joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp edx, 3
je 0x140017e18
test edx, edx
jne 0x140017f8f
mov rbx, qword [0x14079e100]
test rbx, rbx
je 0x140017f8f
xor r14d, r14d
jmp 0x140017e39
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140017e6d
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x140017fda
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140017e30
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140048824
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140017e30
test r14b, 1
je 0x140017f8f
mov rbx, qword [0x14079e100]
test rbx, rbx
je 0x140017f8f
xor r14d, r14d
jmp 0x140017e99
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140017ecd
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x140017fda
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140017e90
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140048824
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140017e90
test r14b, 1
je 0x140017f8f
mov rbx, qword [0x14079e100]
test rbx, rbx
je 0x140017f8f
xor r14d, r14d
jmp 0x140017ef9
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140017f2d
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x140017fda
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140017ef0
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140048824
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140017ef0
test r14b, 1
je 0x140017f8f
mov rbx, qword [0x14079e100]
test rbx, rbx
je 0x140017f8f
xor r14d, r14d
jmp 0x140017f59
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140017f89
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x140017fda
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140017f50
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140048824
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140017f50
test r14b, 1
jne 0x140017f9b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rbx, qword [0x14079e100]
jmp 0x140017fa8
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140017f8f
mov esi, dword [rbx + 0x18]
mov r14, qword [rbx]
test r14, r14
je 0x140017fda
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140017fa4
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140048824
mov rcx, rdi
call r14
jmp 0x140017fa4
lea rcx, str.library_std_src_syspalwindows_thread_local_key.rs
call sym.core::option::unwrap_failed::hc0851016c6838662
ud2
Function at 0x140017ff0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140018007
dec ecx
jmp 0x140018011
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov edx, 1
call fcn.140048824
cmp qword [rdi + 8], 0
je 0x14001803a
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14001803a
lock dec qword [rax]
jne 0x14001803a
mov rcx, qword [rdi + 0x10]
call sym.alloc::sync::Arc_T_A_::drop_slow::hc72eedd0a1b3284b
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140018052
dec ecx
jmp 0x14001805c
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
xor edx, edx
add rsp, 0x68
pop rdi
pop rsi
jmp fcn.140048824

Function at 0x140018450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14004b0b0]
test ecx, ecx
je 0x1400184e6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140018476
cmp byte [rax + 8], 0
jne 0x1400184d8
mov ecx, dword [0x14004b0b0]
test ecx, ecx
je 0x1400184f9
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400184de
test rax, rax
jne 0x1400184d2
movzx eax, byte [0x14079e030]
mov edx, 0x10
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hcb06944149433091
test rax, rax
je 0x140018522
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x14004b0b0]
test ecx, ecx
je 0x14001850c
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.140048824
mov rax, rsi
mov word [rax + 8], 1
add rax, 9
jmp 0x1400184e0
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140018465
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140018482
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov rsi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rsi
jmp 0x1400184c4
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
int3
Function at 0x140018ba0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x140796360]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140018c0a
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140018c36
test eax, eax
js 0x140018c17
mov rdx, qword [rsp + 0x68]
xor eax, eax
jmp 0x140018c2d
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.tcy_
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call sym.std::io::Write::write_fmt::h4096e092b1acc2d9
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call sym.core::ptr::drop_in_place_core::result::Result____std::io::error::Error__::hf1a2036a539b4597
mov ecx, 7
int 0x29
ud2

Function at 0x140019200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14004b070]
test ecx, ecx
je 0x1400192bd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140019230
cmp qword [rax + 8], 0
je 0x140019230
add rax, 0x10
jmp 0x1400192b7
mov ecx, dword [0x14004b070]
test ecx, ecx
je 0x1400192d0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400192b5
test rax, rax
jne 0x140019298
movzx eax, byte [0x14079e030]
mov edx, 0x20
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hcb06944149433091
test rax, rax
je 0x1400192f9
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14004b070]
test ecx, ecx
je 0x1400192e3
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.140048824
mov rax, rsi
mov qword [rax + 8], 1
mov rcx, rax
add rax, 0x10
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 0
jmp 0x1400192b7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140019215
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140019240
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov rsi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rsi
jmp 0x14001928a
mov ecx, 8
mov edx, 0x20
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
int3
Function at 0x140019370
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140019387
dec ecx
jmp 0x140019391
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov edx, 1
call fcn.140048824
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400193b3
dec ecx
jmp 0x1400193bd
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
xor edx, edx
add rsp, 0x68
pop rdi
pop rsi
jmp fcn.140048824
Function at 0x14001b280
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor esi, esi
mov edi, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x14001b310
jmp 0x14001b2ef
jae 0x14001b3be
cmp r8, 0x201
jae 0x14001b310
mov r14d, 0x200
lea r15, [rsp + 0x98]
mov r12, r8
jmp 0x14001b356
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x14001b337
lea rcx, [rsp + 0x28]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h652bddeb65308e11
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp rsi, rdi
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rsp + 0x38], rbx
mov r13, rsi
mov r14, rbx
mov r15, qword [rsp + 0x48]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x14001b37b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14001b423
mov r8d, ebp
cmp r12, r8
jne 0x14001b2e0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14001b450
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14001b2ef
jmp 0x14001b310
cmp r14, r8
jb 0x14001b46a
lea rcx, [rsp + 0x50]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::hbf8b2f0179ef5cb6
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x40]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rsp + 0x28], 0
je 0x14001b40e
mov rcx, qword [rsp + 0x30]
mov edx, 2
call sym.__rust_dealloc
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rsp + 0x28], 0
jne 0x14001b3ff
jmp 0x14001b40e
lea rcx, str.internal_error:_entered_unreachable_codeH_y_
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call sym.core::panicking::panic::hef3431a3c19424e4
jmp 0x14001b47f
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::h89faa5dda92f1452
ud2
Function at 0x14001d2e0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x88], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x90], xmm6
mov dword [rsp + 0xa0], 7
mov qword [rsp + 0xa4], 0
mov word [rsp + 0xac], 0
mov byte [rsp + 0xa8], 1
lea r8, [rsp + 0x88]
mov rcx, rdx
mov rdx, rax
call sym.std::sys::pal::windows::fs::File::open::h60b9ea54d13c2b6b
mov rdi, rdx
test rax, rax
je 0x14001d378
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
call sym.core::ptr::drop_in_place_std::io::error::Error_::ha5de4730a10cc339
mov qword [rsi], 0
jmp 0x14001d549
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileInformationByHandle
test eax, eax
je 0x14001d434
test dword [rsp + 0x40], 0x400
je 0x14001d3d9
mov qword [rsp + 0x80], 0
lea r8, [rsp + 0x80]
mov rcx, rdi
mov edx, 9
mov r9d, 8
call sub.KERNEL32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x14001d434
mov r12d, dword [rsp + 0x60]
mov r15d, dword [rsp + 0x64]
test rdi, rdi
je 0x14001d489
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x14001d50c
mov rbx, qword [rsp + 0x40]
jmp 0x14001d48b
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::ha5de4730a10cc339
mov qword [rsi], 0
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400489dc
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x14001d4fb
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.1400489dc
test r15, r15
je 0x14001d4fb
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x14001d541
mov qword [rsi], 0
mov rcx, rbx
call fcn.1400489dc
jmp 0x14001d541
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x88], 1
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call sym.core::ptr::drop_in_place_std::io::error::Error_::ha5de4730a10cc339
mov qword [rsi], 0
mov rcx, rdi
call fcn.1400489dc
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140038d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
mov ecx, dword [0x14004b0d0]
test ecx, ecx
je 0x140038df2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140038d30
cmp qword [rax + 8], 0
je 0x140038d30
add rax, 0x10
jmp 0x140038dec
mov ecx, dword [0x14004b0d0]
test ecx, ecx
je 0x140038e05
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140038dea
test rax, rax
jne 0x140038db0
mov qword [rsp + 0x30], 0
lea rax, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
mov qword [rsp + 0x28], rax
movzx eax, byte [0x14079e030]
mov edx, 0x18
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hcb06944149433091
test rax, rax
je 0x140038e31
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rax], xmm0
mov ecx, dword [0x14004b0d0]
test ecx, ecx
je 0x140038e18
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.140048824
mov rax, rsi
mov rdx, rax
add rax, 0x10
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 8], 0
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], 0
je 0x140038dec
test rcx, rcx
je 0x140038dec
lock dec qword [rcx]
jne 0x140038dec
mov rsi, rax
call sym.alloc::sync::Arc_T_A_::drop_slow::h5b9ed3ea51fafdab
mov rax, rsi
jmp 0x140038dec
xor eax, eax
add rsp, 0x40
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140038d15
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
jmp 0x140038d40
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
mov rsi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rsi
jmp 0x140038da2
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
ud2

Function at 0x140038ed0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140038ee7
dec ecx
jmp 0x140038ef1
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov edx, 1
call fcn.140048824
cmp qword [rdi + 8], 0
je 0x140038f1a
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140038f1a
lock dec qword [rax]
jne 0x140038f1a
mov rcx, qword [rdi + 0x10]
call sym.alloc::sync::Arc_T_A_::drop_slow::h5b9ed3ea51fafdab
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140038f32
dec ecx
jmp 0x140038f3c
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
xor edx, edx
add rsp, 0x68
pop rdi
pop rsi
jmp fcn.140048824
Function at 0x14003f460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x40]
call sym.std::sys::pal::windows::to_u16s::inner::h4c9a51427fa9952c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, rbx
jne 0x14003f49d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
jmp 0x14003f4ca
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call sym.std::sys::pal::windows::args::from_wide_to_user_path::h0b242e3f6b641f98
mov r14, qword [rsp + 0x28]
cmp r14, rbx
jne 0x14003f4e3
lea rcx, [rsp + 0x30]
call sym.core::ptr::drop_in_place_std::io::error::Error_::ha5de4730a10cc339
mov qword [rsi], rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14003f507
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14003f4d7
mov qword [rsi], rbx
test r14, r14
je 0x14003f4d7
mov edx, 2
mov rcx, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp sym.__rust_dealloc
Function at 0x1400493c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140049430
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14079e174]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400495c0
mov rax, qword [0x14079e178]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14004947c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140049505
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140049460
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x140049612
mov rax, qword [0x14079e178]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14079e178]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400495f5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400494fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140049570
add dword [0x14079e174], 1
cmp ebx, 8
jae 0x140049531
test bl, 4
jne 0x1400495d0
test ebx, ebx
je 0x140049526
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400495e4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140049526
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14004954a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x14079e178]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400494fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x140049487
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140049526
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140049526
mov rax, qword [0x14079e178]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]