joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004e4d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18006c3c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004e4fd
xor eax, eax
jmp 0x18004e669
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18004e537
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18004e537
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18004e669
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18004e65c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18004e57a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18004e5a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004e661
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004e614
sub eax, 1
je 0x18004e614
cmp eax, 2
jne 0x18004e65c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004e661
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18004e642
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18004e65c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18004e661
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800554f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18004eaa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18006c3c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18004eb73
cmp byte [rcx + 0x71], 0
je 0x18004eb73
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18004eb6f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004eb34
sub eax, 1
je 0x18004eb38
cmp eax, 2
jne 0x18004eb6f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800554f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18004eb66
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18004eb6f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18004eb1c
xor al, al
jmp 0x18004eb1c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800554f0
add rsp, 0x60
pop rbx
ret

Function at 0x180050fc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memset
jmp 0x180051008
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x180051028
jmp 0x1800510c5
cmp dword [rsp + 0x68], 0x1000
jne 0x18005104d
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x18005104d
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x18005104f
jmp 0x180050ff3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180051085
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x180051085
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x18005108a
jmp 0x180050ff3
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x180050ff3
mov rax, qword [rsp + 0x20]
jmp 0x1800510c7
xor eax, eax
add rsp, 0x88
ret
Function at 0x402c69
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
cmp word [rdx], 0x5a4d
jne 0x402c94
movsxd rax, dword [rdx + 0x3c]
lea rcx, [rsi + 8]
cmp dword [rdx + rax], 0x4550
jne 0x402ccb
add rdx, rax
mov qword [rcx], rdx
xor eax, eax
jmp 0x402ce6
lea rdi, [rsp + 0x28]
lea rdx, [0x0047a558]
mov rcx, rdi
xor r8d, r8d
call fcn.0042636e
mov dword [rdi + 0x18], 1
mov rax, qword [rdi]
movups xmm0, xmmword [rdi + 8]
movups xmmword [rsi + 0x10], xmm0
mov rcx, qword [rdi + 0x18]
mov qword [rsi + 0x20], rcx
mov qword [rsi + 8], rax
jmp 0x402ce1
lea rdx, [0x0047a558]
xor r8d, r8d
call fcn.0042636e
mov dword [rsi + 0x20], 2
mov eax, 1
mov qword [rsi], rax
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x4105cc
Capabilities:
Get common file path

Disassembly:
lea rdx, [0x0045b90c]
jmp 0x4105e4
push rsi
sub rsp, 0x30
mov rsi, rcx
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
je 0x41060c
and qword [rsi], 0
jmp 0x410630
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.00439d60
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
nop
add rsp, 0x30
pop rsi
ret

Function at 0x4105d8
Capabilities:
Get common file path

Disassembly:
lea rdx, [0x0045b91c]
jmp 0x4105e4

Function at 0x4105e4
Capabilities:
Get common file path

Disassembly:
lea rdx, [0x0045b90c]
jmp 0x4105e4
push rsi
sub rsp, 0x30
mov rsi, rcx
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
je 0x41060c
and qword [rsi], 0
jmp 0x410630
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.00439d60
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
nop
add rsp, 0x30
pop rsi
ret

Function at 0x410637
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x00459010]
call fcn.0041066e
mov ecx, eax
add rsp, 0x28
jmp fcn.00456808

