joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005730
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, ecx
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180005766
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x18000576e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180005780
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x18000e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800058a7
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000589d
lea rsi, [0x18000b058]
nop
lea rdx, [0x18000b048]
lea rcx, [rsp + 0x5c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x180005849
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x18000583c
mov eax, dword [rsp + 0x38]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x180005849
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.180007520
xor eax, eax
lea rdx, [rsp + 0x5c]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rsi + rax - 1]
jne 0x180005887
cmp rax, 8
jne 0x180005850
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x18000587a
mov eax, dword [rsp + 0x38]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x180005887
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.180007520
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180005810
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180008020
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800077ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x18000a500]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800077e6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800077eb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180007834
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18000a400]
cmp byte [rcx + rax], 0
je 0x180007834
dec r8
sub rdx, 1
jne 0x18000781a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x24d8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x24d81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x24d8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24d806f
add dl, dl
jne 0x24d8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24d80f6
xor eax, eax
add dl, dl
jne 0x24d80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24d81ad
add dl, dl
jne 0x24d80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x24d80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x24d807e
mov eax, 1
add dl, dl
jne 0x24d8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24d80fb
sub eax, ebx
mov ebx, 1
jne 0x24d814c
mov ecx, 1
add dl, dl
jne 0x24d812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24d813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24d8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24d807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x24d8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24d8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24d815d
cmp eax, 0x7d00
jae 0x24d819b
cmp eax, 0x500
jb 0x24d8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24d807e
cmp eax, 0x7f
ja 0x24d819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24d807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x24d81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x24d807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x007d8ab0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x007d8ac0]
mov dword [rax], 1
mov rax, qword [0x007d8ad0]
mov dword [rax], 1
mov rax, qword [0x007d8aa0]
mov dword [rax], 1
mov rax, qword [0x007d89b0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x007d8a90]
mov dword [0x0083c00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x007d8a70]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x007d8960]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067
Function at 0x401d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x401d70
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x401d65
cmp edi, 0x2d
jne 0x401d70
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x401f04
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x401f0f
movzx r11d, r11b
cmp rbx, rsi
jae 0x401e0d
add r10, 2
mov ebx, 1
sub rbx, rsi
jmp 0x401dcc
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x401e0d
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x401e0d
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x401db0
cmp r11d, 0xccccccc
jne 0x401df8
cmp sil, 7
jbe 0x401db0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call sym.serde_json::de::Deserializer_R_::parse_exponent_overflow::haeabf641f736643d
jmp 0x401ef1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x401e2a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x401e3a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x0071c080]
subpd xmm1, xmmword [0x0071c090]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x401eac
xorpd xmm1, xmm1
movsd xmm2, qword [0x0071c0a0]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x401e88
jnp 0x401eda
test r10d, r10d
jns 0x401f38
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x134
ja 0x401e80
mov eax, eax
lea r9, [0x007ae5d8]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x401ef9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x0071c0b0]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x0071c0c0]
jae 0x401f38
test r8b, r8b
jne 0x401ee7
xorpd xmm0, xmmword [0x0071c0d0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x401edf
jmp 0x401ee7
mov qword [rsp + 0x28], 5
jmp 0x401f18
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym.serde_json::de::Deserializer_R_::error::h20009a949fc75cd7
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x401ef1
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call sym.serde_json::de::Deserializer_R_::error::h20009a949fc75cd7
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x401eee
Function at 0x483150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test rdx, rdx
je 0x48333a
add rdx, rcx
xor eax, eax
xor r9d, r9d
jmp 0x48318a
xor r11b, 1
movzx r8d, r11b
add rax, r8
mov r8d, r9d
mov r9d, r8d
cmp rcx, rdx
je 0x48333c
movzx r10d, byte [rcx]
test r10b, r10b
js 0x4831b0
inc rcx
mov r8b, 1
cmp r10d, 0x20
jae 0x483250
jmp 0x48317e
mov r8d, r10d
and r8d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xe0
jb 0x483213
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x48322f
movzx r10d, byte [rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r8d
cmp r10d, 0x110000
je 0x48333c
add rcx, 4
mov r8b, 1
cmp r10d, 0x20
jae 0x483250
jmp 0x48317e
add rcx, 2
shl r8d, 6
or r8d, esi
mov r10d, r8d
mov r8b, 1
cmp r10d, 0x20
jae 0x483250
jmp 0x48317e
add rcx, 3
shl r8d, 0xc
or r11d, r8d
mov r10d, r11d
mov r8b, 1
cmp r10d, 0x20
jb 0x48317e
nop word [rax + rax]
cmp r10d, 0x7f
je 0x48317e
mov r11d, r9d
and r11b, 1
je 0x483170
cmp r10d, 0x6d
jne 0x483170
cmp rcx, rdx
je 0x48333c
movzx r10d, byte [rcx]
test r10b, r10b
js 0x483295
inc rcx
cmp r10d, 0x20
jae 0x483322
jmp 0x48317e
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x4832f1
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x48330a
movzx r10d, byte [rcx + 3]
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r9d
cmp r10d, 0x110000
je 0x48333c
add rcx, 4
cmp r10d, 0x20
jae 0x483322
jmp 0x48317e
add rcx, 2
shl r9d, 6
or r9d, esi
mov r10d, r9d
cmp r10d, 0x20
jae 0x483322
jmp 0x48317e
add rcx, 3
shl r9d, 0xc
or r11d, r9d
mov r10d, r11d
cmp r10d, 0x20
jb 0x48317e
xor r11d, r11d
mov r9d, 0
cmp r10d, 0x7f
jne 0x483170
jmp 0x48317e
xor eax, eax
pop rsi
ret
Function at 0x484f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
call sym._ZN12clap_builder5error14Error_LT_F_GT_3new17hf90f93afa002d4a3E.llvm.16764289016520207003
cmp dword [rax], 2
je 0x484f86
cmp qword [rax + 8], 0
je 0x484f86
mov r8, qword [rax + 0x10]
mov rcx, qword [0x0083c108]
xor edx, edx
mov rbx, rax
call fcn.006f5b74
mov rax, rbx
mov qword [rax], 1
movups xmm0, xmmword [rsi]
movups xmmword [rax + 8], xmm0
mov rcx, qword [rsi + 0x10]
mov qword [rax + 0x18], rcx
mov rcx, rax
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.clap_builder::error::Error_F_::with_cmd::h9c96219377d3483f

Function at 0x494b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x494c10
cmp r11, r10
ja 0x494c87
cmp r10, rdx
ja 0x494c99
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x494c12
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x494bf0
jmp 0x494c74
ja 0x494c1a
mov r11, r10
cmp rax, r8
jne 0x494bbe
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x494c50
mov rdi, r8
sub ecx, edx
jns 0x494c6b
jmp 0x494c76
cmp r8, rsi
je 0x494ca8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x494c76
xor al, 1
cmp rdi, rsi
jne 0x494c30
jmp 0x494c76
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::hb6f495100651f9f8
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::h829dac2b01cd87d1
lea rcx, str.librarycore_srcunicodeprintable.rs
call sym.core::option::unwrap_failed::hec1ab125882a5e1e
int3
Function at 0x4ad410
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x4ad452
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x4ad45a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x4ad46b
jmp 0x4ad482
xor r10d, r10d
jmp 0x4ad50d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x4ad482
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x4ad499
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x4ad4b9
add r11, r8
jmp 0x4ad5eb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x4ad582
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x4ad530
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x4ad5a0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x4ad5b2
jmp 0x4ad5cd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x4ad5cd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x4ad5e7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x4b0560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x0071b198]
test ecx, ecx
je 0x4b0584
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4b059d
add rax, 8
jmp 0x4b05a1
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::hd70ed7c6a9653ced
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4b057e
jne 0x4b05a9
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call sym.std::sync::mpmc::context::Context::new::h77e9867641dcd0ee
mov rdi, rax
movzx eax, byte [0x0083c308]
mov edx, 0x10
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4b0663
mov rbx, rax
mov rsi, rax
lea rax, sym.std::sys::thread_local::os_local::destroy_value::hd70ed7c6a9653ced
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x0071b198]
test ecx, ecx
je 0x4b0643
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x0071b198]
test ecx, ecx
je 0x4b0653
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
je 0x4b063b
mov rax, qword [rdi + 8]
test rax, rax
je 0x4b062a
lock dec qword [rax]
jne 0x4b062a
mov rcx, qword [rdi + 8]
call sym.alloc::sync::Arc_T_A_::drop_slow::h31a9f62d0d5c82c9
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov rax, rbx
jmp 0x4b05a1
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::hd70ed7c6a9653ced
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b05ed
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::hd70ed7c6a9653ced
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b0601
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
ud2
Function at 0x4b0690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x0071b178]
test ecx, ecx
je 0x4b06b7
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4b06d0
add rax, 8
jmp 0x4b074b
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4b06ae
je 0x4b0749
movzx eax, byte [0x0083c308]
mov edx, 0x10
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4b0773
mov rbx, rax
mov rsi, rax
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x0071b178]
test ecx, ecx
je 0x4b0753
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x0071b178]
test ecx, ecx
je 0x4b0763
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
je 0x4b0744
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov rax, rbx
jmp 0x4b074b
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b070e
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b0722
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
int3
Function at 0x4b5e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4b5e7c
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4b5e95
add rax, 8
jmp 0x4b5f30
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4b5e73
je 0x4b5f2e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x0083c308]
mov edx, 0x18
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4b5f5d
mov rbx, rax
mov rsi, rax
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4b5f3d
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x0071b260]
test ecx, ecx
je 0x4b5f4d
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
je 0x4b5f29
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov rax, rbx
jmp 0x4b5f30
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b5ef3
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h11c5ff2709c8df73
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4b5f07
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
int3

Function at 0x4bf590
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
cmp word [rcx], 0
mov eax, 2
mov ecx, 0x17
cmove ecx, eax
mov rax, qword [0x0083c060]
cmp rax, 3
jne 0x4bf630
mov edx, 1
xor r8d, r8d
call sub.ws2_32.dll_socket
cmp rax, 0xffffffffffffffff
je 0x4bf607
mov rdi, rax
mov dword [rsp + 0x34], 1
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
test eax, eax
je 0x4bf61d
call sub.kernel32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rcx, rdi
call fcn.006f5984
jmp 0x4bf622
call sub.kernel32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
jmp 0x4bf622
xor ebx, ebx
mov rsi, rdi
mov rax, rbx
mov rdx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov byte [rsp + 0x33], 1
lea rax, [rsp + 0x33]
mov qword [rsp + 0x38], rax
lea rax, str._home_slixe_.cargo_registry_src_index.crates.io_6f17d22bba15001f_mio_1.0.2_src_sys_windows_net.rs
mov qword [rsp + 0x20], rax
lea rax, [0x0083c060]
lea r9, [0x00740a80]
lea r8, [rsp + 0x38]
mov esi, ecx
mov rcx, rax
xor edx, edx
call sym.std::sys::sync::once::queue::Once::call::hb4e640d06204af1e
mov ecx, esi
jmp 0x4bf5b5
Function at 0x4c3270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov ecx, dword [0x0071b090]
test ecx, ecx
je 0x4c3346
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4c333f
je 0x4c333d
lea rcx, [rsp + 0x20]
call sym.parking_lot_core::parking_lot::ThreadData::new::h93c10ae7ed024061
movzx eax, byte [0x0083c308]
mov edx, 0x40
xor ecx, ecx
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h5a8f05db6a24897c
test rax, rax
je 0x4c3392
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x30], rcx
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmm2, xmmword [rsp + 0x40]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h9350fdb68b322476
mov rsi, rax
mov qword [rax + 0x38], rcx
mov ecx, dword [0x0071b090]
test ecx, ecx
je 0x4c3365
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x0071b090]
test ecx, ecx
je 0x4c3375
dec ecx
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
je 0x4c3338
lock dec qword [0x0083c070]
mov rcx, qword [0x0083c108]
xor edx, edx
mov r8, rdi
call fcn.006f5b74
mov rax, rsi
jmp 0x4c333f
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h9350fdb68b322476
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c3295
jmp 0x4c333f
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h9350fdb68b322476
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
jmp 0x4c32fe
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h9350fdb68b322476
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h3a56cd97d8b2cb6b
mov ecx, eax
mov rdx, rsi
call fcn.006f5c64
test rdi, rdi
jne 0x4c331f
jmp 0x4c3338
mov ecx, 8
mov edx, 0x40
call sym.alloc::alloc::handle_alloc_error::h033f15fcf3b32b44
ud2