joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b6090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x1401b60eb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1401b60eb
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x1401b6106
cmp eax, 0x42
jne 0x1401b60eb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1401b61b6
cmp byte [r8 + r11], 0x5f
jne 0x1401b61b6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1401b621e
mov rcx, rsi
xor edx, edx
call fcn.1401b1690
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1401b1690
test al, al
jne 0x1401b62b1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b6142
lea rdx, [0x1402f6ca1]
mov r8d, 1
call fcn.14003e4b0
test al, al
jne 0x1401b62b1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1401b60fa
xor r14d, r14d
lea rbx, [0x1402fd160]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1401b6174
cmp byte [rax + rcx], 0x45
je 0x1401b62d3
sub r14, 1
jb 0x1401b6199
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b6199
mov r8d, 2
mov rdx, rbx
call fcn.14003e4b0
test al, al
jne 0x1401b62b1
mov rcx, rsi
call fcn.1401b2ef0
test al, al
jne 0x1401b62b1
mov rax, qword [rsi]
test rax, rax
jne 0x1401b6160
jmp 0x1401b60fa
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x1401b6278
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x1401b6212
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1401b61fc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1401b61eb
add dl, 0xa9
jmp 0x1401b61fa
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1401b6278
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1401b6278
movzx edx, bl
add rax, rdx
jae 0x1401b61c0
jmp 0x1401b6278
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1401b6278
cmp rax, rcx
jae 0x1401b6275
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1401b62cb
cmp qword [rsi + 0x20], 0
je 0x1401b62c4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1401b6090
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1401b60fc
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401b62b9
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for___::closureshim_as_mut_const___dyn___unsafe_extern__
lea rdx, [0x1402f6fe8]
test r9b, r9b
cmovne rdx, rax
call fcn.14003e4b0
test al, al
je 0x1401b62b9
mov dil, 2
jmp 0x1401b60fa
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1401b60fa
mov dil, 1
xor r9d, r9d
jmp 0x1401b627a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1401b60fa
Function at 0x1401b8f00
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x88], 4
mov dword [rsp + 0xd0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1401b8f65
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0xb0], edx
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1401b8fa8
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x1401b8fa1
lea r9, [0x1403349a0]
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp r8, r10
jne 0x1401b8f90
mov dword [rsp + 0xc0], edx
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x1401b900c
mov rax, r14
shr rax, 0x3c
jne 0x1401b904c
mov rbx, qword [rcx]
lea rdi, [r14*8]
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x1401b8ff0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401b903d
mov rcx, rax
mov qword [0x14036c198], rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1401b903d
mov rsi, rax
cmp r14, 4
jae 0x1401b9015
xor eax, eax
jmp 0x1401b9053
xor eax, eax
mov esi, 8
jmp 0x1401b9066
mov rax, r14
and rax, 0xfffffffffffffffc
xor ecx, ecx
nop
movups xmm0, xmmword [rbx + rcx*8]
movups xmm1, xmmword [rbx + rcx*8 + 0x10]
movups xmmword [rsi + rcx*8], xmm0
movups xmmword [rsi + rcx*8 + 0x10], xmm1
add rcx, 4
cmp rax, rcx
jne 0x1401b9020
jmp 0x1401b905e
mov ecx, 8
mov rdx, rdi
call fcn.140004360
ud2
call fcn.140004320
ud2
mov rcx, qword [rbx + rax*8]
mov qword [rsi + rax*8], rcx
inc rax
cmp r14, rax
jne 0x1401b9053
mov eax, r14d
mov dword [rsp + 0x8c], eax
mov qword [rsp + 0x90], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x1402f9d43]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
mov edi, eax
test eax, eax
je 0x1401b90f0
shl rdi, 0x20
or rdi, 2
mov ebx, 1
test r14, r14
je 0x1401b90dd
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, rsi
call fcn.14027f164
mov rax, rbx
mov rdx, rdi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 1
movups xmmword [rsp + 0x78], xmm0
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x1401b9133
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401b9169
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1401b9169
mov rdi, rax
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor ebx, ebx
test r14, r14
jne 0x1401b90cc
jmp 0x1401b90dd
lea rbx, [rsp + 0x78]
mov ecx, 8
mov edx, 0x20
call fcn.140004360
ud2
Function at 0x1401bd7f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140284708]
test ecx, ecx
je 0x1401bd8eb
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1401bd824
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1401bd824
add rdi, 0x10
jmp 0x1401bd8e1
mov ecx, dword [0x140284708]
test ecx, ecx
je 0x1401bd8fe
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1401bd8df
mov rsi, rax
test rax, rax
jne 0x1401bd8b5
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x1401bd876
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401bd921
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1401bd921
mov rsi, rax
lea rax, [0x1402846f0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140284708]
test ecx, ecx
je 0x1401bd911
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1401bd8e1
call fcn.1401bd590
jmp 0x1401bd8e1
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402846f0]
call fcn.140202220
mov ecx, eax
jmp 0x1401bd806
lea rcx, [0x1402846f0]
call fcn.140202220
mov ecx, eax
jmp 0x1401bd834
lea rcx, [0x1402846f0]
call fcn.140202220
mov ecx, eax
jmp 0x1401bd8ad
mov ecx, 8
mov edx, 0x20
call fcn.140004360
ud2
Function at 0x1401bf240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x1401bf281
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x1401bf276
cmp edi, 0x2d
jne 0x1401bf281
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x1401bf41a
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x1401bf425
movzx r10d, r10b
cmp rbx, r11
jae 0x1401bf320
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x1401bf2dc
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x1401bf320
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1401bf320
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccb
jle 0x1401bf2c0
cmp r10d, 0xccccccc
jne 0x1401bf308
cmp r11b, 7
jbe 0x1401bf2c0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1401bf470
jmp 0x1401bf407
mov ecx, dword [rsp + 0x80]
test al, al
je 0x1401bf33c
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x1401bf34c
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14028c060]
subpd xmm1, xmmword [0x14028c070]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x1401bf3b8
xorpd xmm1, xmm1
movsd xmm2, qword [0x14028c080]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x1401bf398
jnp 0x1401bf3f0
test ecx, ecx
jns 0x1401bf44b
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x1401bf390
mov eax, eax
lea r9, [0x14030add0]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x1401bf40f
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x1401bf44b
test r8b, r8b
jne 0x1401bf3fd
xorpd xmm0, xmmword [0x14028c090]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x1401bf3f5
jmp 0x1401bf3fd
mov qword [rsp + 0x28], 5
jmp 0x1401bf42e
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401bee70
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401bf407
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401bee70
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1401bf404
Function at 0x1401bfe10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x1401bfe51
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x1401bfe46
cmp edi, 0x2d
jne 0x1401bfe51
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x1401bffea
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x1401bfff5
movzx r10d, r10b
cmp rbx, r11
jae 0x1401bfef0
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x1401bfeac
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x1401bfef0
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1401bfef0
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccb
jle 0x1401bfe90
cmp r10d, 0xccccccc
jne 0x1401bfed8
cmp r11b, 7
jbe 0x1401bfe90
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1401c01c0
jmp 0x1401bffd7
mov ecx, dword [rsp + 0x80]
test al, al
je 0x1401bff0c
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x1401bff1c
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14028c150]
subpd xmm1, xmmword [0x14028c160]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x1401bff88
xorpd xmm1, xmm1
movsd xmm2, qword [0x14028c170]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x1401bff68
jnp 0x1401bffc0
test ecx, ecx
jns 0x1401c001b
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x1401bff60
mov eax, eax
lea r9, [0x14030add0]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x1401bffdf
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x1401c001b
test r8b, r8b
jne 0x1401bffcd
xorpd xmm0, xmmword [0x14028c180]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x1401bffc5
jmp 0x1401bffcd
mov qword [rsp + 0x28], 5
jmp 0x1401bfffe
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401bf670
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401bffd7
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401bf670
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1401bffd4
Function at 0x1401d40d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1401d4106
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1401d410e
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1401d4113
xor r10d, r10d
jmp 0x1401d41c1
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1401d4136
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1401d414d
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1401d416d
add r11, r8
jmp 0x1401d429e
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1401d4242
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop word cs:[rax + rax]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1401d41f0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1401d4254
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x1401d425a
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1401d4280
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1401d429a
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401e8e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1401e8f4d
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
movabs rdx, 0x736f6d6570736575
xor rdx, rax
movabs r8, 0x646f72616e646f6d
xor r8, rcx
movabs r9, 0x6c7967656e657261
xor r9, rax
movabs r10, 0x7465646279746573
xor r10, rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14005dd00
test rdi, rdi
je 0x1401e8fd5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1401e8fee
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1401e90e6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1401e9168
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1401e90f3
mov r11, rax
mov r8, rcx
nop word [rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1401e8fb0
cmp r9, 8
jae 0x1401e90fc
jmp 0x1401e9168
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14005dd00
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1401e9168
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1401e9168
mov r8, rcx
cmp r9, 8
jb 0x1401e9168
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1401e9100
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140202220
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x1402022a5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1402022e6
cmp dword [rsp + 0x2c], 0
je 0x1402022ca
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14020230e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x14036c1b8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14036c1b8], rsi
jne 0x140202280
mov byte [0x14036c1b0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1402022dc
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14020235a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1402022cf
mov edi, dword [rsp + 0x28]
jmp 0x1402022dc
mov edi, dword [rsi + 0x18]
jmp 0x1402022da
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x140303378]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140202960
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.30_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._at_line__column
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.14003d630
ud2
lea rax, str.30_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._at_line__column
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1402029a0
ud2
Function at 0x140202810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140284960]
test ecx, ecx
je 0x140202912
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140202844
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140202844
add rdi, 0x10
jmp 0x140202908
mov ecx, dword [0x140284960]
test ecx, ecx
je 0x140202925
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140202906
mov rsi, rax
test rax, rax
jne 0x1402028d5
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140202896
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140202948
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140202948
mov rsi, rax
lea rax, [0x140284948]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140284960]
test ecx, ecx
je 0x140202938
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140202908
test rcx, rcx
je 0x140202908
lock dec qword [rcx]
jne 0x140202908
call fcn.1402021c0
jmp 0x140202908
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140284948]
call fcn.140202220
mov ecx, eax
jmp 0x140202826
lea rcx, [0x140284948]
call fcn.140202220
mov ecx, eax
jmp 0x140202854
lea rcx, [0x140284948]
call fcn.140202220
mov ecx, eax
jmp 0x1402028cd
mov ecx, 8
mov edx, 0x18
call fcn.140004360
ud2

Function at 0x140203190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140284980]
test ecx, ecx
je 0x140203259
invalid
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1402031bd
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x140203248
mov ecx, dword [0x140284980]
test ecx, ecx
je 0x14020326c
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14020324e
mov rsi, rax
test rax, rax
jne 0x140203242
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14020320b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x140200d50.63
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x140200d50.63
mov rsi, rax
lea rax, [0x140284968]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x140284980]
test ecx, ecx
je 0x14020327f
invalid
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x140203250
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140284968]
call fcn.140202220
mov ecx, eax
jmp 0x1402031a5
lea rcx, [0x140284968]
call fcn.140202220
test al, 0xef
invalid
dec dword [rcx - 0xb1163f]
invalid
invalid
lea rcx, [0x140284968]
call fcn.140202220
mov ecx, eax
shr ebx, 0xab
mov ecx, 8
mov edx, 0x10
call fcn.140004360
ud2