joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406820
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.004be600
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x0045ae30]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x4069de
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4068d0
cmp dword [rsp + 0x34], 0
jne 0x4069e3
mov r15d, dword [rsp + 0x38]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], r15
test r15, r15
je 0x4069e3
cmp r15d, 0x1000
ja 0x406a23
xor r12d, r12d
nop dword [rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x80
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x4069de
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x406970
cmp dword [rsp + 0x34], 0
jne 0x4069e3
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
je 0x40699d
jbe 0x406920
jmp 0x406a0f
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x80]
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x4068d0
call sub.KERNEL32.dll_GetLastError
mov rcx, rdi
call fcn.004be984
mov rcx, rsi
call fcn.004be984
movaps xmm6, xmmword [rsp + 0x1080]
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x004c2900]
mov rcx, r12
mov rdx, r15
call fcn.004b9400
jmp 0x406a37
lea r8, [0x004c2900]
mov edx, 0x1000
mov rcx, r15
call fcn.004b9370
ud2

Function at 0x4077a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x004c1010]
jmp fcn.0045ebc0

Function at 0x407940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x004c1030]
jmp fcn.0045e970
Function at 0x40b1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x40b200
test ecx, ecx
jne 0x40b250
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x40b20c
test ecx, ecx
jne 0x40b250
mov rcx, rdi
call fcn.0040b0b0
movzx eax, al
test bpl, bpl
jne 0x40b257
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x40b243.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x0040b3c8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x40b243.2
xor eax, eax
test bpl, bpl
je 0x40b21c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x40b3a9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x40b28a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x40b309
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x40b2d0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x40b2eb
inc rax
dec rdi
cmp rax, 1
jne 0x40b2b0
jmp 0x40b309
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x40b2eb
cmp ebx, 0x5c
je 0x40b2eb
inc rax
dec rdi
cmp rax, 1
jne 0x40b2d0
jmp 0x40b309
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x40b3b7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x40b333
mov al, 9
cmp rdx, 2
je 0x40b337
cmp rdx, 1
jne 0x40b347
cmp byte [r8], 0x2e
jne 0x40b347
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x40b347
mov al, 0xa
jmp 0x40b347
cmp byte [r8], 0x2e
jne 0x40b347
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x40b243.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x40b243.2
mov ecx, 2
jmp case.0x40b243.2
lea r8, [0x004c2e88]
call fcn.004b92e0
ud2
lea r8, [0x004c2ea0]
call fcn.004b92e0
ud2

Function at 0x40fa90
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40faa8
dec ecx
jmp 0x40fab2
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov edx, 0x20
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fada
dec ecx
jmp 0x40fae4
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x40fb20
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rsi, qword [rax + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fb3d
dec ecx
jmp 0x40fb47
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov rdi, qword [rsp + 0x20]
cmp qword [rdi], 0
je 0x40fb74
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x40fb74
lock dec qword [rax]
jne 0x40fb74
lea rcx, [rdi + 0x10]
call fcn.004489f0
mov edx, 0x20
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fb92
dec ecx
jmp 0x40fb9c
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x40fc90
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fca8
dec ecx
jmp 0x40fcb2
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fcda
dec ecx
jmp 0x40fce4
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x40fd50
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rsi, qword [rax + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fd6d
dec ecx
jmp 0x40fd77
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov rdi, qword [rsp + 0x20]
cmp qword [rdi], 0
je 0x40fda4
mov rax, qword [rdi + 8]
test rax, rax
je 0x40fda4
lock dec qword [rax]
jne 0x40fda4
lea rcx, [rdi + 8]
call fcn.00448a50
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40fdc2
dec ecx
jmp 0x40fdcc
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x40fed0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rsi, qword [rax + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40feed
dec ecx
jmp 0x40fef7
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov rdi, qword [rsp + 0x20]
cmp qword [rdi], 0
je 0x40ff24
mov rax, qword [rdi + 8]
test rax, rax
je 0x40ff24
lock dec qword [rax]
jne 0x40ff24
lea rcx, [rdi + 8]
call fcn.004488c0
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40ff42
dec ecx
jmp 0x40ff4c
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x40ffa0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40ffb7
dec ecx
jmp 0x40ffc1
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call fcn.004018d0
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x40ffe9
dec ecx
jmp 0x40fff3
mov rcx, rsi
call fcn.0043b930
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x4177e0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov rbx, qword [rdx]
test rbx, rbx
je 0x417841
mov qword [rsp + 0x38], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rbx
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x4178bd
mov rbx, qword [rsp + 0x38]
jmp 0x417843
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x4178ac
mov r14, rax
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.004be984
test r15, r15
je 0x4178ac
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdi
mov qword [rsi], 1
jmp 0x4178c9
mov qword [rsi], 0
mov rcx, rbx
call fcn.004be984
jmp 0x4178c9
call sub.KERNEL32.dll_GetLastError
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x41a960
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x200
mov rsi, rcx
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
movzx ebp, word [rdx + 0x10]
mov word [rsp + 0x2e], bp
mov rax, qword [0x004fb258]
cmp rax, 3
jne 0x41aa5e
cmp rdi, 0x17f
ja 0x41aa70
lea r14, [rsp + 0x80]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rsp + rdi + 0x80], 0
inc rdi
lea rcx, [rsp + 0x38]
mov rdx, r14
mov r8, rdi
call fcn.004aca80
cmp qword [rsp + 0x38], 0
je 0x41a9ee
lea rax, [0x004c4340]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x41aa83
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x30]
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x41aa46
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x41aa83
mov rax, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
jmp 0x41aa83
call fcn.0045e8a0
cmp rdi, 0x17f
jbe 0x41a99e
lea r9, [rsp + 0x2e]
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.004595a0
mov rax, rsi
add rsp, 0x200
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x41b970
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xf0
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rcx, qword [rdx]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x2c]
call sub.WS2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x41ba63
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x50]
cmp ecx, 2
je 0x41ba72
cmp ecx, 0x17
jne 0x41ba9b
cmp eax, 0x1c
jb 0x41bab7
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x30], xmm0
movzx r8d, word [rsp + 0x52]
rol r8w, 8
mov r9d, dword [rsp + 0x54]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x30]
call fcn.004acf50
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xdc]
movups xmmword [rsp + 0x32], xmm0
movups xmmword [rsp + 0x3e], xmm1
mov word [rsi], 1
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x3e]
movups xmmword [rsi + 2], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x41baab
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x41baa2
cmp eax, 0x10
jb 0x41bad1
mov ecx, dword [rsp + 0x54]
movzx edx, word [rsp + 0x52]
rol dx, 8
call fcn.004acf00
mov word [rsi], 0
mov dword [rsi + 2], eax
shr rax, 0x20
mov word [rsi + 6], ax
jmp 0x41baab
lea rax, [0x004c46e8]
mov qword [rsi + 8], rax
mov word [rsi], 2
mov rax, rsi
add rsp, 0xf0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___library_std_src_sys_common_net.rs
lea r8, [0x004c4768]
mov edx, 0x43
call fcn.004ada10
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
lea r8, [0x004c47c8]
mov edx, 0x42
call fcn.004ada10
ud2

