joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e3ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, sym.std::sys::thread_local::os::destroy_value::h51e28eb9ebc44057
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h30e103cd9492790d

Function at 0x1401e3ad0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call fcn.1402fb86c
mov rax, qword [rdi]
dec qword [rax]
jne 0x1401e3b09
dec qword [rax + 8]
jne 0x1401e3b09
mov edx, 0x170
mov r8d, 0x10
mov rcx, rax
call sym.__rust_dealloc
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402fb86c
Function at 0x1401e7490
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1401e74f6
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x1401e74b8
add rdi, rbx
sub rsi, rbx
je 0x1401e74f6
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1401e74b0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x1401e74b0
and ebp, 0x7fffffff
jmp 0x1401e74f8
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1401e7e00
Capabilities:
Get session user name

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
xor ecx, ecx
call sub.advapi32.dll_GetUserNameW
test eax, eax
jne 0x1401e7f2c
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h8ad5a1ea52680193
cmp edi, 0x7a
jne 0x1401e7e76
mov edi, dword [rsp + 0x24]
test rdi, rdi
je 0x1401e7e99
lea r14, [rdi + rdi]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov edx, 2
mov rcx, r14
call sym.__rust_alloc
test rax, rax
je 0x1401e7f44
mov rbx, rax
jmp 0x1401e7e9e
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1401e7f1f
mov ebx, 2
mov dword [rsp + 0x24], edi
lea rdx, [rsp + 0x24]
mov rcx, rbx
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x1401e7ec2
mov r8d, dword [rsp + 0x24]
test r8, r8
je 0x1401e7ee6
dec r8
jmp 0x1401e7ee9
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test edi, edi
jne 0x1401e7f0b
jmp 0x1401e7f1f
xor r8d, r8d
lea rcx, [rsp + 0x28]
mov rdx, rbx
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test edi, edi
je 0x1401e7f1f
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1403bed56]
lea r8, [0x1403bedd0]
mov edx, 0x16
call sym.core::panicking::panic::h82631201f060ca88
mov ecx, 2
mov rdx, r14
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
mov rsi, rax
test edi, edi
je 0x1401e7f6c
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rcx, rsi
call sym._Unwind_Resume
int3
Function at 0x1401e7f80
Capabilities:
Get session user name

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ebp, edx
mov rsi, rcx
mov dword [rsp + 0x24], 0
lea r8, [rsp + 0x24]
mov ecx, edx
xor edx, edx
call sub.secur32.dll_GetUserNameExW
test al, al
jne 0x1401e80d7
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h8ad5a1ea52680193
cmp edi, 0xea
je 0x1401e7fea
cmp edi, 0x534
jne 0x1401e801c
lea rdx, str.Missing_recordLinuxBSDMac_OSillumosiOSNintendoXBoxPlayStationFuchsiaRedox
mov r8d, 0xe
xor ecx, ecx
call sym.std::io::error::Error::new::hf5317d2be5b4732f
jmp 0x1401e8029
mov edi, dword [rsp + 0x24]
test rdi, rdi
je 0x1401e803c
lea r14, [rdi + rdi]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov edx, 2
mov rcx, r14
call sym.__rust_alloc
test rax, rax
je 0x1401e80ef
mov rbx, rax
jmp 0x1401e8041
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1401e80a5
mov ebx, 2
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x28]
mov ecx, ebp
mov rdx, rbx
call sub.secur32.dll_GetUserNameExW
test al, al
je 0x1401e80b3
mov r8d, dword [rsp + 0x28]
lea eax, [r8 + 1]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x24], eax
jne 0x1401e80fc
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test edi, edi
je 0x1401e80a5
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test edi, edi
jne 0x1401e8091
jmp 0x1401e80a5
lea rcx, [0x1403bed56]
