joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021f520
Capabilities:
Reference wmi statements

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x14021f5f7
lea rcx, [0x14032ed32]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x14021f5f7
mov rbx, qword [rsp + 0x30]
cmp qword [rsi + 0x20], 0
je 0x14021f5c3
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14021f5c3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x14021f65f
mov qword [rdi], 2
mov rcx, qword [rsi + 0x28]
cmp qword [rsi + 0x20], 0
mov qword [rsi + 0x20], 0
je 0x14021f61c
test rcx, rcx
je 0x14021f61c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 0x10], 0
test r15, r15
je 0x14021f638
test rcx, rcx
je 0x14021f638
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x14021f654
test rcx, rcx
je 0x14021f654
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rsi + 0x30], 0
je 0x14021f65f
call fcn.1402dad9c
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14021ff30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1402de7d8]
jmp sym.std::sys::thread_local::os::Storage_T_::get::h84cf90d03eafc23d

Function at 0x140221850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1402de7d8]
jmp sym.std::sys::thread_local::os::Storage_T_::get::h84cf90d03eafc23d

Function at 0x140221f70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140221fb2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140221fba
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140221fcb
jmp 0x140221fe2
xor r10d, r10d
jmp 0x14022206d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140221fe2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140221ff9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140222019
add r11, r8
jmp 0x14022214b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1402220e2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140222090
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140222100
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140222112
jmp 0x14022212d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14022212d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140222147
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x140222950
Capabilities:
Get disk size

Disassembly:
push rsi
sub rsp, 0x30
cmp qword [rcx + 0x78], 0
je 0x140222993
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov rcx, qword [rcx + 0x50]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x140222993
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x80], rax
mov al, 1
add rsp, 0x30
pop rsi
ret
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x140222a10
Capabilities:
Get disk size

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
xor edi, edi
lea r8, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rdx
xor edx, edx
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x140222a5c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov edi, 1
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140222a70
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x24], eax
test eax, eax
je 0x140222adb
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x24]
mov qword [rsp + 0x40], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call sym._ZN5rayon4iter6extend91__LT_impl_u20_rayon..iter..ParallelExtend_LT_T_GT__u20_for_u20_alloc..vec..Vec_LT_T_GT__GT_10par_extend
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi], xmm0
jmp 0x140222af2
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x1402241c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.0___]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::hb6e5c9660c144cb0
Function at 0x140225960
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov rsi, r9
mov rdi, rcx
add r8, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h14d6973f08
mov rax, qword [rsp + 0xe0]
add rax, rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x78]
lea rbx, [rsp + 0x40]
mov rdx, rbx
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h14d6973f08
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x140225a41
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140225a1f
mov rcx, qword [rsp + 0x80]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140225a3a
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call sym.__rust_dealloc
xor ebp, ebp
jmp 0x140225ad6
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 0
mov rdi, qword [rsp + 0x80]
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bpl
mov r14d, dword [rsp + 0x38]
mov rcx, rbx
call fcn.1402db24c
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140225abb
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140225ad6
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call sym.__rust_dealloc
shl r14, 8
movzx eax, bpl
or rax, r14
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140225c70
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov dword [rsp + 0x28], 0x3c00
mov ecx, 0x3c00
call sym.malloc
test rax, rax
je 0x140225dac
mov rdi, rax
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x140225e05
cmp eax, 0x6f
jne 0x140225d4e
mov rcx, rdi
call fcn.1402dbf68
mov ecx, dword [rsp + 0x28]
call sym.malloc
test rax, rax
je 0x140225dac
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x140225e05
cmp eax, 0x6f
jne 0x140225d4e
mov rcx, rdi
call fcn.1402dbf68
mov ecx, dword [rsp + 0x28]
call sym.malloc
test rax, rax
je 0x140225dac
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x140225e05
mov rcx, rdi
call fcn.1402dbf68
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hffb574642817ad4a]
mov qword [rsp + 0x38], rax
lea rax, [0x14032f918]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sym.alloc::fmt::format::format_inner::h5a493f368b54610e
jmp 0x140225e1a
mov rax, qword [0x1403591d8]
movzx eax, byte [rax]
mov ecx, 0x32
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x140225e25
movups xmm0, xmmword [0x14032f8d7]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14032f8c7]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x14032f8b7]
movups xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsi], 0x32
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x32
jmp 0x140225e1a
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov ecx, 1
mov edx, 0x32
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
int3
Function at 0x14022ad40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1402de5e8]
jmp sym.std::sys::thread_local::os::Storage_T_::get::hfbcf880f4fcc9c69

Function at 0x14022ad50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1402de5d8]
jmp sym.std::sys::thread_local::os::Storage_T_::get::h903017d76e616058

Function at 0x140231d30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [0x1402de5e8]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::hfbcf880f4fcc9c69
Function at 0x1402376f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
movups xmm0, xmmword [rdx + 0x38]
movups xmm1, xmmword [rdx + 0x48]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rdx + 0x28]
movzx ebp, byte [rdx + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], bpl
mov rax, qword [0x1403591d8]
movzx eax, byte [rax]
mov ecx, 0x5f0
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140237960
mov rbx, rax
movabs r15, 0x800000000000000
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xa60c596fc19fead0
movabs r9, 0xded7d4e2d7dedfc6
movabs r10, 0xe414a674f0de7325
nop dword [rax]
mov eax, 1
lock xadd qword [0x1403bbb28], rax
mov r11, rax
xor r11, rcx
mov r14, r11
rol r14, 0x10
lea r12, [r11 + rdx]
xor r14, r12
add r11, r8
lea r12, [r14 + r9]
mov r13, r11
xor r13, r10
rol r14, 0x15
rol r11, 0x20
xor rax, r12
xor r12, r15
xor r12, r14
add rax, r13
rol r13, 0xd
add r11, r12
xor r13, rax
rol r12, 0x10
xor r12, r11
rol rax, 0x20
add r11, r13
add rax, r12
rol r13, 0x11
xor r13, r11
rol r12, 0x15
rol r11, 0x20
xor r12, rax
xor rax, r15
xor r11, 0xff
add rax, r13
add r11, r12
rol r13, 0xd
xor r13, rax
rol r12, 0x10
rol rax, 0x20
xor r12, r11
add r11, r13
rol r13, 0x11
add rax, r12
xor r13, r11
rol r12, 0x15
xor r12, rax
rol r11, 0x20
add rax, r13
add r11, r12
rol r13, 0xd
xor r13, rax
rol r12, 0x10
rol rax, 0x20
xor r12, r11
add r11, r13
rol r13, 0x11
add rax, r12
xor r13, r11
rol r12, 0x15
xor r12, rax
rol r11, 0x20
add rax, r13
add r11, r12
rol r13, 0xd
xor r13, rax
rol r12, 0x10
xor r12, r11
add r11, r13
rol r13, 0x11
rol r12, 0x15
mov rax, r11
rol rax, 0x20
xor rax, r13
xor rax, r12
xor rax, r11
je 0x1402377b0
mov rcx, qword [rsi + 0x58]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov rdx, qword [rsp + 0x20]
mov qword [rdi + 0x138], rdx
mov byte [rdi + 0x140], bpl
mov qword [rdi], 0
mov qword [rdi + 8], rbx
mov qword [rdi + 0x80], 0
mov qword [rdi + 0x88], rbx
mov rdx, qword [rsp + 0x28]
mov qword [rdi + 0x100], rdx
mov qword [rdi + 0x108], rax
mov qword [rdi + 0x110], rcx
mov rdx, qword [rsi + 0x10]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14023794c
test rdx, rdx
je 0x14023794c
mov rcx, qword [rsi + 0x18]
mov r8d, 1
call sym.__rust_dealloc
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x5f0
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
ud2

Function at 0x140237fc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, sym.std::sys::thread_local::os::destroy_value::h371b1a880603043f
jmp sym.std::sys::thread_local::os::Storage_T_::get::h854ddb3983b75498
Function at 0x140238ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.0___]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h80c98249436509ec

Function at 0x1402392f0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1402db1bc
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402db1bc

Function at 0x140239330
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1402db1bc
mov edx, 0xc
mov r8d, 4
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402db1bc

Function at 0x140239370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x140239457
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14023944f
je 0x14023944d
test rbx, rbx
je 0x1402393b4
mov rdi, qword [rbx + 8]
cmp qword [rbx], 0
mov qword [rbx], 0
jne 0x1402393c4
call sym.crossbeam_epoch::default::default_collector::hccf5fb05f37e3dd3
mov rcx, rax
call sym.crossbeam_epoch::collector::Collector::register::h748c97f0be74e1bd
mov rdi, rax
mov rax, qword [0x1403591d8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140239471
mov qword [rax], rdi
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.1402db1bc
test rdi, rdi
je 0x140239448
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
cmp qword [rcx + 0x818], 0
jne 0x140239435
cmp rax, 1
jne 0x140239435
call sym.crossbeam_epoch::internal::Local::finalize::hbfbff793beb4bf2a
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x14023944f
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140239398
jmp 0x14023944f
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
ud2
Function at 0x1402394e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x140239587
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14023957f
je 0x140239520
test rdi, rdi
je 0x140239524
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x140239526
mov rbx, qword [rdi + 8]
jmp 0x140239526
xor eax, eax
jmp 0x14023957f
xor ebx, ebx
mov rax, qword [0x1403591d8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1402395a1
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.1402db1bc
test rdi, rdi
je 0x14023957c
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140239504
jmp 0x14023957f
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x14023da50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [0x140359098]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h854ddb3983b75498

Function at 0x140242430
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.1402db1bc
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
cmp qword [rcx + 0x818], 0
jne 0x140242472
cmp rax, 1
jne 0x140242472
call sym.crossbeam_epoch::internal::Local::finalize::hbfbff793beb4bf2a
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402db1bc
Function at 0x140265f20
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret

Function at 0x140267230
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1402672c0
jmp 0x1402672af
jae 0x14026737b
cmp r8, 0x201
jae 0x1402672c0
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x140267317
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1402672ef
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h498cd2a0878ddf3d
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x14026733d
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1402673e7
mov r8d, r13d
cmp r12, r8
jne 0x1402672a0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x14026741a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1402672af
jmp 0x1402672c0
cmp r14, r8
jb 0x140267434
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h4f0d847f13879248
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x1402673d0
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x1402673bb
jmp 0x1402673d0
lea rcx, str.internal_error:_entered_unreachable_codeHi3_
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call sym.core::panicking::panic::h82631201f060ca88
jmp 0x140267449
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
ud2
Function at 0x140267480
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x14026749f
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hab0355a4f2b8b8d2]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
ud2