joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140130130]
test ecx, ecx
je 0x14002425d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140024276
cmp qword [rax + 8], 0
je 0x140024276
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130118]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14002424c
mov ecx, dword [0x140130130]
test ecx, ecx
je 0x14002431d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14002433a
mov rsi, rax
test rax, rax
jne 0x140024303
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x1400242c8
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140024352
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140024352
mov rsi, rax
lea rax, [0x140130118]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140130130]
test ecx, ecx
je 0x140024342
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rsi + 0x10]
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130118]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140024295
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130118]
call fcn.14007f590
mov ecx, eax
jmp 0x1400242fb
mov ecx, 8
mov edx, 0x18
call fcn.1400034d0
ud2
Function at 0x140037260
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x140037340
mov rsi, r8
test r8, r8
je 0x140037366
mov rdi, rdx
mov rbx, rsi
shl rbx, 6
mov r14, qword [rcx]
cmp rsi, 4
jae 0x1400372a3
xor eax, eax
jmp 0x1400372e0
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
movdqu xmm1, xmmword [r14 + rdx*8]
movdqu xmm2, xmmword [r14 + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x1400372b0
cmp rax, rsi
je 0x1400372f7
nop
mov rdx, qword [r14 + rax*8]
not rdx
mov qword [rdi + rax*8], rdx
lea rdx, [rax + 1]
mov rax, rdx
cmp rsi, rdx
jne 0x1400372e0
or byte [rdi], 1
sub rbx, qword [rcx + 0x20]
je 0x140037336
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, ebx
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp rbx, 1
adc rbx, 0
nop word [rax + rax]
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9, rsi
call fcn.14011c6b0
dec rbx
jne 0x140037320
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x38], 0
lea r9, [0x14014edd0]
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.1400290b0
ud2
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_limb.rs
xor ecx, ecx
xor edx, edx
call fcn.140005d60
ud2

Function at 0x14003dff0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.1400061f0
cmp rax, rcx
je 0x14003e015
cmp rdx, 4
jae 0x14003e018
xor eax, eax
xor r8d, r8d
jmp 0x14003e0b0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140131ff0]
movdqa xmm3, xmmword [0x140132000]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14003e040
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14003e0c7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14003e0b0
ret
Function at 0x14003f060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14003f0bb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14003f0bb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14003f0d6
cmp eax, 0x42
jne 0x14003f0bb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14003f186
cmp byte [r9 + r11], 0x5f
jne 0x14003f186
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14003f1ee
mov rcx, rsi
xor edx, edx
call fcn.14003a760
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14003a760
test al, al
jne 0x14003f281
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f112
lea rdx, [0x140151682]
mov r8d, 1
call fcn.1400066e0
test al, al
jne 0x14003f281
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14003f0ca
xor r14d, r14d
lea rbx, [0x140151a36]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14003f144
cmp byte [rax + rcx], 0x45
je 0x14003f2aa
sub r14, 1
jb 0x14003f169
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f169
mov r8d, 2
mov rdx, rbx
call fcn.1400066e0
test al, al
jne 0x14003f281
mov rcx, rsi
call fcn.14003bff0
test al, al
jne 0x14003f281
mov rax, qword [rsi]
test rax, rax
jne 0x14003f130
jmp 0x14003f0ca
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14003f248
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14003f1e2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14003f1cc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14003f1bb
add dl, 0xa9
jmp 0x14003f1ca
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14003f248
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14003f248
movzx edx, bl
add rax, rdx
jae 0x14003f190
jmp 0x14003f248
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14003f248
cmp rax, rcx
jae 0x14003f245
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14003f289
cmp qword [rsi + 0x20], 0
je 0x14003f2a3
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14003f060
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14003f0cc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003f298
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x1401519f8]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.1400066e0
test al, al
je 0x14003f298
mov dil, 2
jmp 0x14003f0ca
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x14003f253
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14003f0ca
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14003f0ca
Function at 0x140041840
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400418a0
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
jmp 0x140041868
add rdi, rbx
sub rsi, rbx
je 0x1400418a0
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140041860
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140041860
mov al, 1
jmp 0x1400418a2
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007f210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x1401300b0]
test ecx, ecx
je 0x14007f240
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14007f259
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14007f259
add rdi, 0x10
jmp 0x14007f34e
lea rcx, [0x140130098]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14007f22d
mov ecx, dword [0x1401300b0]
test ecx, ecx
je 0x14007f32f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14007f34c
mov rsi, rax
test rax, rax
jne 0x14007f2fe
mov qword [rsp + 0x28], 0
lea rax, [0x140130098]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x14007f2c0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14007f368
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14007f368
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x1401300b0]
test ecx, ecx
je 0x14007f358
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14007f34e
test rcx, rcx
je 0x14007f34e
lock dec qword [rcx]
jne 0x14007f34e
call fcn.140024700
jmp 0x14007f34e
lea rcx, [0x140130098]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14007f278
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x140130098]
call fcn.14007f590
mov ecx, eax
jmp 0x14007f2f6
mov ecx, 8
mov edx, 0x18
call fcn.1400034d0
ud2
Function at 0x14007f590
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x14007f615
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x14007f656
cmp dword [rsp + 0x2c], 0
je 0x14007f63a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14007f67e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1401d2158]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401d2158], rsi
jne 0x14007f5f0
