joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d5580
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov rsi, qword [rsp + 0x88]
mov r15, r9
mov rbp, qword [rsp + 0x80]
mov r12, r8
mov rdi, rcx
mov byte [rsi], 0xff
test rbp, rbp
je 0x1801d56ee
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r14
rdtsc
mov rcx, qword [rcx + 0x119718]
shl rdx, 0x20
or rax, rdx
mov dword [rsp + 0x20], 7
mov rbx, rax
mov rdx, rbp
mov rax, qword [0x180598590]
call qword [case.0x180097796.0]
mov r14d, eax
rdtsc
mov rcx, qword [rdi + 0x119758]
shl rdx, 0x20
or rdx, rax
sub rdx, rbx
mov rbx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rdi + 0x119758], rcx
mov rcx, qword [rdi + 0x119750]
inc rcx
mov qword [rdi + 0x119750], rcx
mov rcx, qword [rdi + 0x119760]
cmp rcx, rdx
jae 0x1801d5636
mov qword [rdi + 0x119760], rdx
mov rax, qword [rdi + 0x119768]
cmp rax, rdx
jbe 0x1801d5649
mov qword [rdi + 0x119768], rdx
test r14d, r14d
js 0x1801d5656
mov byte [rsi], 3
jmp 0x1801d56e9
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d56aa
mov qword [rsp + 0x38], 0
lea rdx, str.void___cdecl_NEMHCNotifyHandlerPhysicalDeregister_struct_VM__enum_PGMPHYSHANDLERKIND_unsigned___int64_unsigned___int64_void__unsigned_char__
mov qword [rsp + 0x30], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3.._VMMAll_NEMAllNativeTemplate_win.cpp.h
mov dword [rsp + 0x28], 0xaea
mov qword [rsp + 0x20], rdx
mov r8d, 0x155
mov edx, 0x10
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d56e9
mov dword [rsp + 0x38], r14d
lea r9, str.NEMHCNotifyHandlerPhysicalDeregister:_WHvMapGpaRange___p__RGp__RGp_______Rhrc_n
mov qword [rsp + 0x30], r15
mov edx, 0x10
mov qword [rsp + 0x28], r12
mov r8d, 0x155
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
Function at 0x1801d5710
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
cmp byte [r8], 1
mov rsi, r8
mov r14, rdx
mov rdi, rcx
ja 0x1801ce506
mov byte [r8], 1
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
rdtsc
mov rcx, qword [rcx + 0x119718]
mov r8d, 0x1000
shl rdx, 0x20
or rax, rdx
mov rdx, r14
mov rbx, rax
and rdx, 0xfffffffffffff000
mov rax, qword [0x180598598]
call qword [case.0x180097796.0]
mov ebp, eax
rdtsc
mov rcx, qword [rdi + 0x1197b8]
shl rdx, 0x20
or rdx, rax
sub rdx, rbx
mov rbx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rdi + 0x1197b8], rcx
mov rcx, qword [rdi + 0x1197b0]
inc rcx
mov qword [rdi + 0x1197b0], rcx
mov rcx, qword [rdi + 0x1197c0]
cmp rcx, rdx
jae 0x1801ce588
mov qword [rdi + 0x1197c0], rdx
mov rax, qword [rdi + 0x1197c8]
cmp rax, rdx
jbe 0x1801ce59b
mov qword [rdi + 0x1197c8], rdx
test ebp, ebp
js 0x1801ce5be
mov rax, qword [rdi + 0x119738]
inc rax
mov qword [rdi + 0x119738], rax
lock dec dword [rdi + 0x119728]
xor eax, eax
mov byte [rsi], 1
jmp 0x1801ce62f
mov rax, qword [rdi + 0x119748]
mov ecx, 0x1550010
inc rax
mov qword [rdi + 0x119748], rax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801ce62a
mov rcx, qword gs:[0x30]
lea r9, str.nemHCJustUnmapPageFromHyperV__RGp_:_failed__hrc_Rhrc___x__Last_x__u_n
mov rdx, qword gs:[0x30]
mov r8d, 0x155
mov ecx, dword [rcx + 0x68]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rdx + 0x1250]
mov edx, 0x10
mov dword [rsp + 0x38], ecx
mov rcx, rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xffffe510
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov r8, qword [rsp + 0x40]
jmp 0x1801ce4d0

Function at 0x1801d5720
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8, qword [rsp + 0x38]
jmp 0x1801ce4d0
Function at 0x1801d6250
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, qword [rsp + 0xa0]
mov rbp, r9
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov byte [rsi], 0xff
test r9, r9
je 0x1801d6325
mov qword [rax + 8], rbx
rdtsc
mov rcx, qword [rcx + 0x119718]
mov r9, r8
shl rdx, 0x20
mov r8, r12
or rax, rdx
mov dword [rsp + 0x20], 7
mov rbx, rax
mov rdx, rbp
mov rax, qword [0x180598590]
call qword [case.0x180097796.0]
mov r14d, eax
rdtsc
mov rcx, qword [rdi + 0x119758]
shl rdx, 0x20
or rdx, rax
sub rdx, rbx
mov rbx, qword [rsp + 0x80]
add rcx, rdx
mov qword [rdi + 0x119758], rcx
mov rcx, qword [rdi + 0x119750]
inc rcx
mov qword [rdi + 0x119750], rcx
mov rcx, qword [rdi + 0x119760]
cmp rcx, rdx
jae 0x1801d630a
mov qword [rdi + 0x119760], rdx
mov rax, qword [rdi + 0x119768]
cmp rax, rdx
jbe 0x1801d631d
mov qword [rdi + 0x119768], rdx
test r14d, r14d
js 0x1801d6342
mov byte [rsi], 3
xor eax, eax
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d63a9
mov rcx, qword gs:[0x30]
lea r9, str.NEMR3NotifyPhysRamRegister:_GCPhys_RGp_LB__RGp_pvR3_p_hrc_Rhrc___x__Last_x__u_n
mov rdx, qword gs:[0x30]
mov r8d, 0x155
mov ecx, dword [rcx + 0x68]
mov dword [rsp + 0x50], ecx
mov ecx, dword [rdx + 0x1250]
mov edx, 0x10
mov dword [rsp + 0x48], ecx
mov rcx, rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rax, qword [rdi + 0x119740]
inc rax
mov qword [rdi + 0x119740], rax
mov eax, 0xffffe56a
jmp 0x1801d6327
Function at 0x1801d63f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r14, qword [rsp + 0xa8]
mov rsi, r9
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov byte [r14], 0xff
cmp r9, 0x1000
jb 0x1801d6588
movabs rax, 0xffff800000000000
test rax, r9
jne 0x1801d6588
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
rdtsc
mov rcx, qword [rcx + 0x119718]
mov r9, r8
shl rdx, 0x20
mov r8, r12
or rax, rdx
mov dword [rsp + 0x20], 5
mov rbx, rax
mov rdx, rsi
mov rax, qword [0x180598590]
call qword [case.0x180097796.0]
mov ebp, eax
rdtsc
mov rcx, qword [rdi + 0x119758]
shl rdx, 0x20
or rdx, rax
sub rdx, rbx
mov rbx, qword [rsp + 0x80]
add rcx, rdx
mov qword [rdi + 0x119758], rcx
mov rcx, qword [rdi + 0x119750]
inc rcx
mov qword [rdi + 0x119750], rcx
mov rcx, qword [rdi + 0x119760]
cmp rcx, rdx
jae 0x1801d64c1
mov qword [rdi + 0x119760], rdx
mov rax, qword [rdi + 0x119768]
cmp rax, rdx
jbe 0x1801d64d4
mov qword [rdi + 0x119768], rdx
test ebp, ebp
js 0x1801d64fd
mov byte [r14], 2
xor eax, eax
mov rbp, qword [rsp + 0x88]
lea r11, [rsp + 0x60]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d656d
mov rcx, qword gs:[0x30]
lea r9, str.nemR3NativeNotifyPhysRomRegisterEarly:_GCPhys_RGp_LB__RGp_pvPages_p_fFlags_x_hrc_Rhrc___x__Last_x__u_n
mov rdx, qword gs:[0x30]
mov r8d, 0x155
mov ecx, dword [rcx + 0x68]
mov dword [rsp + 0x58], ecx
mov ecx, dword [rdx + 0x1250]
mov edx, 0x10
mov dword [rsp + 0x50], ecx
mov ecx, dword [rsp + 0xa0]
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ecx
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rax, qword [rdi + 0x119740]
inc rax
mov qword [rdi + 0x119740], rax
mov eax, 0xffffe56a
jmp 0x1801d64de
mov eax, 0xfffffffa
jmp 0x1801d64e6
Function at 0x1801f7cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rdi
push r13
sub rsp, 0x58
mov qword [rax + 8], rsi
mov r13, r9
mov qword [rax - 0x28], r12
mov rdi, rdx
mov qword [rax - 0x38], r15
mov r12, rcx
call sym.VBoxVMM.dll_DBGFR3FlowItNext
xor ebp, ebp
mov rsi, rax
mov r15d, ebp
test rax, rax
je 0x1801f7e63
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0x48], r14
mov edx, r15d
lea rcx, [rdx + rdx*8]
lea rdi, [rcx*8]
mov rcx, rsi
add rdi, r13
call sym.VBoxVMM.dll_DBGFR3FlowBbGetFlags
mov rcx, rsi
mov ebx, eax
call sym.VBoxVMM.dll_DBGFR3FlowBbGetInstrCount
lea rdx, [rdi + 8]
mov qword [rdi], rsi
mov r14d, eax
mov dword [rdi + 0x38], ebp
lea ecx, [rax + 4]
mov dword [rdi + 0x3c], ecx
mov rcx, rsi
call sym.VBoxVMM.dll_DBGFR3FlowBbGetStartAddress
mov rcx, rsi
call sym.VBoxVMM.dll_DBGFR3FlowBbGetType
add eax, 0xfffffffc
cmp eax, 2
ja 0x1801f7d6b
lea rdx, [rdi + 0x20]
mov rcx, rsi
call sym.VBoxVMM.dll_DBGFR3FlowBbGetBranchAddress
test bl, 4
je 0x1801f7dcc
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov rcx, rsi
call sym.VBoxVMM.dll_DBGFR3FlowBbQueryError
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1801f7dcc
inc dword [rdi + 0x3c]
mov rax, 0xffffffffffffffff
mov edx, dword [rdi + 0x38]
nop dword [rax]
inc rax
cmp byte [rcx + rax], bpl
jne 0x1801f7da0
cmp edx, eax
jb 0x1801f7db1
mov eax, edx
jmp 0x1801f7dc9
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bpl
jne 0x1801f7dc0
mov dword [rdi + 0x38], eax
mov ebx, ebp
test r14d, r14d
je 0x1801f7e33
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call sym.VBoxVMM.dll_DBGFR3FlowBbQueryInstr
mov edx, dword [rdi + 0x38]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
inc rax
cmp byte [rcx + rax], bpl
jne 0x1801f7e01
cmp edx, eax
jb 0x1801f7e12
mov eax, edx
jmp 0x1801f7e29
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bpl
jne 0x1801f7e20
inc ebx
mov dword [rdi + 0x38], eax
cmp ebx, r14d
jb 0x1801f7dd3
add dword [rdi + 0x38], 4
mov rcx, r12
inc r15d
call sym.VBoxVMM.dll_DBGFR3FlowItNext
mov rsi, rax
test rax, rax
jne 0x1801f7d10
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x80]
test r13, r13
je 0x1801f7ec6
mov rcx, rdi
call sym.VBoxVMM.dll_DBGFR3FlowBranchTblItNext
test rax, rax
je 0x1801f7ec6
nop word [rax + rax]
mov ecx, ebp
lea rbx, [rcx + rcx*2]
mov rcx, rax
add rbx, rbx
mov qword [r13 + rbx*8], rax
call sym.VBoxVMM.dll_DBGFR3FlowBranchTblGetSlots
add eax, 4
mov dword [r13 + rbx*8 + 0x20], 0x1d
mov rcx, rdi
mov dword [r13 + rbx*8 + 0x24], eax
inc ebp
call sym.VBoxVMM.dll_DBGFR3FlowBranchTblItNext
test rax, rax
jne 0x1801f7e90
xor eax, eax
add rsp, 0x58
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x140001910
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140010b30
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle fcn.140010b60
cmp qword [rcx + 0x40], 0
js fcn.140010b60
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp fcn.14000e7b0

Function at 0x140010b60
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x140010bb5
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140010c65
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x14005c0c0]
test rax, rax
je 0x140010c9a
and eax, 0x4000
xor ecx, ecx
lea rbx, [rsp + 0x70]
or rax, rcx
je 0x140010c00
lea r8, [0x140051ce8]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140010a40
jmp 0x140010c22
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rdi + 0x30]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.14000e7b0
nop
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx eax, byte [0x14005c0c8]
mov ecx, 4
call fcn.140042720
test rax, rax
je 0x140010ca4
and ebx, 0x7fffffff
mov dword [rax], ebx
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
mov rax, qword [rdi + 0x30]
jmp 0x140010c3c
call fcn.140045470
jmp 0x140010bd9
mov ecx, 4
mov edx, 4
call fcn.140007930
int3
Function at 0x140014fc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140014fe5
cmp rax, rcx
je 0x140014feb
cmp rdx, 4
jae 0x140014fef
xor eax, eax
xor r8d, r8d
jmp 0x140015080
pop rbp
jmp fcn.140008460
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14004e5a0]
movdqa xmm3, xmmword [0x14004e5b0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140015010
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140015097
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140015080
pop rbp
ret
Function at 0x14001c730
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140054230]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14001c79f
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001c7cb
test eax, eax
js 0x14001c7ab
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001c7c1
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140054290]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14001bf10
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14001c050
mov ecx, 7
int 0x29
ud2

Function at 0x14001d7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x14004d0a0]
test esi, esi
je 0x14001d877
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14001d86e
je 0x14001d819
test rdi, rdi
je 0x14001d81d
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x14001d81f
mov rbx, qword [rdi + 8]
jmp 0x14001d81f
xor eax, eax
jmp 0x14001d86e
xor ebx, ebx
movzx eax, byte [0x14005c0c8]
mov ecx, 0x10
call fcn.140042720
test rax, rax
je 0x14001d898
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14001d86b
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14004d088]
call fcn.14001da80
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001d7fd
jmp 0x14001d86e
mov ecx, 8
mov edx, 0x10
call fcn.140007930
int3
Function at 0x14001d8b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x14004d0c0]
test esi, esi
je 0x14001d956
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14001d94d
je 0x14001d94b
movzx eax, byte [0x14005c0c8]
mov ecx, 0x10
call fcn.140042720
test rax, rax
je 0x14001d977
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14001d946
mov rax, qword [rdi]
test rax, rax
je 0x14001d935
lock dec qword [rax]
jne 0x14001d935
mov rcx, rdi
call fcn.14001b930
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rax, rsi
jmp 0x14001d94d
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14004d0a8]
call fcn.14001da80
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001d8da
jmp 0x14001d94d
mov ecx, 8
mov edx, 0x10
call fcn.140007930
int3

Function at 0x14001da80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x14001db15
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x14001db54
cmp dword [rbp], 0
je 0x14001db38
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14001db69
mov edi, eax
mov rax, qword [0x14005e038]
mov rax, qword [0x14005c0b8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14005c0b8], rsi
jne 0x14001daf0
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x14001db49
call sub.kernel32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x14001dbab
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001db3d
mov edi, dword [rbp + 4]
jmp 0x14001db49
mov edi, dword [rsi + 0x18]
jmp 0x14001db47
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.14001dbe0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call fcn.140008190
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.14001dc30
int3
Function at 0x14001e510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x14004d080]
test esi, esi
je 0x14001e59c
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14001e593
je 0x14001e591
movzx eax, byte [0x14005c0c8]
mov ecx, 0x18
call fcn.140042720
test rax, rax
je 0x14001e5bd
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14001e58c
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rax, rsi
jmp 0x14001e593
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14004d068]
call fcn.14001da80
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001e536
jmp 0x14001e593
mov ecx, 8
mov edx, 0x18
call fcn.140007930
int3
Function at 0x140020da0
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov rax, r8
mov rdi, rcx
mov dword [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 7
mov qword [rbp - 0x2c], 0
mov word [rbp - 0x24], 0
mov byte [rbp - 0x28], 1
lea r8, [rbp - 0x48]
mov rcx, rdx
mov rdx, rax
call fcn.14003dbc0
mov rsi, rdx
test rax, rax
je 0x140020e62
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x140020e56
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x140020e22
mov rcx, rbx
call rax
cmp qword [r14 + 8], 0
je 0x140020e45
cmp qword [r14 + 0x10], 0x11
jb 0x140020e34
mov rbx, qword [rbx - 8]
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov qword [rdi], 0
jmp 0x140020fcd
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.14003de40
cmp dword [rbp - 0x48], 2
jne 0x140020eef
mov rax, qword [rbp - 0x40]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x140020ecf
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rax, qword [r15]
test rax, rax
je 0x140020e9b
mov rcx, r14
call rax
cmp qword [r15 + 8], 0
je 0x140020ebe
cmp qword [r15 + 0x10], 0x11
jb 0x140020ead
mov r14, qword [r14 - 8]
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x14005c0b0]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rbp - 0x10]
test rsi, rsi
je 0x140020f3d
mov qword [rbp - 0x48], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x140020fb9
mov rbx, qword [rbp - 0x48]
jmp 0x140020f3f
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x140020fa8
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x140020fa8
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x140020fc5
mov qword [rdi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x140020fc5
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret