joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140279c80
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1405d52b0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov eax, dword [rcx + 0x10]
mov qword [rbp + 0xf], r8
test eax, eax
jne 0x140279cb6
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x140279dfd
cmp eax, 1
jne 0x140279ce0
mov rcx, qword [rcx + 8]
xor r8d, r8d
mov qword [rsp + 0x28], r9
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], 8
call sub.ntdll.dll_NtQueryVirtualMemory
cdqe
jmp 0x140279dfd
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rdi
cmp eax, 2
jne 0x140279deb
mov eax, dword [rcx]
xor edi, edi
mov dword [rbp + 0x17], eax
mov eax, edi
mov qword [rbp + 0x1f], rdx
mov edx, 0x9a4
mov dword [rbp + 0x37], edi
mov qword [rbp + 0x27], r8
mov qword [rbp + 0x2f], r9
mov dword [rbp - 0x19], 0xf601f600
mov dword [rbp - 0x15], 0xf603f670
mov dword [rbp - 0x11], 0xf613f624
mov dword [rbp - 0xd], 0xf615f60b
mov dword [rbp - 9], 0xf617f601
mov dword [rbp - 5], 0xf612f617
mov dword [rbp - 1], 0xf61bf60d
mov dword [rbp + 3], 0xf613
mov byte [rbp + 7], 1
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x19], cx
inc rax
cmp rax, 0xf
jb 0x140279d52
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp - 0x19]
xor edx, edx
mov byte [rbp + 7], dil
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140279deb
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x37]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x17]
lea rax, [rbp + 0x17]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], rax
mov edx, 0x22241c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x27]
mov rcx, qword [rax]
mov rax, qword [rbp + 0xf]
mov qword [rax], rcx
mov rax, qword [rbp + 0x2f]
jmp 0x140279ded
xor eax, eax
mov rbx, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14027a820
add rsp, 0xb0
pop rbp
ret
Function at 0x140279f20
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1405d52b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov dword [rcx], edx
mov dword [rcx + 0x10], r8d
cmp r8d, 2
jne 0x14027a111
mov qword [rsp + 0xa8], rbx
xor ebx, ebx
mov qword [rbp + 0x2f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x2f]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140279f9f
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp + 0x47]
lea r9d, [rbx + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x4b]
mov dword [rbp + 0x47], 4
lea edx, [rbx + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp + 0x4b]
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140279fae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14027a037
movdqa xmm0, xmmword [0x1402d5180]
lea rcx, [rbp + 0x37]
movdqa xmm1, xmmword [0x1402d5160]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 0x37], 0x3e2a3c1a
movdqu xmmword [rbp + 7], xmm1
mov dword [rbp + 0x3b], 0x1127410c
mov dword [rbp + 0x3f], 0x140a16
mov byte [rbp + 0x43], 1
mov dword [rbp + 0x17], 0x5f121812
mov dword [rbp + 0x1b], 0xe6e6eeed
mov dword [rbp + 0x1f], 0xf2f2f6a4
mov dword [rbp + 0x23], 0x100efee
call fcn.14002e3e0
lea rcx, [rbp - 9]
mov rbx, rax
call fcn.140186150
mov rdx, rax
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [0x1405e6200]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1405e5bf0], ecx
jg 0x14027a126
xor r9d, r9d
mov qword [rbp + 0x37], 8
lea rdx, [rbp + 0x37]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call qword [0x1405e5be8]
test eax, eax
js 0x14027a089
test byte [rbp + 0x3b], 1
jne 0x14027a109
movdqa xmm0, xmmword [0x1402d5150]
lea rcx, [rbp + 0x37]
movdqa xmm1, xmmword [0x1402d5170]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 0x37], 0x3e2a3c1a
movdqa xmm0, xmmword [0x1402d5190]
movdqu xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x3b], 0x1127410c
mov dword [rbp + 0x3f], 0x140a16
mov byte [rbp + 0x43], 1
movdqu xmmword [rbp + 7], xmm1
mov dword [rbp + 0x27], 0xf9e7ffe8
mov dword [rbp + 0x2b], 0x100e3f5
call fcn.14002e3e0
lea rcx, [rbp - 9]
mov rbx, rax
call fcn.1401861f0
mov rdx, rax
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14027a820
add rsp, 0x90
pop rbp
ret
lea rcx, [0x1405e5bf0]
