joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9d50
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400a9ef8
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400a9db5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400a9db5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400a9db5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400a9dec
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400a9e42
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a9e42
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a9e42
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a9e42
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a9e42
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400a9800
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400a9ea4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140085f60
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400a9bd0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400a9ef0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140085f60
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ab660
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400f3080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400ab6f5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400ab756
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140085f60
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400bf810
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400ab811
sub ecx, 1
je 0x1400ab884
sub ecx, 1
je 0x1400ab7c0
cmp ecx, 1
je 0x1400ab7a3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400d76dc]
call fcn.140085f60
jmp 0x1400ab884
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400ab390
test eax, eax
je 0x1400ab884
jmp 0x1400ab72a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400ab884
sub rax, rsi
cmp rax, rbp
jae 0x1400ab884
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400860e0
jmp 0x1400ab884
cmp r8d, 4
jle 0x1400ab884
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400ab884
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140085e80
mov esi, eax
test eax, eax
je 0x1400ab863
mov edx, 5
mov rcx, rbx
call fcn.1400ac350
mov eax, esi
jmp 0x1400ab72a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140094780
mov rcx, r14
call fcn.140094a60
test eax, eax
je 0x1400ab728
mov edx, 5
mov rcx, rbx
call fcn.1400ac350
mov eax, Ordinal_45
jmp 0x1400ab72a
Function at 0x1400be620
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [0x1400f3020]
mov rdi, rax
test rax, rax
jne 0x1400be662
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400be6a9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400be702
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400be6c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400be743
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400d25ba]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400d25bb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400be710
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400be760
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400be79a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400be79f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400be7e8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400be7e8
dec r8
sub rdx, 1
jne 0x1400be7ce
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400c0078
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c00c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c00c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c00c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c00c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c00c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c00c4
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400cdc60]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400cdc70]
mov dword [rax], 1
mov rax, qword [0x1400cdc80]
mov dword [rax], 1
mov rax, qword [0x1400cdbe0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400cdc50]
mov dword [0x1400e100c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400cdd30]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400cdd10]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400cdbc0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [str.0R_n_]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001880
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r14, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call sym.___str_u16__as_std::net::socket_addr::ToSocketAddrs_::to_socket_addrs::he2ea203f569d639a
mov rax, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
test rax, rax
je 0x1400019ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rsi, qword [rsp + 0x58]
cmp r15, rsi
je 0x1400019cf
lea rdi, [rsp + 0x42]
xor ebx, ebx
lea r13, [rsp + 0x40]
jmp 0x140001915
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call sym.__rust_dealloc
add r15, 0x20
mov rbx, r12
cmp r15, rsi
je 0x1400019d2
movzx eax, word [r15]
movups xmm0, xmmword [r15 + 0x10]
movups xmmword [rsp + 0x6e], xmm0
movups xmm0, xmmword [r15 + 2]
movaps xmmword [rsp + 0x60], xmm0
cmp ax, 2
je 0x140001a00
mov word [rsp + 0x40], ax
movups xmm0, xmmword [rsp + 0x6e]
movups xmmword [rdi + 0xe], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rdi], xmm0
mov rcx, r14
xor edx, edx
mov r8, r13
call sym.std::sys_common::net::UdpSocket::connect::h681a6a9756be6100
mov r12, rax
test rax, rax
je 0x140001a0f
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x140001905
lea rax, [rbx - 1]
mov qword [rsp + 0x38], rax
mov rbp, qword [rbx - 1]
mov rbx, qword [rbx + 7]
mov rax, qword [rbx]
test rax, rax
je 0x14000198e
mov rcx, rbp
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400018f0
mov r8, qword [rbx + 0x10]
mov rcx, rbp
call sym.__rust_dealloc
jmp 0x1400018f0
mov edx, 1
mov rcx, r14
mov r8, r15
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.std::sys_common::net::UdpSocket::connect::h681a6a9756be6100
xor r12d, r12d
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1400019f0
shl rdx, 5
mov r8d, 4
mov rcx, qword [rsp + 0x30]
call sym.__rust_dealloc
test r12, r12
lea rax, str.could_not_resolve_to_any_addresses
cmovne rax, r12
jmp 0x140001a7a
mov r12, rbx
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x1400019dc
jmp 0x1400019f0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140001a2d
shl rdx, 5
mov r8d, 4
mov rcx, qword [rsp + 0x30]
call sym.__rust_dealloc
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x140001a78
lea rsi, [rbx - 1]
mov rdi, qword [rbx - 1]
mov rbx, qword [rbx + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140001a50
mov rcx, rdi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140001a65
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call sym.__rust_dealloc
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
xor eax, eax
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003d40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call sym.__rand_core::os::OsRng_as_rand_core::RngCore_::try_fill_bytes::h16d8f2d59290fd35
test rax, rax
je 0x140003da2
mov rbx, rax
mov r14, rdx
mov rax, qword [rdx]
test rax, rax
je 0x140003d8b
mov rcx, rbx
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140003dfa
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call sym.__rust_dealloc
jmp 0x140003dfa
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x1400a8238]
lea rdx, [rsp + 0x40]
mov r9d, 8
call sym.rand_chacha::guts::init_chacha::hc4875e31aa072773
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.rand_chacha::guts::refill_wide::h54a29a11c4c711a5

Function at 0x1400047d0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004810
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14000482f
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004840
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a8880]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004884
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400048a3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x1400048b0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a8890]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400048f4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004913
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004920
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88a0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004964
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004983
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004990
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88b0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400049d4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400049f3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004a00
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88c0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004a44
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004a63
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x140004a70
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88d0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004ab4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004ad3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004ae0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88e0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004b24
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004b43
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004b50
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a88f0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004b94
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004bb3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004bc0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a8900]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004c04
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004c23
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x140004c30
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a8910]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004c74
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004c93
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004ca0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a8920]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004ce4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004d03
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h9bfb2951764e4dac
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140005590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, section..data
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h1f3cbaeaf9e75e11

Function at 0x1400055a0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rdi]
dec qword [rax]
jne 0x1400055d9
dec qword [rax + 8]
jne 0x1400055d9
mov edx, 0x170
mov r8d, 0x10
mov rcx, rax
call sym.__rust_dealloc
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
call sym.std::sys::thread_local::guard::windows::enable::h3f4e6a37e99397f9
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400090a0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140009106
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x1400090c8
add rdi, rbx
sub rsi, rbx
je 0x140009106
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400090c0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400090c0
and ebp, 0x7fffffff
jmp 0x140009108
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret