joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x1400c276b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1400c276b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x1400c2786
cmp eax, 0x42
jne 0x1400c276b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400c2836
cmp byte [r8 + r11], 0x5f
jne 0x1400c2836
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1400c289e
mov rcx, rsi
xor edx, edx
call fcn.1400be110
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1400be110
test al, al
jne 0x1400c2931
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400c27c2
lea rdx, [0x14026ef93]
mov r8d, 1
call fcn.140033880
test al, al
jne 0x1400c2931
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400c277a
xor r14d, r14d
lea rbx, [0x14026f301]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400c27f4
cmp byte [rax + rcx], 0x45
je 0x1400c2953
sub r14, 1
jb 0x1400c2819
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400c2819
mov r8d, 2
mov rdx, rbx
call fcn.140033880
test al, al
jne 0x1400c2931
mov rcx, rsi
call fcn.1400bf940
test al, al
jne 0x1400c2931
mov rax, qword [rsi]
test rax, rax
jne 0x1400c27e0
jmp 0x1400c277a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x1400c28f8
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x1400c2892
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400c287c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400c286b
add dl, 0xa9
jmp 0x1400c287a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400c28f8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400c28f8
movzx edx, bl
add rax, rdx
jae 0x1400c2840
jmp 0x1400c28f8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400c28f8
cmp rax, rcx
jae 0x1400c28f5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1400c294b
cmp qword [rsi + 0x20], 0
je 0x1400c2944
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400c2710
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400c277c
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400c2939
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_____::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x14026f2e0]
test r9b, r9b
cmovne rdx, rax
call fcn.140033880
test al, al
je 0x1400c2939
mov dil, 2
jmp 0x1400c277a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1400c277a
mov dil, 1
xor r9d, r9d
jmp 0x1400c28fa
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400c277a
Function at 0x1400c5a15
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x88], 4
mov dword [rsp + 0xd0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400c5a7a
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0xb0], edx
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1400c5ab0
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x1400c5aa9
lea r9, [0x1402a1d74]
xor r10d, r10d
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp r8, r10
jne 0x1400c5a98
mov dword [rsp + 0xc0], edx
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400c5b00
mov rax, rsi
shr rax, 0x3c
jne 0x1400c5bc2
mov r14, qword [rcx]
lea rbx, [rsi*8]
mov ecx, 8
mov rdx, rbx
call fcn.1400c65b2
test rax, rax
je 0x1400c5bc9
mov rdi, rax
xor eax, eax
mov rcx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp rsi, rax
jne 0x1400c5aec
mov eax, esi
jmp 0x1400c5b07
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x88]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x14027205b]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
mov ebx, eax
test eax, eax
je 0x1400c5b60
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x1400c5ba4
movaps xmm0, xmmword [rsp + 0x50]
mov eax, 1
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x78], xmm0
mov ecx, 8
mov edx, 0x20
call fcn.1400c65b2
test rax, rax
je 0x1400c5bd8
mov rbx, rax
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor r14d, r14d
mov rcx, rdi
mov rdx, rsi
call fcn.1400fd262
mov rax, r14
mov rdx, rbx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14002fd60
ud2
mov ecx, 8
mov rdx, rbx
call fcn.14002fda0
ud2
lea r14, [rsp + 0x78]
mov ecx, 8
mov edx, 0x20
call fcn.14002fda0
ud2

Function at 0x1400c621a
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400c6243
mov rdx, qword [rsp + 0x20]
jmp 0x1400c624b
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x1400cb0c2
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400cb0ee
xor eax, eax
jmp 0x1400cb0f3
call fcn.140069e8e
nop
add rsp, 0x38
ret
Function at 0x1400cc650
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400cc6d5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1400cc716
cmp dword [rsp + 0x2c], 0
je 0x1400cc6fa
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400cc73e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1402f61c8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1402f61c8], rsi
jne 0x1400cc6b0
mov byte [0x1402f61c0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1400cc70c