call fcn.14027a9c8
cmp dword [0x1405e5bf0], 0xffffffff
jne 0x14027a05e
lea rcx, [0x1405b4078]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1402d5128]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1405e5bf0]
mov qword [0x1405e5be8], rax
call fcn.14027a968
jmp 0x14027a05e
Function at 0x14027a180
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x98
mov rax, qword [0x1405d52b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov eax, dword [rcx + 0x10]
mov rdi, r9
mov r15, qword [rbp + 0x7f]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test eax, eax
jne 0x14027a1cc
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x14027a1eb
mov rcx, qword [rbx + 8]
mov r9d, edi
mov r8, rsi
mov qword [rsp + 0x20], r15
mov rdx, r14
call sub.ntdll.dll_NtReadVirtualMemory
mov eax, dword [rbx + 0x10]
cmp eax, 2
jne 0x14027a2e0
mov eax, dword [rbx]
mov edx, 0x9a4
xor eax, 0x8fea0644
mov dword [rbp - 0x31], 0xf601f600
mov dword [rbp - 1], eax
mov eax, 0xfcb3e314
xor r14, rax
mov dword [rbp - 0x2d], 0xf603f670
mov rax, rdi
mov qword [rbp + 7], r14
xor rax, 0x544becbe
mov dword [rbp - 0x29], 0xf613f624
xor r14d, r14d
mov qword [rbp + 0xf], rax
mov dword [rbp - 9], r14d
mov eax, r14d
mov dword [rbp - 0x25], 0xf615f60b
mov dword [rbp - 0x21], 0xf617f601
mov dword [rbp - 0x1d], 0xf612f617
mov dword [rbp - 0x19], 0xf61bf60d
mov dword [rbp - 0x15], 0xf613
mov byte [rbp - 0x11], 1
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x31], cx
inc rax
cmp rax, 0xf
jb 0x14027a262
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x31]
xor edx, edx
mov byte [rbp - 0x11], r14b
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14027a2e0
mov qword [rsp + 0x38], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
mov dword [rsp + 0x28], edi
mov r9d, Ordinal_27
mov edx, 0x22240e
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14027a820
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14027a680
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x98
mov rax, qword [0x1405d52b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov eax, dword [rcx + 0x10]
mov rdi, r9
mov r15, qword [rbp + 0x7f]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test eax, eax
jne 0x14027a6cc
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x14027a6eb
mov rcx, qword [rbx + 8]
mov r9d, edi
mov r8, rsi
mov qword [rsp + 0x20], r15
mov rdx, r14
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [rbx + 0x10]
cmp eax, 2
jne 0x14027a7e0
mov eax, dword [rbx]
mov edx, 0x9a4
xor eax, 0x8fea0644
mov dword [rbp - 0x31], 0xf601f600
mov dword [rbp - 1], eax
mov eax, 0xfcb3e314
xor r14, rax
mov dword [rbp - 0x2d], 0xf603f670
mov rax, rdi
mov qword [rbp + 7], r14
xor rax, 0x544becbe
mov dword [rbp - 0x29], 0xf613f624
xor r14d, r14d
mov qword [rbp + 0xf], rax
mov dword [rbp - 9], r14d
mov eax, r14d
mov dword [rbp - 0x25], 0xf615f60b
mov dword [rbp - 0x21], 0xf617f601
mov dword [rbp - 0x1d], 0xf612f617
mov dword [rbp - 0x19], 0xf61bf60d
mov dword [rbp - 0x15], 0xf613
mov byte [rbp - 0x11], 1
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x31], cx
inc rax
cmp rax, 0xf
jb 0x14027a762
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x31]
xor edx, edx
mov byte [rbp - 0x11], r14b
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14027a7e0
mov qword [rsp + 0x38], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
mov dword [rsp + 0x28], edi
mov r9d, Ordinal_27
mov edx, 0x22240a
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14027a820
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140006020
cmp r11, r10
ja 0x140006097
cmp r10, rdx
ja 0x1400060a9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140006022
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140006000
jmp 0x140006084
ja 0x14000602a
mov r11, r10
cmp rax, r8
jne 0x140005fce
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140006060
mov rdi, r8
sub ecx, edx
jns 0x14000607b
jmp 0x140006086
cmp r8, rsi
je 0x1400060b8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140006086
xor al, 1
cmp rdi, rsi
jne 0x140006040
jmp 0x140006086