lea r8, [0x1403bee00]
mov edx, 0x16
call sym.core::panicking::panic::h82631201f060ca88
mov ecx, 2
mov rdx, r14
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x24]
lea rdx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call sym.core::panicking::assert_failed::h1b4d8f30e0568595
ud2
Function at 0x1401e8180
Capabilities:
Get hostname

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov ecx, 1
xor edx, edx
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
jne 0x1401e82a9
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h8ad5a1ea52680193
cmp edi, 0xea
jne 0x1401e81fe
mov edi, dword [rsp + 0x20]
test rdi, rdi
je 0x1401e821e
lea r14, [rdi + rdi]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov edx, 2
mov rcx, r14
call sym.__rust_alloc
test rax, rax
je 0x1401e82c1
mov rbx, rax
jmp 0x1401e8223
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1401e8278
mov ebx, 2
mov dword [rsp + 0x24], edi
lea r8, [rsp + 0x24]
mov ecx, 1
mov rdx, rbx
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1401e8285
mov r8d, dword [rsp + 0x24]
lea rcx, [rsp + 0x28]
mov rdx, rbx
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test edi, edi
je 0x1401e8278
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test edi, edi
jne 0x1401e8264
jmp 0x1401e8278
lea rcx, [0x1403bed56]
lea r8, [0x1403bee18]
mov edx, 0x16
call sym.core::panicking::panic::h82631201f060ca88
mov ecx, 2
mov rdx, r14
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
mov rsi, rax
test edi, edi
je 0x1401e82e9
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rcx, rsi
call sym._Unwind_Resume
int3
Function at 0x1401e8300
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov dword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
xor ecx, ecx
xor edx, edx
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
jne 0x1401e848b
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h8ad5a1ea52680193
cmp edi, 0xea
jne 0x1401e8381
mov edi, dword [rsp + 0x28]
test rdi, rdi
je 0x1401e83a4
lea r14, [rdi + rdi]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov edx, 2
mov rcx, r14
call sym.__rust_alloc
test rax, rax
je 0x1401e84a3
mov rbx, rax
jmp 0x1401e83a9
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1401e8478
mov ebx, 2
mov dword [rsp + 0x2c], edi
lea r8, [rsp + 0x2c]
xor ecx, ecx
mov rdx, rbx
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1401e8408
mov r8d, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
call sym.std::sys::os_str::wtf8::Buf::into_string::hea150b589ea4789a
movabs r13, 0x8000000000000000
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
cmp r15, r13
jne 0x1401e842c
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov r13, r14
jmp 0x1401e845d
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test edi, edi
jne 0x1401e8464
jmp 0x1401e8478
lea rdx, str.Not_valid_unicodeGnomeWindowsLXDEOpenboxMateXFCEKDECinnamonI3AquaIOSAndroidWeb_BrowserConsoleUbuntuErmineOrbitalUSenen_eses_assertion_failed:_fail_home_kali_.cargo_registry_src_index.crates.io_6f17d22bba15001f_whoami_1.5.1_src_os_windows.rs
mov r8d, 0x11
mov cl, 0x15
call sym.std::io::error::Error::new::hf5317d2be5b4732f
mov r12, rax
test r15, r15
je 0x1401e8459
mov r8d, 1
mov rcx, r14
mov rdx, r15
call sym.__rust_dealloc
mov qword [rsi + 8], r12
mov qword [rsi], r13
test edi, edi
je 0x1401e8478
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1403bed56]
lea r8, [0x1403bee30]
mov edx, 0x16
call sym.core::panicking::panic::h82631201f060ca88
mov ecx, 2
mov rdx, r14
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
mov rsi, rax
test r15, r15
je 0x1401e84ce
mov r8d, 1
mov rcx, r14
mov rdx, r15
call sym.__rust_dealloc
jmp 0x1401e84ce
test edi, edi
je 0x1401e84e6