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x1400cc78a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400cc6ff
mov edi, dword [rsp + 0x28]
jmp 0x1400cc70c
mov edi, dword [rsi + 0x18]
jmp 0x1400cc70a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x140276880]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.1400ccd70
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_store
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140032e60
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_store
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1400ccdb0
ud2
Function at 0x1400ccc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140225128]
test ecx, ecx
je 0x1400ccd20
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400ccc74
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400ccc74
add rdi, 0x10
jmp 0x1400ccd16
mov ecx, dword [0x140225128]
test ecx, ecx
je 0x1400ccd33
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400ccd14
mov rsi, rax
test rax, rax
jne 0x1400ccce3
movzx eax, byte [0x1402f6250]
mov ecx, 0x18
mov edx, 8
call fcn.14002dcc0
test rax, rax
je 0x1400ccd56
mov rsi, rax
lea rax, [0x140225110]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140225128]
test ecx, ecx
je 0x1400ccd46
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400ccd16
test rcx, rcx
je 0x1400ccd16
lock dec qword [rcx]
jne 0x1400ccd16
call fcn.1400cc600
jmp 0x1400ccd16
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140225110]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400ccc56
lea rcx, [0x140225110]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400ccc84
lea rcx, [0x140225110]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400cccdb
mov ecx, 8
mov edx, 0x18
call fcn.14002fda0
ud2

Function at 0x1400cd3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140225148]
test ecx, ecx
je 0x1400cd43f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400cd3c9
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1400cd42e
mov ecx, dword [0x140225148]
test ecx, ecx
je 0x1400cd452
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400cd434
mov rsi, rax
test rax, rax
jne 0x1400cd428
movzx eax, byte [0x1402f6250]
mov ecx, 0x10
mov edx, 8
call fcn.14002dcc0
test rax, rax
je 0x1400cd475
mov rsi, rax
lea rax, [0x140225130]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x140225148]
test ecx, ecx
je 0x1400cd465
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400cd436
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140225130]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400cd3b5
lea rcx, [0x140225130]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400cd3d5
lea rcx, [0x140225130]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400cd420
mov ecx, 8
mov edx, 0x10
call fcn.14002fda0
ud2
Function at 0x1400cd9e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1402761a8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1400cda51
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400cda87
test eax, eax
js 0x1400cda62
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400cda7a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140276208]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400cca60
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400cbdc0
mov ecx, 7
int 0x29
ud2

Function at 0x1400ce040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140225108]
test ecx, ecx
je 0x1400ce0fd
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400ce070
cmp qword [rax + 8], 0
je 0x1400ce070
add rax, 0x10
jmp 0x1400ce0f7
mov ecx, dword [0x140225108]
test ecx, ecx
je 0x1400ce110
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400ce0f5
mov rsi, rax
test rax, rax
jne 0x1400ce0db
movzx eax, byte [0x1402f6250]
mov ecx, 0x20
mov edx, 8
call fcn.14002dcc0
test rax, rax
je 0x1400ce133
mov rsi, rax
lea rax, [0x1402250f0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140225108]
test ecx, ecx
je 0x1400ce123
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x1400ce0f7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402250f0]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400ce055
lea rcx, [0x1402250f0]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400ce080
lea rcx, [0x1402250f0]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400ce0d3
mov ecx, 8
mov edx, 0x20
call fcn.14002fda0
ud2
Function at 0x1400d1890
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.1400ea180
mov rdi, rdx
test rax, rax
je 0x1400d1920
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.1400cbd20
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1400ea3a0
cmp dword [rsp + 0x38], 2
jne 0x1400d194f
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1400d199b
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x1400d19c7
