rsi
call fcn.140067480
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140050026
test rcx, rcx
je 0x140050026
lock dec qword [rcx]
jne 0x140050026
call fcn.14004f8b0
jmp 0x140050026
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14006a070]
call fcn.140053a30
mov ecx, eax
jmp 0x14004ff66
lea rcx, [0x14006a070]
call fcn.140053a30
mov ecx, eax
jmp 0x14004ff94
lea rcx, [0x14006a070]
call fcn.140053a30
mov ecx, eax
jmp 0x14004ffeb
mov ecx, 8
mov edx, 0x18
call fcn.1400059f0
ud2
Function at 0x140053a30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140053ab5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140053af6
cmp dword [rsp + 0x2c], 0
je 0x140053ada
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140053b1e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1400942b8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400942b8], rsi
jne 0x140053a90
mov byte [0x1400942b1], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140053aec
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140053b6a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140053adf
mov edi, dword [rsp + 0x28]
jmp 0x140053aec
mov edi, dword [rsi + 0x18]
jmp 0x140053aea
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x140089288]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140031340
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.description___is_deprecated__use_Displaycalled__Option::unwrap____on_a__None__value
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140009d20
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.description___is_deprecated__use_Displaycalled__Option::unwrap____on_a__None__value
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140031380
ud2
Function at 0x140053bb0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14006a0a8]
test ecx, ecx
je 0x140053ca9
dec ecx
call fcn.140067488
cmp rax, 2
jb 0x140053be0
cmp qword [rax + 8], 0
je 0x140053be0
add rax, 0x10
jmp 0x140053ca3
mov ecx, dword [0x14006a0a8]
test ecx, ecx
je 0x140053cbc
dec ecx
call fcn.140067488
cmp rax, 1
je 0x140053c83
mov rsi, rax
test rax, rax
jne 0x140053c53
movzx eax, byte [0x140094300]
mov ecx, 0x20
mov edx, 8
call fcn.140003cb0
test rax, rax
je 0x140053ce2
mov rsi, rax
lea rax, [0x14006a090]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14006a0a8]
test ecx, ecx
je 0x140053ccf
dec ecx
mov rdx, rsi
call fcn.140067480
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140053c87
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140053c8f
xor eax, eax
jmp 0x140053ca3
call fcn.14005f860
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14006a090]
call fcn.140053a30
mov ecx, eax
jmp 0x140053bc5
lea rcx, [0x14006a090]
call fcn.140053a30
mov ecx, eax
jmp 0x140053bf0
lea rcx, [0x14006a090]
call fcn.140053a30
mov ecx, eax
jmp 0x140053c4b
mov ecx, 8
mov edx, 0x20
call fcn.1400059f0
ud2
Function at 0x14005c6a0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1400041d0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14005c6fa
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x14005c782
mov edx, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140003d40
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x14005c757
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14005c76a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x14005c782
mov edx, 1
mov rcx, rdi
call fcn.140003d40
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005d760
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x14005d7d0
jmp 0x14005d7bf
jae 0x14005d875
cmp r8, 0x201
jae 0x14005d7d0
mov r15d, 0x200
lea r12, [rsp + 0x68]
mov r13, r8
jmp 0x14005d817
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x14005d7f7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.140044450
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x38]
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, r14
mov r12, qword [rsp + 0x20]
mov r13, r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r13d
mov rdx, r12
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x14005d83c
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14005d8ca
mov r8d, ebp
cmp r13, r8
jne 0x14005d7b0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14005d8ea
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x14005d7bf
jmp 0x14005d7d0
cmp r15, r8
jb 0x14005d904
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.14004a280
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x14005d8b5
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.140003d40
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x14005d8a6
jmp 0x14005d8b5
lea rcx, str.internal_error:_entered_unreachable_codelibrary_std_src_syswindows_args.rs
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140009e20
jmp 0x14005d919
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14000a940
ud2