joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038960
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rdi, r9
mov r14, r8
mov rsi, rcx
mov rbx, qword [rsp + 0x280]
movups xmm0, xmmword [0x140163020]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x140163010]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x140163000]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140162ff0]
movups xmmword [rsp + 0x30], xmm0
lea rax, [0x140162fc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xf8], 0
lea r15, [rsp + 0x28]
mov r8d, 0x20
mov rcx, r15
call fcn.14002d510
mov r8d, 0x20
mov rcx, r15
mov rdx, r14
call fcn.14002d510
mov rcx, r15
mov rdx, rdi
mov r8, rbx
call fcn.14002d510
lea rcx, [rsp + 0x158]
mov r8d, 0xd8
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x158]
mov r9, qword [rax + 0x20]
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmm3, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x130], xmm3
movaps xmmword [rsp + 0x120], xmm2
movaps xmmword [rsp + 0x110], xmm1
movaps xmmword [rsp + 0x100], xmm0
cmp r9, 0x81
jae 0x140038ae3
lea r8, [rsp + 0x1a8]
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.14002d2c0
nop
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_ring_0.17.8_src_digest.rs
mov edx, pe_nt_image_headers64
mov rcx, r9
call fcn.140004b30
ud2

Function at 0x14003c9a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.1400046c0
cmp rax, rcx
je 0x14003c9c5
cmp rdx, 4
jae 0x14003c9c8
xor eax, eax
xor r8d, r8d
jmp 0x14003ca60
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140141f10]
movdqa xmm3, xmmword [0x140141f20]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14003c9f0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14003ca77
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14003ca60
ret
Function at 0x14003da10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14003da6b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14003da6b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14003da86
cmp eax, 0x42
jne 0x14003da6b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14003db36
cmp byte [r9 + r11], 0x5f
jne 0x14003db36
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14003db9e
mov rcx, rsi
xor edx, edx
call fcn.140039110
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140039110
test al, al
jne 0x14003dc31
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003dac2
lea rdx, [0x1401634e2]
mov r8d, 1
call fcn.140004bb0
test al, al
jne 0x14003dc31
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14003da7a
xor r14d, r14d
lea rbx, [0x140163896]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14003daf4
cmp byte [rax + rcx], 0x45
je 0x14003dc5a
sub r14, 1
jb 0x14003db19
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003db19
mov r8d, 2
mov rdx, rbx
call fcn.140004bb0
test al, al
jne 0x14003dc31
mov rcx, rsi
call fcn.14003a9a0
test al, al
jne 0x14003dc31
mov rax, qword [rsi]
test rax, rax
jne 0x14003dae0
jmp 0x14003da7a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14003dbf8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14003db92
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14003db7c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14003db6b
add dl, 0xa9
jmp 0x14003db7a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14003dbf8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14003dbf8
movzx edx, bl
add rax, rdx
jae 0x14003db40
jmp 0x14003dbf8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14003dbf8
cmp rax, rcx
jae 0x14003dbf5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14003dc39
cmp qword [rsi + 0x20], 0
je 0x14003dc53
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14003da10
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14003da7c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14003dc48
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x140163858]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.140004bb0
test al, al
je 0x14003dc48
mov dil, 2
jmp 0x14003da7a
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x14003dc03
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14003da7a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14003da7a
Function at 0x140041ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
mov rcx, qword [rax + 0x10]
mov r8, rdx
sub r8, rcx
jb 0x1400426ef
cmp r8, 2
jb 0x140041f71
mov r9, rcx
add r9, 2
jb 0x1400426d5
mov qword [rax + 0x10], r9
mov r10, rdx
sub r10, r9
jb 0x140042728
mov r8, r9
sub r8, rcx
cmp r8, 2
jne 0x140041f71
mov r8, qword [rax]
movzx ecx, word [r8 + rcx]
rol cx, 8
movzx ecx, cx
cmp r10, rcx
jae 0x140041fbc
mov qword [rsi + 8], 0xa
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
jmp 0x140041fa1
lea rax, [0x140167d71]
mov rcx, rax
shr rcx, 0x30
mov word [rsi + 0x16], cx
mov rcx, rax
shr rcx, 0x10
mov dword [rsi + 0x12], ecx
mov qword [rsi + 0x18], 2
mov qword [rsi + 8], 0xb
mov word [rsi + 0x10], ax
mov qword [rsi], 1
add rcx, r9
jb 0x1400426d5
mov qword [rax + 0x10], rcx
cmp rcx, rdx
ja 0x140042709
sub rcx, r9
add r8, r9
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x70], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov r14d, 8
xor r15d, r15d