lea rcx, [rsp + 0x88]
call fcn.1400cbd20
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.14011d1e4
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x1400d1a25
mov qword [rsp + 0x80], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1400d1aa1
mov rbx, qword [rsp + 0x80]
jmp 0x1400d1a27
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1400d1a90
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.14011d1e4
test r15, r15
je 0x1400d1a90
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x1400d1acd
mov qword [rsi], 0
mov rcx, rbx
call fcn.14011d1e4
jmp 0x1400d1acd
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1400cbd20
mov qword [rsi], 0
mov rcx, rdi
call fcn.14011d1e4
jmp 0x1400d190f
Function at 0x1400eaae0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
lea rcx, [rsp + 0xa8]
call fcn.1400ce680
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400eac4b
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x1400eaba0
jmp 0x1400eab7f
jae 0x1400eac61
cmp r8, 0x201
jae 0x1400eaba0
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x1400eabe7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x1400eabc7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1400cea80
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x1400eac12
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400eac96
mov r8d, r15d
cmp r12, r8
jne 0x1400eab70
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400ead22
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x1400eab7f
jmp 0x1400eaba0
lea rcx, [rsp + 0xb0]
call fcn.1400cbd20
mov byte [rsi + 0x18], 2
jmp 0x1400eacf2
cmp rdi, r8
jb 0x1400ead3c
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.1400d0100
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x1400eacad
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 2
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x1400eacc6
mov edx, 2
mov rcx, qword [rsp + 0x28]
call fcn.14002dd50
cmp byte [rsp + 0x78], 2
jne 0x1400ead07
mov byte [rsi + 0x18], 2
lea rcx, [rsp + 0x60]
call fcn.1400cbd20
cmp qword [rsp + 0x40], 0
je 0x1400eacf2
mov edx, 2
mov rcx, qword [rsp + 0x30]
call fcn.14002dd50
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x1400eace3
jmp 0x1400eacf2
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140033ba0
jmp 0x1400ead51
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.140033800
ud2

Function at 0x1400ecd50
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1402761a8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x11
and al, 0x38
Function at 0x1400ed080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x1400ed0dc
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x1400ed1d1
test r15w, r15w
je 0x1400ed0dc
cmp r15w, 0x2e
jne 0x1400ed1d1
test r12w, r12w
jne 0x1400ed1d1
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov rdx, r14
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x1400ed1b7
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
jmp 0x1400ed133
mov rcx, rdi
mov rdx, rbx
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x1400ed1b7
cmp word [rsp + 0xac], 0x2e
jne 0x1400ed15c
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x1400ed120
cmp ax, 0x2e
jne 0x1400ed15c
cmp word [rsp + 0xb0], 0
je 0x1400ed120
lock inc qword [r14]
jle 0x1400ed2b9
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x1400ed1fc
call sub.kernel32.dll_GetLastError
cmp eax, 0x12
jne 0x1400ed248
mov qword [rsi], 0
jmp 0x1400ed2a7
lock inc qword [r14]
jle 0x1400ed2b9
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
jmp 0x1400ed25a
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call sub.msvcrt.dll_memcpy
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x1400eff10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140225168]
test ecx, ecx
je 0x1400efff0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400eff44
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400eff44
add rdi, 0x10
jmp 0x1400effe6
mov ecx, dword [0x140225168]
test ecx, ecx
je 0x1400f0003
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400effe4
mov rsi, rax
test rax, rax
jne 0x1400effb3
movzx eax, byte [0x1402f6250]
mov ecx, 0x18
mov edx, 8
call fcn.14002dcc0
test rax, rax
je 0x1400f0026
mov rsi, rax
lea rax, [0x140225150]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140225168]
test ecx, ecx
je 0x1400f0016
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400effe6
test rcx, rcx
je 0x1400effe6
lock dec qword [rcx]
jne 0x1400effe6
call fcn.1400f0040
jmp 0x1400effe6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140225150]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400eff26
lea rcx, [0x140225150]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400eff54
lea rcx, [0x140225150]
call fcn.1400cc650
mov ecx, eax
jmp 0x1400effab
mov ecx, 8
mov edx, 0x18
call fcn.14002fda0
ud2