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400040b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400035a0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140004aa0
int3

Function at 0x14000c470
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000c495
cmp rax, rcx
je 0x14000c49b
cmp rdx, 4
jae 0x14000c4a2
xor eax, eax
xor r8d, r8d
jmp 0x14000c540
pop rbp
jmp fcn.1400030c0
xor eax, eax
jmp 0x14000c557
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140036420]
movdqa xmm3, xmmword [0x140036430]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000c4d0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000c557
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000c540
pop rbp
ret
Function at 0x14000d530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x14000d5b4
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x14000d5b4
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x14000d5cd
cmp eax, 0x42
jne 0x14000d5b4
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
mov r9b, 1
cmp rsi, r11
jae 0x14000d6fd
cmp byte [r10 + rsi], 0x5f
jne 0x14000d68c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x14000d6fd
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x14000d757
mov dil, 1
xor r9d, r9d
jmp 0x14000d6ff
xor edx, edx
call fcn.140009070
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.140009070
test al, al
jne 0x14000d73d
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000d60c
lea rdx, [0x14098132b]
mov r8d, 1
call fcn.140003620
mov rdx, rbx
test al, al
jne 0x14000d73d
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x14000d5c0
xor r14d, r14d
lea rdi, [0x140981681]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x14000d644
cmp byte [rax + rcx], 0x45
je 0x14000d790
sub r14, 1
jb 0x14000d66c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x14000d66c
mov r8d, 2
mov rdx, rdi
call fcn.140003620
mov rdx, rbx
test al, al
jne 0x14000d73d
mov rcx, rdx
call fcn.14000a8d0
test al, al
jne 0x14000d73d
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x14000d630
jmp 0x14000d5c0
xor eax, eax
mov r14d, 0x3e
nop word cs:[rax + rax]
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x14000d6ed
lea edi, [rdx - 0x30]
cmp dil, 0xa
jb 0x14000d6cf
lea edi, [rdx - 0x61]
cmp dil, 0x1a
jae 0x14000d6c1
add dl, 0xa9
jmp 0x14000d6cd
lea edi, [rdx - 0x41]
cmp dil, 0x1a
jae 0x14000d6fd
add dl, 0xe3
mov edi, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul r14
jo 0x14000d6fd
movzx edx, dil
xor edi, edi
add rax, rdx
jb 0x14000d6ff
cmp rsi, r11
jb 0x14000d6a0
jmp 0x14000d6ff
inc rsi
mov qword [rcx + 0x10], rsi
inc rax
jne 0x14000d58f
xor edi, edi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x14000d745
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x140981660]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.140003620
mov rcx, rbx
test al, al
je 0x14000d745
mov sil, 2
jmp 0x14000d5c0
mov qword [rcx], 0
mov byte [rcx + 8], dil
xor esi, esi
jmp 0x14000d5c0
cmp qword [rcx + 0x20], 0
je 0x14000d750
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.14000d530
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14000d5c2
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x14000d5c0
Function at 0x1400103e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140983aa8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14001044f
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001047b
test eax, eax
js 0x14001045b
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140010471
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x30]
call fcn.14000fd50
mov rcx, rax
call fcn.14000fdd0
mov ecx, 7
int 0x29
ud2

Function at 0x1400109e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x1400350a8]
test ecx, ecx
je 0x140010add
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140010a11
cmp qword [rax + 8], 0
jne 0x140010ace
mov ecx, dword [0x1400350a8]
test ecx, ecx
je 0x140010af0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140010ad4
test rax, rax
jne 0x140010a8f
mov qword [rbp - 8], 0
lea rax, [0x140035090]
mov qword [rbp - 0x10], rax
movzx eax, byte [0x14098b0a0]
mov ecx, 0x18
call fcn.14002f090
test rax, rax
je 0x140010b1c
mov rcx, qword [rbp]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400350a8]
test ecx, ecx
je 0x140010b03
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
test rdx, rdx
je 0x140010ace
test rcx, rcx
je 0x140010ace
lock dec qword [rcx]
jne 0x140010ace
lea rcx, [rbp - 8]
mov rsi, rax
call fcn.140010bf0
mov rax, rsi
add rax, 0x10
jmp 0x140010ad6
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x140035090]
call fcn.140010cb0
mov ecx, eax
jmp 0x1400109fb
lea rcx, [0x140035090]
call fcn.140010cb0
mov ecx, eax
jmp 0x140010a21
lea rcx, [0x140035090]
mov rsi, rax
call fcn.140010cb0
mov ecx, eax
mov rax, rsi
jmp 0x140010a81
mov ecx, 8
mov edx, 0x18
call fcn.140002430
ud2
Function at 0x140010cb0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
cmp qword [rcx], 0
je 0x140010d45
mov rax, qword [0x14098d038]
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp + 4], eax
cmp eax, 1
jne 0x140010d84
cmp dword [rbp], 0
je 0x140010d68
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140010d99
mov edi, eax
mov rax, qword [0x14098b150]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14098b150], rsi
jne 0x140010d20
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140010d79
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x140010ddb
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140010d6d
mov edi, dword [rbp + 4]
jmp 0x140010d79
mov edi, dword [rsi + 0x18]
jmp 0x140010d77
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x30], 0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x30]
call fcn.140010e40
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x30]
call fcn.140002bf0
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x30]
call fcn.140010e90
int3

Function at 0x140011520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140035088]
test ecx, ecx
je 0x1400115bb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14001154c
cmp byte [rax + 8], 0
jne 0x1400115ac
mov ecx, dword [0x140035088]
test ecx, ecx
je 0x1400115ce
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400115b2
test rax, rax
jne 0x1400115a6
movzx eax, byte [0x14098b0a0]
mov ecx, 0x10
call fcn.14002f090
test rax, rax
je 0x1400115f7
lea rcx, [0x140035070]
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x140035088]
test ecx, ecx
je 0x1400115e1
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov word [rax + 8], 1
add rax, 9
jmp 0x1400115b4
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x140035070]
call fcn.140010cb0
mov ecx, eax
jmp 0x14001153b
lea rcx, [0x140035070]
call fcn.140010cb0
mov ecx, eax
jmp 0x140011558
lea rcx, [0x140035070]
mov rsi, rax
call fcn.140010cb0
mov ecx, eax
mov rax, rsi
jmp 0x140011598
mov ecx, 8
mov edx, 0x10
call fcn.140002430
int3
Function at 0x140011b50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140035068]
test ecx, ecx
je 0x140011c12
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140011b86
cmp qword [rax + 8], 0
je 0x140011b86
add rax, 0x10
jmp 0x140011c0b
mov ecx, dword [0x140035068]
test ecx, ecx
je 0x140011c25
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140011c09
test rax, rax
jne 0x140011bec
movzx eax, byte [0x14098b0a0]
mov ecx, 0x20
call fcn.14002f090
test rax, rax
je 0x140011c4e
lea rcx, [0x140035050]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x140035068]
test ecx, ecx
je 0x140011c38
dec ecx
mov rdx, rax
mov rsi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
mov qword [rax + 8], 1
mov rcx, rax
add rax, 0x10
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 0
jmp 0x140011c0b
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x140035050]
call fcn.140010cb0
mov ecx, eax
jmp 0x140011b6b
lea rcx, [0x140035050]
call fcn.140010cb0
mov ecx, eax
jmp 0x140011b96
lea rcx, [0x140035050]
mov rsi, rax
call fcn.140010cb0
mov ecx, eax
mov rax, rsi
jmp 0x140011bde
mov ecx, 8
mov edx, 0x20
call fcn.140002430
int3

Function at 0x140014d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
movzx eax, byte [rdx + 0x3a]
test al, al
setne r8b
cmp r9b, 1
ja 0x140014db6
test al, al
jne 0x140014d8f
movzx esi, byte [rdx + 0x10]
lea eax, [rsi - 5]
cmp al, 1
ja 0x140014d8f
invalid
mov r10, qword [rdx]
xor r8d, r8d
xor eax, eax