lea rdx, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x88], r8
mov dword [rsp + 0x54], r8d
jmp 0x1400420d3
lea r8, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rustls_0.22.4_src_msgs_codec.rs
mov rcx, r9
call fcn.140004b30
ud2
Function at 0x140086000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140086042
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14008604a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14008605b
jmp 0x140086072
xor r10d, r10d
jmp 0x1400860fd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140086072
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140086089
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400860a9
add r11, r8
jmp 0x1400861da
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140086172
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140086120
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140086190
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400861a2
jmp 0x1400861bc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400861bc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400861d6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008c400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x1401400b0]
test ecx, ecx
je 0x14008c430
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14008c449
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14008c449
add rdi, 0x10
jmp 0x14008c53e
lea rcx, [0x140140098]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14008c41d
mov ecx, dword [0x1401400b0]
test ecx, ecx
je 0x14008c51f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14008c53c
mov rsi, rax
test rax, rax
jne 0x14008c4ee
mov qword [rsp + 0x28], 0
lea rax, [0x140140098]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x14008c4b0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14008c558
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14008c558
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x1401400b0]
test ecx, ecx
je 0x14008c548
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14008c53e
test rcx, rcx
je 0x14008c53e
lock dec qword [rcx]
jne 0x14008c53e
call fcn.14008c5a0
jmp 0x14008c53e
lea rcx, [0x140140098]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14008c468
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x140140098]
call fcn.14008c7e0
mov ecx, eax
jmp 0x14008c4e6
mov ecx, 8
mov edx, 0x18
call fcn.140002ac0
ud2
Function at 0x14008c7e0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x14008c865
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x14008c8a6
cmp dword [rsp + 0x2c], 0
je 0x14008c88a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14008c8ce
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1401e6158]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401e6158], rsi
jne 0x14008c840
mov byte [0x1401e6150], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14008c89c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14008c91a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14008c88f
mov edi, dword [rsp + 0x28]
jmp 0x14008c89c
mov edi, dword [rsi + 0x18]
jmp 0x14008c89a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x14016c708]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.14008c980
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_windows_core_0.52.0_src_imp_ref_count.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140004170
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._Users_caojian_.cargo_registry_src_index.crates.io_6f17d22bba15001f_windows_core_0.52.0_src_imp_ref_count.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14008c9c0
ud2
Function at 0x14008d520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1401400d0]
test ecx, ecx
je 0x14008d5e6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14008d54d
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x14008d5e0
mov ecx, dword [0x1401400d0]
test ecx, ecx
je 0x14008d608
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14008d625
mov rsi, rax
test rax, rax
jne 0x14008d5da
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x14008d59f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14008d640
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14008d640
mov rsi, rax
lea rax, [0x1401400b8]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1401400d0]
test ecx, ecx
je 0x14008d630
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x14008d627
lea rcx, [0x1401400b8]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14008d540
jmp 0x14008d54d
lea rcx, [0x1401400b8]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14008d56c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401400b8]
call fcn.14008c7e0
mov ecx, eax
jmp 0x14008d5d2
mov ecx, 8
mov edx, 0x10
call fcn.140002ac0
ud2
Function at 0x14008e2a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140140090]
test ecx, ecx
je 0x14008e2cd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14008e2e6
cmp qword [rax + 8], 0
je 0x14008e2e6
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140078]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14008e2bc
mov ecx, dword [0x140140090]
test ecx, ecx
je 0x14008e391
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14008e3ae
mov rsi, rax
test rax, rax
jne 0x14008e373
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x14008e338
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14008e3c6
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14008e3c6
mov rsi, rax
lea rax, [0x140140078]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140140090]
test ecx, ecx
je 0x14008e3b6
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140078]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14008e305
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140140078]
call fcn.14008c7e0
mov ecx, eax
jmp 0x14008e36b
mov ecx, 8
mov edx, 0x20
call fcn.140002ac0
ud2
Function at 0x140090720
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x1400907a0
jmp 0x14009078f
jae 0x140090844
cmp r8, 0x201
jae 0x1400907a0
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x1400907e7
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x1400907c7
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14008ed80
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x14009080b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x14009089d
mov r8d, ebx
cmp rbp, r8
jne 0x140090780
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400908bd
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x14009078f
jmp 0x1400907a0
cmp r12, r8
jb 0x1400908d7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140091460
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rsi, rsi
je 0x140090888
mov rcx, qword [0x1401e6138]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rsi, rsi
jne 0x140090875
jmp 0x140090888
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140004ed0
jmp 0x1400908ec
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.140004b30
ud2
Function at 0x1400b28e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x1401400f0]
test ecx, ecx
je 0x1400b2910
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400b2929
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400b2929
add rdi, 0x10
jmp 0x1400b2a1e
lea rcx, [0x1401400d8]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400b28fd
mov ecx, dword [0x1401400f0]
test ecx, ecx
je 0x1400b29ff
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400b2a1c
mov rsi, rax
test rax, rax
jne 0x1400b29ce
mov qword [rsp + 0x28], 0
lea rax, [0x1401400d8]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x1400b2990
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400b2a38
mov rcx, rax
mov qword [0x1401e6138], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400b2a38
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x1401400f0]
test ecx, ecx
je 0x1400b2a28
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400b2a1e
test rcx, rcx
je 0x1400b2a1e
lock dec qword [rcx]
jne 0x1400b2a1e
call fcn.1400b2a60
jmp 0x1400b2a1e
lea rcx, [0x1401400d8]
call fcn.14008c7e0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400b2948
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1401400d8]
call fcn.14008c7e0
mov ecx, eax
jmp 0x1400b29c6
mov ecx, 8
mov edx, 0x18
call fcn.140002ac0
ud2
Function at 0x1400b3390
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rbx, r8
inc rbx
sete bpl
je 0x1400b35f8
js 0x1400b3612
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x1401e61e9]
mov rcx, qword [0x1401e6138]
test rcx, rcx
jne 0x1400b33eb
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400b35e9
mov rcx, rax
mov qword [0x1401e6138], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400b35e9
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
cmp r14, 0x10
jae 0x1400b3438
test r14, r14
je 0x1400b34f3
xor eax, eax
cmp byte [r15 + rax], 0
je 0x1400b3574
inc rax
cmp r14, rax
jne 0x1400b3420
jmp 0x1400b34f3
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
je 0x1400b347e
cmp rax, r14
cmovae rax, r14
test rax, rax
je 0x1400b347e
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r15 + rcx], 0
je 0x1400b3574
inc rcx
cmp rax, rcx
jne 0x1400b3460
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x1400b3484
jmp 0x1400b34ce
lea rcx, [r14 - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x140145c90]
movabs rdx, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x1400b34ce
add rax, 0x10
cmp rax, rcx
jbe 0x1400b34a0
cmp rax, r14
je 0x1400b34f3
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1400b3574
inc rax
cmp r14, rax
jne 0x1400b34e0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x30]
call fcn.140002cb0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov rcx, rax
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1400b35aa
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
jne 0x1400b35c8
jmp 0x1400b35d9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test bpl, bpl
jne 0x1400b35d9
mov rcx, qword [0x1401e6138]
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
je 0x1400b35d9
mov rcx, qword [0x1401e6138]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rbx
call fcn.140002ac0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_a28077b28a02b92985b3a3faecf92813155f1ea1library_alloc_srccollections_btree_navigate.rs
lea r8, str.library_alloc_src_ffic_str.rs
mov edx, 0x2b
call fcn.140004ed0
ud2
call fcn.140002a80
ud2