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rcx, rsi
call sym._Unwind_Resume
int3
Function at 0x140203dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test rdx, rdx
je 0x140203fa1
add rdx, rcx
xor eax, eax
xor r9d, r9d
jmp 0x140203e0a
xor r11b, 1
movzx r8d, r11b
add rax, r8
mov r8d, r9d
mov r9d, r8d
cmp rcx, rdx
je 0x140203fa3
movzx r10d, byte [rcx]
test r10b, r10b
js 0x140203e30
inc rcx
mov r8b, 1
cmp r10d, 0x20
jae 0x140203ec0
jmp 0x140203dfe
mov r8d, r10d
and r8d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xe0
jb 0x140203e86
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x140203ea2
movzx r10d, byte [rcx + 3]
add rcx, 4
and r8d, 7
shl r8d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r8d
mov r8b, 1
cmp r10d, 0x20
jae 0x140203ec0
jmp 0x140203dfe
add rcx, 2
shl r8d, 6
or r8d, esi
mov r10d, r8d
mov r8b, 1
cmp r10d, 0x20
jae 0x140203ec0
jmp 0x140203dfe
add rcx, 3
shl r8d, 0xc
or r11d, r8d
mov r10d, r11d
mov r8b, 1
cmp r10d, 0x20
jb 0x140203dfe
nop dword [rax]
cmp r10d, 0x7f
je 0x140203dfe
mov r11d, r9d
and r11b, 1
je 0x140203df0
cmp r10d, 0x6d
jne 0x140203df0
cmp rcx, rdx
je 0x140203fa3
movzx r10d, byte [rcx]
test r10b, r10b
js 0x140203f05
inc rcx
cmp r10d, 0x20
jae 0x140203f89
jmp 0x140203dfe
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x140203f58
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x140203f71
movzx r10d, byte [rcx + 3]
add rcx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r9d
cmp r10d, 0x20
jae 0x140203f89
jmp 0x140203dfe
add rcx, 2
shl r9d, 6
or r9d, esi
mov r10d, r9d
cmp r10d, 0x20
jae 0x140203f89
jmp 0x140203dfe
add rcx, 3
shl r9d, 0xc
or r11d, r9d
mov r10d, r11d
cmp r10d, 0x20
jb 0x140203dfe
xor r11d, r11d
mov r9d, 0
cmp r10d, 0x7f
jne 0x140203df0
jmp 0x140203dfe
xor eax, eax
pop rsi
ret
Function at 0x14020f540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rsi, r8
mov rdi, rdx
mov byte [rsp + 0xfd], cl
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 8
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x20], 2
mov qword [rsp + 0x88], 0
movabs rax, 0x8000000000000001
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x98], 3
mov byte [rsp + 0x9c], 3
mov byte [rsp + 0xa0], 3
mov word [rsp + 0xa4], 0
mov byte [rsp + 0xa6], 3
mov byte [rsp + 0xaa], 3
mov byte [rsp + 0xae], 3
mov word [rsp + 0xb2], 0
mov byte [rsp + 0xb4], 3
mov byte [rsp + 0xb8], 3
mov byte [rsp + 0xbc], 3
mov word [rsp + 0xc0], 0
mov byte [rsp + 0xc2], 3
mov byte [rsp + 0xc6], 3
mov byte [rsp + 0xca], 3
mov word [rsp + 0xce], 0
mov byte [rsp + 0xd0], 3
mov byte [rsp + 0xd4], 3
mov byte [rsp + 0xd8], 3
mov word [rsp + 0xdc], 0
mov byte [rsp + 0xde], 3
mov byte [rsp + 0xe2], 3
mov byte [rsp + 0xe6], 3
mov word [rsp + 0xea], 0
mov byte [rsp + 0xec], 3
mov byte [rsp + 0xf0], 3
mov byte [rsp + 0xf4], 3
mov word [rsp + 0xf8], 0
mov word [rsp + 0xfb], 0x202
mov byte [rsp + 0xfa], 0
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov ecx, 0xe0
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14020f723
mov rbx, rax
lea rdx, [rsp + 0x20]
mov r8d, 0xe0
mov rcx, rax
call sym.memcpy
cmp dword [rbx], 2
je 0x14020f6f8
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14020f6f8
mov rcx, qword [rbx + 0x10]
mov r8d, 1
call sym.__rust_dealloc
mov qword [rbx], 1
movups xmm0, xmmword [rsi]
movups xmmword [rbx + 8], xmm0
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x18], rax
mov rcx, rbx
mov rdx, rdi
add rsp, 0x100
pop rbx
pop rdi
pop rsi
jmp sym.clap_builder::error::Error_F_::with_cmd::hd9236cd4ac7b9d2c
mov ecx, 8
mov edx, 0xe0
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
ud2
Function at 0x140255f70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.PD_]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h649b1ba41a19b03d

Function at 0x14025a770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x14025a83f
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14025a832
je 0x14025a830
test rdi, rdi
je 0x14025a7b9
movups xmm6, xmmword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
jne 0x14025a7d5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [str.1_F_]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14025a859
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.1402fb86c
test rdi, rdi
je 0x14025a82b
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x14025a832
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14025a79d
jmp 0x14025a832
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3
Function at 0x14025b810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
cmp byte [rsp + 0x118], 0x6d
jne 0x14025c36e
cmp byte [rsp + 0x110], 0
jne 0x14025c36e
mov esi, dword [rcx + 0x18]
mov r13d, dword [rcx + 0x1c]
mov dword [rsp + 0x6c], r13d
mov r8d, esi
shr r8d, 8
mov dword [rsp + 0x68], r8d
mov r8d, esi
shr r8d, 0x10
mov dword [rsp + 0x78], r8d
mov r12d, esi
shr r12d, 0x18
mov r8d, r13d
shr r8d, 8
mov dword [rsp + 0x64], r8d
mov r15d, r13d
shr r15d, 0x10
shr r13d, 0x18
mov ebx, dword [rcx + 0x20]
mov edi, ebx
shr edi, 8
mov r14d, ebx
shr r14d, 0x10
mov ebp, ebx
shr ebp, 0x18
mov qword [rsp + 0x90], rcx
movzx eax, word [rcx + 0x24]
mov word [rsp + 0x5a], ax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x98]
call sym.__anstyle_parse::params::ParamsIter_as_core::iter::traits::iterator::Iterator_::next::hcffa29f5097bf527
mov dword [rsp + 0x8c], r12d
mov dword [rsp + 0x38], r12d
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x3c], ecx
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x84], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x34], r15d
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x6c]
mov dword [rsp + 0x24], ecx
mov dword [rsp + 0x7c], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x48], ebx
movzx ecx, word [rsp + 0x5a]
mov ebx, ecx
test rax, rax
je 0x14025c1fe
lea r14, [0x1403c6c9c]
lea rbp, [0x1403c6cc8]
lea r12, [0x1403c6cb0]
xor esi, esi
xor r13d, r13d
mov dword [rsp + 0x5c], ecx
xor r15d, r15d
mov dword [rsp + 0x44], ecx
xor edi, edi
movzx ecx, word [rsp + 0x5a]
mov ebx, ecx
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x80]
Function at 0x1402868e0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.8_
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret

Function at 0x140287bf0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140287c80
jmp 0x140287c6f
jae 0x140287d3b
cmp r8, 0x201
jae 0x140287c80
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x140287cd7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140287caf
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h498cd2a0878ddf3d
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140287cfd
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140287da7
mov r8d, r13d
cmp r12, r8
jne 0x140287c60
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x140287dda
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140287c6f
jmp 0x140287c80
cmp r14, r8
jb 0x140287df4
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x140287d90
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x140287d7b
jmp 0x140287d90
lea rcx, str.internal_error:_entered_unreachable_code8
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call sym.core::panicking::panic::h82631201f060ca88
jmp 0x140287e09
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
ud2
Function at 0x140287e40
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x140287e5f
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hab0355a4f2b8b8d2]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
ud2