Function at 0x410652
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.0041066e
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.00456800
Function at 0x410d50
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r15, rcx
xorps xmm0, xmm0
lea r14, [rsp + 0x30]
movaps xmmword [r14], xmm0
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x10
mov rcx, r14
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
je 0x410e20
mov edi, dword [rsp + 0x2c]
cmp rdi, 0x11
jae 0x410e3f
lea r12, [rsp + rdi]
add r12, 0x30
mov rcx, rdi
call fcn.004566f2
lea rsi, [rsp + 0x48]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
and qword [rsi + 0x10], 0
mov rcx, rsi
mov rdx, rdi
call fcn.004565da
mov rbx, qword [rsi]
mov rsi, qword [rsi + 0x10]
lea rax, [rbx + rsi]
xor ecx, ecx
cmp rdi, rcx
je 0x410ddf
mov dl, byte [rsp + rcx + 0x30]
mov byte [rax + rcx], dl
inc rcx
jmp 0x410dce
add rsi, r12
sub rsi, r14
mov qword [rsp + 0x58], rsi
mov rdi, qword [rsp + 0x50]
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call fcn.0040ed30
cmp dword [r14], 1
jne 0x410e26
and qword [r15], 0
test rdi, rdi
je 0x410e31
mov edx, 1
mov rcx, rbx
call fcn.0040a620
jmp 0x410e31
and qword [r15], 0
jmp 0x410e31
mov qword [r15], rbx
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str._root_.cargo_registry_src_github.com_1ecc6299db9ec823_winutil_0.1.1_src_lib.rs
mov edx, 0x10
mov rcx, rdi
call fcn.0040bcd0
ud2
Function at 0x41a242
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x41a31f
mov r10, rdx
mov rsi, r8
shr rsi, 8
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov r11d, 0xff
mov rdi, r8
and rdi, r11
xor rdi, rax
imul rdi, rdx
mov rax, rsi
and rax, r11
xor rax, rdi
imul rax, rdx
xor r14d, r14d
xor edx, edx
div rbx
mov rdi, qword [rcx]
shl rdx, 5
lea rbx, [rdi + rdx]
add rbx, 9
cmp qword [rbx - 9], r10
jne 0x41a2c8
cmp byte [rdi + rdx + 8], r8b
jne 0x41a2c8
cmp byte [rbx], sil
sete r14b
mov r11, qword [rdi + rdx + 0x10]
mov rcx, qword [rcx + 0x18]
test r14b, r14b
je 0x41a2e2
mov eax, 1
cmp qword [rdi + rdx + 0x18], rcx
je 0x41a312
mov rax, r8
shr rax, 0x10
lea r14, [rdi + rdx]
add rdx, rdi
add rdx, 8
mov qword [r14], r10
mov byte [rdx], r8b
mov byte [rbx], sil
mov dword [rdx + 2], eax
shr rax, 0x20
mov word [rdx + 6], ax
mov qword [rdx + 8], r9
mov qword [rdx + 0x10], rcx
xor eax, eax
mov rdx, r11
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x0045cd50]
lea r8, str._root_.cargo_registry_src_github.com_1ecc6299db9ec823_regex_0.1.80_src_compile.rs
mov edx, 0x39
call fcn.0040c200
ud2