Function at 0x41e8c0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call fcn.0043c390
mov rsi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x41e96f
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.00437340
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x41e96f
mov rcx, rdi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x41e944
test rsi, rsi
je 0x41e940
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.004018d0
xor esi, esi
jmp 0x41e96f
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x41e96c
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.004018d0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x436970
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.0043c390
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x436a19
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rbx
call fcn.0043c390
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
test r15, r15
je 0x436a1e
mov rcx, rdi
mov rdx, r15
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
je 0x436a49
xor r14d, r14d
test rbx, rbx
je 0x4369fe
add rbx, rbx
mov r8d, 2
mov rcx, r15
mov rdx, rbx
call fcn.004018d0
test rsi, rsi
je 0x436a3a
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.004018d0
jmp 0x436a3a
mov rbx, rsi
jmp 0x436a37
test rsi, rsi
je 0x436a37
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.004018d0
mov r14, rbx
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
test rbx, rbx
jne 0x4369ea
jmp 0x4369fe

Function at 0x43b3a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov edx, 0xffffffff
cmp r9, rdx
cmovb rdx, r9
mov qword [rsp + 0x78], rcx
lea r9, [rsp + 0x80]
mov qword [rsp + 0x80], rax
test rcx, rcx
cmove r9, rcx
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x43b442
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x58]
cmp eax, 0xc0000011
jne 0x43b451
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x43b488
cmp eax, 0x103
je 0x43b492
test eax, eax
js 0x43b46e
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x43b488
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x78], 0
lea rax, [0x004c6ba0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [0x00492f80]
mov qword [rsp + 0x70], rax
lea rax, [0x004c7628]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa8]
call fcn.00434a10
mov rcx, rax
call fcn.00438ee0
mov ecx, 7
int 0x29
ud2
Function at 0x43b560
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov edx, 0xffffffff
cmp r9, rdx
cmovb rdx, r9
mov qword [rsp + 0x78], rcx
lea r9, [rsp + 0x80]
mov qword [rsp + 0x80], rax
test rcx, rcx
cmove r9, rcx
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x43b609
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x58]
cmp eax, 0x103
je 0x43b63f
test eax, eax
js 0x43b61a
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x43b632
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x78], 0
lea rax, [0x004c6ba0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [0x00492f80]
mov qword [rsp + 0x70], rax
lea rax, [0x004c7628]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa8]
call fcn.00434a10
mov rcx, rax
call fcn.00438ee0
mov ecx, 7
int 0x29
ud2

Function at 0x43b870
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x43b8a6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x0043a040]
mov qword [rsp + 0x48], rax
lea rax, [0x004c76c0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_sys_windows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.004ad990
ud2
Function at 0x43b930
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x43b9ae
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x43b9ef
cmp dword [rsp + 0x2c], 0
je 0x43b9d3
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x43ba1e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x004fb1b0]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x004fb1b0], rsi
jne 0x43b990
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x43b9e5
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x43ba74
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x43b9d8
mov edi, dword [rsp + 0x28]
jmp 0x43b9e5
mov edi, dword [rsi + 0x18]
jmp 0x43b9e3
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], 0
lea rax, str.library_std_src_sys_windows_thread_local_key.rs
mov qword [rsp + 0x20], rax
lea r8, [0x004c7710]
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x30]
xor ecx, ecx
call fcn.004392d0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x30], 0
lea rax, [0x004c6ba0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.004ad990
ud2
mov qword [rsp + 0x30], 0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rax, [0x004c6ba0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.00439420
ud2