mov byte [0x1401d2150], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14007f64c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14007f6ca
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14007f63f
mov edi, dword [rsp + 0x28]
jmp 0x14007f64c
mov edi, dword [rsi + 0x18]
jmp 0x14007f64a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x140159ee0]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.14007f730
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.combase.dll
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140005ca0
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.combase.dll
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14007f770
ud2
Function at 0x1400802d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1401300d0]
test ecx, ecx
je 0x140080396
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400802fd
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x140080390
mov ecx, dword [0x1401300d0]
test ecx, ecx
je 0x1400803b8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400803d5
mov rsi, rax
test rax, rax
jne 0x14008038a
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x14008034f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400803f0
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400803f0
mov rsi, rax
lea rax, [0x1401300b8]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1401300d0]
test ecx, ecx
je 0x1400803e0
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400803d7
lea rcx, [0x1401300b8]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400802f0
jmp 0x1400802fd
lea rcx, [0x1401300b8]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14008031c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401300b8]
call fcn.14007f590
mov ecx, eax
jmp 0x140080382
mov ecx, 8
mov edx, 0x10
call fcn.1400034d0
ud2
Function at 0x140081030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140130090]
test ecx, ecx
je 0x14008105d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140081076
cmp qword [rax + 8], 0
je 0x140081076
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130078]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14008104c
mov ecx, dword [0x140130090]
test ecx, ecx
je 0x140081121
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14008113e
mov rsi, rax
test rax, rax
jne 0x140081103
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x1400810c8
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140081156
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140081156
mov rsi, rax
lea rax, [0x140130078]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140130090]
test ecx, ecx
je 0x140081146
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130078]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140081095
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140130078]
call fcn.14007f590
mov ecx, eax
jmp 0x1400810fb
mov ecx, 8
mov edx, 0x20
call fcn.1400034d0
ud2
Function at 0x1400834b0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x140083530
jmp 0x14008351f
jae 0x1400835d4
cmp r8, 0x201
jae 0x140083530
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x140083577
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x140083557
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.140081b10
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x14008359b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14008362d
mov r8d, ebx
cmp rbp, r8
jne 0x140083510
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14008364d
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x14008351f
jmp 0x140083530
cmp r12, r8
jb 0x140083667
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1400841f0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rsi, rsi
je 0x140083618
mov rcx, qword [0x1401d2138]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rsi, rsi
jne 0x140083605
jmp 0x140083618
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140006a00
jmp 0x14008367c
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.140006660
ud2
Function at 0x140087880
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.1400a0e10
mov rsi, rdx
test rax, rax
je 0x140087943
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140087937
test rax, rax
je 0x140087937
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x140087926
cmp qword [r14 + 0x10], 0x11
jb 0x140087915
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1401d2138]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401d2138]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov qword [rdi], 0
jmp 0x140087ab7
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.1400a1640
cmp dword [rsp + 0x40], 2
jne 0x1400879d5
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400879b6
test rcx, rcx
je 0x1400879b6
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
cmp qword [r15 + 8], 0
je 0x1400879a5
cmp qword [r15 + 0x10], 0x11
jb 0x140087994
mov r14, qword [r14 - 8]
mov rcx, qword [0x1401d2138]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401d2138]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x140087a27
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x140087aa3
mov rbx, qword [rsp + 0x40]
jmp 0x140087a29
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x140087a92
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x140087a92
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x140087aaf
mov qword [rdi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x140087aaf
call sub.KERNEL32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400a4f60
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140159888]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1400a4fca
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1400a4fd9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400a5010
cmp eax, 0x103
je 0x1400a501a
test eax, eax
js 0x1400a4ff6
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400a5010
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14007e790
mov rcx, rax
call fcn.14007e890
mov ecx, 7
int 0x29
ud2
Function at 0x1400a5d30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x1401300f0]
test ecx, ecx
je 0x1400a5d60
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400a5d79
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400a5d79
add rdi, 0x10
jmp 0x1400a5e6e
lea rcx, [0x1401300d8]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400a5d4d
mov ecx, dword [0x1401300f0]
test ecx, ecx
je 0x1400a5e4f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400a5e6c
mov rsi, rax
test rax, rax
jne 0x1400a5e1e
mov qword [rsp + 0x28], 0
lea rax, [0x1401300d8]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x1400a5de0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400a5e88
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400a5e88
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x1401300f0]
test ecx, ecx
je 0x1400a5e78
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400a5e6e
test rcx, rcx
je 0x1400a5e6e
lock dec qword [rcx]
jne 0x1400a5e6e
call fcn.1400da710
jmp 0x1400a5e6e
lea rcx, [0x1401300d8]
call fcn.14007f590
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400a5d98
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1401300d8]
call fcn.14007f590
mov ecx, eax
jmp 0x1400a5e16
mov ecx, 8
mov edx, 0x18
call fcn.1400034d0
ud2