Function at 0x437120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x00459050]
test rcx, rcx
jne 0x437141
lea rcx, [0x00459050]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
cmp rax, 1
jbe 0x43715d
mov rdi, rax
cmp dword [rax], 1
jne 0x43715d
add rdi, 8
jmp 0x437208
mov rcx, qword [0x00459050]
test rcx, rcx
jne 0x437178
lea rcx, [0x00459050]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
test rax, rax
je 0x43718f
mov rsi, rax
cmp rax, 1
jne 0x4371db
xor edi, edi
jmp 0x437208
mov ecx, 0x20
mov edx, 8
call fcn.0040a590
test rax, rax
je 0x437212
mov rsi, rax
mov qword [rax], 0
lea rax, [0x00459050]
mov qword [rsi + 0x18], rax
mov rcx, qword [0x00459050]
test rcx, rcx
jne 0x4371d3
lea rcx, [0x00459050]
call fcn.004524f0
mov rcx, rax
mov rdx, rsi
call fcn.00456800
lea rdi, [rsi + 8]
cmp qword [rsi], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
je 0x437208
test rcx, rcx
je 0x437208
lock sub qword [rcx], 1
jne 0x437208
call fcn.00437300
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x20
mov edx, 8
call fcn.0040aee0
ud2
Function at 0x437e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x00459060]
test rcx, rcx
jne 0x437e30
lea rcx, [0x00459060]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
cmp rax, 1
jbe 0x437e47
mov rsi, rax
cmp dword [rax], 1
je 0x437ed4
mov rcx, qword [0x00459060]
test rcx, rcx
jne 0x437e62
lea rcx, [0x00459060]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
test rax, rax
je 0x437e79
mov rsi, rax
cmp rax, 1
jne 0x437ec5
xor esi, esi
jmp 0x437ed8
mov ecx, 0x18
mov edx, 8
call fcn.0040a590
test rax, rax
je 0x437ee1
mov rsi, rax
mov qword [rax], 0
lea rax, [0x00459060]
mov qword [rsi + 0x10], rax
mov rcx, qword [0x00459060]
test rcx, rcx
jne 0x437ebd
lea rcx, [0x00459060]
call fcn.004524f0
mov rcx, rax
mov rdx, rsi
call fcn.00456800
mov qword [rsi], 1
mov qword [rsi + 8], 0
add rsi, 8
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.0040aee0
ud2
Function at 0x43a020
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x54], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea rcx, [rsp + 0x90]
lea r9, [rsp + 0x40]
call fcn.0044efc0
cmp dword [rsp + 0x90], 1
mov rdi, qword [rsp + 0x98]
jne 0x43a0cf
cmp dil, 3
jne 0x43a0c3
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
call qword [rax]
mov rax, qword [rdi + 8]
cmp qword [rax + 8], 0
je 0x43a0b2
mov rcx, qword [rdi]
mov rdx, qword [rax + 0x10]
call fcn.0040a620
mov rcx, qword [0x00484110]
xor edx, edx
mov r8, rdi
call fcn.004568c8
mov qword [rsi], 0
jmp 0x43a1f6
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.0044f190
cmp dword [rsp + 0x40], 1
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
jne 0x43a12d
cmp r12b, 3
jne 0x43a1e7
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
call qword [rax]
mov rax, qword [rbx + 8]
cmp qword [rax + 8], 0
je 0x43a117
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
call fcn.0040a620
mov rcx, qword [0x00484110]
xor edx, edx
mov r8, rbx
call fcn.004568c8
jmp 0x43a1e7
cmp rbx, 2
je 0x43a1e7
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x43a1e2
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x43a208
mov rbx, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x43a208
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x43a1ee
call sub.KERNEL32.dll_GetLastError
mov qword [rsi], 0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsi], 0
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
jmp 0x43a1ee
Function at 0x4524f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
lea rcx, [0x004840e8]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rbx, qword [rsi]
test rbx, rbx
jne 0x45257b
mov rbx, qword [rsi + 8]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x452595
mov edi, eax
test rbx, rbx
je 0x45256f
mov ecx, 0x18
mov edx, 8
call fcn.0040a590
test rax, rax
je 0x4525af
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rax, qword [0x00484128]
nop word cs:[rax + rax]
nop dword [rax]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x00484128], rcx
jne 0x452560
mov ebx, edi
mov rax, rbx
xchg qword [rsi], rax
test edi, edi
je 0x4525c0
lea rcx, [0x004840e8]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rax, rbx
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESlibrary_std_src_syswindows_thread_local_key.rs
lea r8, [0x0047c7c8]
mov edx, 0x2e
call fcn.0040c200
ud2
mov ecx, 0x18
mov edx, 8
call fcn.0040aee0
ud2
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
lea rax, str.assertion_failed:_key___0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 0
lea rax, [0x0047a558]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [0x0040c430]
mov qword [rsp + 0x48], rax
lea rax, str.fatal_runtime_error:__n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x50]
call fcn.00437f00
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.00438010
mov ecx, 7
int 0x29
ud2
Function at 0x455d30
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov rcx, qword [0x00459038]
test rcx, rcx
jne 0x455d53
lea rcx, [0x00459038]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
cmp rax, 1
jbe 0x455d6a
mov rsi, rax
cmp dword [rax], 1
je 0x455e20
mov rcx, qword [0x00459038]
test rcx, rcx
jne 0x455d85
lea rcx, [0x00459038]
call fcn.004524f0
mov rcx, rax
call fcn.00456808
cmp rax, 1
je 0x455e26
mov rsi, rax
test rax, rax
jne 0x455dec
mov ecx, 0x20
mov edx, 8
call fcn.0040a590
test rax, rax
je 0x455ea5
mov rsi, rax
mov qword [rax], 0
lea rax, [0x00459038]
mov qword [rsi + 0x18], rax
mov rcx, qword [0x00459038]
test rcx, rcx
jne 0x455de4
lea rcx, [0x00459038]
call fcn.004524f0
mov rcx, rax
mov rdx, rsi
call fcn.00456800
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x455e34
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rsi], 1
movups xmmword [rsi + 8], xmm0
add rsi, 8
jmp 0x455e28
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [fcn.004535f0]
mov qword [rsp + 0x38], rax
lea rax, str.couldnt_generate_random_bytes:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00452c60
ud2
mov ecx, 0x20
mov edx, 8
call fcn.0040aee0
ud2

Function at 0x456f70
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00458040
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00458040
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x456fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x004847f4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x457188
mov rax, qword [0x004847f8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x45702c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4570b7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x457010
mov rcx, r12
call fcn.00457d40
mov rbp, rax
test rax, rax
je 0x4571c2
mov rax, qword [0x004847f8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00457e70
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004847f8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4571d1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4570b0
sub eax, 4
and eax, 0xfffffffb
jne 0x457140
add dword [0x004847f4], 1
cmp ebx, 8
jae 0x4570e8
test bl, 4
jne 0x457190
test ebx, ebx
je 0x4570d9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x4571b0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x4570d9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x45711a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x004847f8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4570b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00456f70
nop dword [rax]
xor edi, edi
jmp 0x457037
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x4570d9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x4570d9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00456f70
mov rax, qword [0x004847f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00456f70
nop
nop dword [rax]
Function at 0x4579b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00484ae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00484ac0]
test rbx, rbx
je 0x457a04
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4579fb
test r12, r12
je 0x4579fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4579e0
lea rcx, [0x00484ae0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x457d40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0047d470]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x457db9
mov rcx, r10
call fcn.00457c10
test eax, eax
je 0x457db9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x457db6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x457dad
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x457db9
add r8, 0x28
cmp r8, r9
jne 0x457d98
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret