joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d80a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov ecx, dword [0x1402b7048]
test ecx, ecx
je 0x1400d80cd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400d80e6
cmp qword [rax + 8], 0
je 0x1400d80e6
add rax, 0x10
add rsp, 0x50
pop rsi
ret
lea rcx, sym.std::sys::common::thread_local::os_local::destroy_value::h15a3cd3cb4c6dde2
call sym.std::sys::windows::thread_local_key::StaticKey::init::h6a94beccf240c3a3
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400d80bc
mov ecx, dword [0x1402b7048]
test ecx, ecx
je 0x1400d81a0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400d81bd
mov rsi, rax
test rax, rax
jne 0x1400d8177
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1400d8138
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400d820f
mov rcx, rax
mov qword [0x1403610c8], rax
mov r8d, 0x18
xor edx, edx
call fcn.14014aadc
test rax, rax
je 0x1400d820f
mov rsi, rax
lea rax, sym.std::sys::common::thread_local::os_local::destroy_value::h15a3cd3cb4c6dde2
lea eax, [0x1402b7030]
lea rcx, sym.std::sys::common::thread_local::os_local::destroy_value::h15a3cd3cb4c6dde2
call sym.std::sys::windows::thread_local_key::StaticKey::init::h6a94beccf240c3a3
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400d8105
xor eax, eax
add rsp, 0x50
pop rsi
ret
Function at 0x1400e0530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov r14, rdx
mov rsi, rcx
mov rbp, qword [rdx]
mov rbx, qword [rdx + 8]
mov r8, qword [rbp + 0xa0]
mov rdi, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
mov dword [rsp + 0x58], eax
cmp eax, 0x5b
jne 0x1400e0bcc
add rbp, 0xa0
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump::h79d57655808a8b62
test al, al
je 0x1400e05ad
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump_space::h136a8c0723ad6479
mov r8, qword [rbp]
cmp r8, rdi
jne 0x1400e069f
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0xb8], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb0], rax
test rdi, rdi
je 0x1400e0630
js 0x1400e0bf8
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1400e0611
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e0623
mov rcx, rax
mov qword [0x1403610c8], rax
xor edx, edx
mov r8, rdi
call fcn.14014aadc
mov r14, rax
test rax, rax
jne 0x1400e0636
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
mov r15d, eax
cmp eax, 0x5e
jne 0x1400e06d9
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump::h79d57655808a8b62
test al, al
je 0x1400e05ad
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump_space::h136a8c0723ad6479
mov r8, qword [rbp]
cmp r8, rdi
je 0x1400e05ad
jmp 0x1400e06dd
mov r8, qword [rbp]
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x28], rbx
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0xb8], xmm0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 8
mov qword [rsp + 0x68], 0
mov r13d, 8
lea rbx, [rsp + 0xb8]
xor r12d, r12d
lea r15, [rsp + 0xa0]
nop dword [rax + rax]
mov qword [rsp + 0xa0], 0
lea rdx, [0x1402d1be0]
lea r9, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_syntax_0.8.2_src_ast_parse.rs
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0xa0]
call sym.core::panicking::assert_failed::h7826f930a0925192
Function at 0x1400e2690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r12, rdx
mov rdi, rcx
mov rsi, qword [rdx]
mov rbx, qword [rdx + 0x10]
lea r13, [rsi + 0xa0]
mov rbp, qword [rsi + 0xa0]
cmp rbp, rbx
jne 0x1400e2750
mov rax, qword [r13 + 0x10]
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x68], xmm0
mov rax, qword [r13 + 0x10]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [r13]
movaps xmmword [rsp + 0x50], xmm0
mov rbx, qword [r12 + 8]
test rbp, rbp
je 0x1400e2783
js 0x1400e3096
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1400e272e
mov rsi, rbp
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e2743
mov rcx, rax
mov qword [0x1403610c8], rax
mov rbp, rsi
xor edx, edx
mov rsi, rbp
mov r8, rbp
call fcn.14014aadc
mov r14, rax
test rax, rax
jne 0x1400e278c
mov ecx, 1
mov rdx, rsi
call sym.alloc::alloc::handle_alloc_error::hc580476980f9927e
mov dword [rsp + 0x9c], r8d
lea rax, [rsi + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0xa8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsi + 0xb0]
mov qword [rsp + 0x40], rax
mov r15, qword [r12 + 8]
jmp 0x1400e27f3
mov rsi, rbp
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call sym.memcpy
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm1
movups xmmword [rdi + 0x70], xmm2
mov qword [rdi], rsi
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], rsi
mov dword [rdi + 0x18], 0x14
jmp 0x1400e3021
Function at 0x1400e3240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov rbx, qword [rdx + 8]
mov r8, qword [r15 + 0xa0]
add r15, 0xa0
mov rdi, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
cmp eax, 0x78
je 0x1400e32a5
mov r8, qword [r15]
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
cmp eax, 0x75
je 0x1400e32a5
mov r8, qword [r15]
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
cmp eax, 0x55
jne 0x1400e33ec
mov r8, qword [r15]
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
cmp eax, 0x75
sete cl
mov dl, 2
sub dl, cl
xor ecx, ecx
cmp eax, 0x78
movzx ebp, dl
cmove ebp, ecx
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump::h79d57655808a8b62
test al, al
je 0x1400e32e8
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump_space::h136a8c0723ad6479
mov r8, qword [r15]
cmp r8, rdi
jne 0x1400e33ab
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x30], rax
test rdi, rdi
je 0x1400e335d
js 0x1400e33e7
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1400e333e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e3350
mov rcx, rax
mov qword [0x1403610c8], rax
xor edx, edx
mov r8, rdi
call fcn.14014aadc
mov r14, rax
test rax, rax
jne 0x1400e3363
mov ecx, 1
mov rdx, rdi
call sym.alloc::alloc::handle_alloc_error::hc580476980f9927e
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sym.memcpy
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm1
movups xmmword [rsi + 0x70], xmm2
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov dword [rsi + 0x18], 0xa
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
mov rcx, rsi
mov rdx, r14
mov r8d, ebp
cmp eax, 0x7b
jne 0x1400e33d5
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp sym.regex_syntax::ast::parse::ParserI_P_::parse_hex_brace::h234ea75be69156f9
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp sym.regex_syntax::ast::parse::ParserI_P_::parse_hex_digits::heba5f68faa6e6a59
call sym.alloc::raw_vec::capacity_overflow::he878bd52295379cc
lea rcx, str.assertion_failed:_self.char____x__self.char____u__self.char____U
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_syntax_0.8.2_src_ast_parse.rs
mov edx, 0x50
call sym.core::panicking::panic::haa5ab648900af052
int3
Function at 0x1400e4480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov r12, qword [rdx]
mov r13, qword [rdx + 8]
mov r8, qword [r12 + 0xa0]
mov rdi, qword [rdx + 0x10]
mov rcx, r13
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
mov dword [rsp + 0x80], eax
cmp eax, 0x7b
jne 0x1400e4a7a
lea rbx, [r12 + 0xa0]
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump::h79d57655808a8b62
test al, al
je 0x1400e4503
mov rcx, r14
call sym.regex_syntax::ast::parse::ParserI_P_::bump_space::h136a8c0723ad6479
mov r8, qword [rbx]
cmp r8, rdi
jne 0x1400e45cc
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x30], rax
test rdi, rdi
je 0x1400e4577
js 0x1400e4aa3
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0xb0], xmm0
mov rcx, r13
mov rdx, rdi
call sym.regex_syntax::ast::parse::ParserI_P_::char_at::h03b3d509f825a1c1
cmp eax, 0x2d
je 0x1400e4624
and eax, 0x1fffdf
add eax, 0xffffffbf
cmp eax, 0x1a
jb 0x1400e4624
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
mov byte [rsi + 8], 0xc
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e45b8
cmp qword [r12 + 0x80], 0
jne 0x1400e4aa8
mov qword [r12 + 0x80], 0xffffffffffffffff
mov qword [r12 + 0x98], 0
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x20], 0
lea rdx, [0x1402d1f18]
lea r9, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_syntax_0.8.2_src_ast_parse.rs
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x20]
call sym.core::panicking::assert_failed::h7826f930a0925192
Function at 0x1400ed5b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x1400ed70e
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
ja 0x1400ed7b3
mov rdi, rdx
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1400ed613
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400ed7a6
mov rcx, rax
mov qword [0x1403610c8], rax
xor edx, edx
mov r8, rbx
call fcn.14014aadc
test rax, rax
je 0x1400ed7a6
cmp rbx, 0xa0
jb 0x1400ed689
lea rcx, [rax + r14*8]
add rcx, 0xfffffffffffffff8
xor edx, edx
cmp rcx, rax
jb 0x1400ed68b
lea rcx, [rax + 4]
lea r8, [rax + r14*8]
add r8, 0xfffffffffffffffc
cmp r8, rcx
jb 0x1400ed68b
movabs rcx, 0x1ffffffffffffffe
lea r8, [r14 - 1]
lea r9, [rcx + 1]
cmp r8, r9
ja 0x1400ed68b
mov rdx, rbx
and rdx, 0xfffffffffffffff8
lea r8, [rdi + rdx]
cmp rax, r8
jae 0x1400ed72a
mov r8, rax
add r8, rdx
cmp r8, rdi
jbe 0x1400ed72a
xor edx, edx
mov rcx, rdx
or rcx, 1
test bl, 8
je 0x1400ed6ba
mov r8d, dword [rdi + rdx*8]
mov r9d, dword [rdi + rdx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rdx*8], r10d
mov dword [rax + rdx*8 + 4], r9d
mov rdx, rcx
cmp r14, rcx
je 0x1400ed715
nop
mov ecx, dword [rdi + rdx*8]
mov r8d, dword [rdi + rdx*8 + 4]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8], r9d
mov dword [rax + rdx*8 + 4], r8d
mov ecx, dword [rdi + rdx*8 + 8]
mov r8d, dword [rdi + rdx*8 + 0xc]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8 + 8], r9d
mov dword [rax + rdx*8 + 0xc], r8d
add rdx, 2
cmp r14, rdx
jne 0x1400ed6c0
mov rcx, rdx
jmp 0x1400ed715
xor ecx, ecx
mov eax, 4
mov qword [rsi], r14
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
and rcx, r14
xor edx, edx
movdqa xmm0, xmmword [0x1402bf4d0]
nop word [rax + rax]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400ed740
mov rdx, rcx
cmp r14, rcx
je 0x1400ed715
jmp 0x1400ed68b
mov ecx, 4
mov rdx, rbx
call sym.alloc::alloc::handle_alloc_error::hc580476980f9927e
call sym.alloc::raw_vec::capacity_overflow::he878bd52295379cc
int3
Function at 0x140106430
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae sym.core::str::count::do_count_chars::h4155dae073d780b0
cmp rax, rcx
je 0x140106455
cmp rdx, 4
jae 0x140106458
xor eax, eax
xor r8d, r8d
jmp 0x1401064f0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1402bfd10]
movdqa xmm3, xmmword [0x1402bfd20]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140106480
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140106507
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1401064f0
ret
Function at 0x1401131e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14011a8b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movd xmm1, dword [rdx + 8]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
movd xmm2, r9d
punpcklqdq xmm2, xmm1
shufps xmm0, xmm2, 0x24
xorps xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
ret
Function at 0x140121190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx eax, byte [0x1403610d0]
test al, al
je 0x14012132f
test edx, edx
je 0x1401211b7
cmp edx, 3
jne 0x14012132f
mov rbx, qword [0x1403610d8]
test rbx, rbx
je 0x14012132f
xor r14d, r14d
jmp 0x1401211d9
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14012120d
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x14012137a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1401211d0
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.14014a9a4
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x1401211d0
test r14b, 1
je 0x14012132f
mov rbx, qword [0x1403610d8]
test rbx, rbx
je 0x14012132f
xor r14d, r14d
jmp 0x140121239
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14012126d
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x14012137a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140121230
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.14014a9a4
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140121230
test r14b, 1
je 0x14012132f
mov rbx, qword [0x1403610d8]
test rbx, rbx
je 0x14012132f
xor r14d, r14d
jmp 0x140121299
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1401212cd
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x14012137a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140121290
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.14014a9a4
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x140121290
test r14b, 1
je 0x14012132f
mov rbx, qword [0x1403610d8]
test rbx, rbx
je 0x14012132f
xor r14d, r14d
jmp 0x1401212f9
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140121329
mov esi, dword [rbx + 0x18]
mov r15, qword [rbx]
test r15, r15
je 0x14012137a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1401212f0
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.14014a9a4
mov rcx, rdi
call r15
mov r14b, 1
jmp 0x1401212f0
test r14b, 1
jne 0x14012133b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rbx, qword [0x1403610d8]
jmp 0x140121348
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14012132f
mov esi, dword [rbx + 0x18]
mov r14, qword [rbx]
test r14, r14
je 0x14012137a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140121344
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.14014a9a4
mov rcx, rdi
call r14
jmp 0x140121344
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
lea r8, str.library_std_src_syswindows_thread_local_key.rs
mov edx, 0x2b
call sym.core::panicking::panic::haa5ab648900af052
ud2
Function at 0x140122080
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140122105
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140122146
cmp dword [rsp + 0x2c], 0
je 0x14012212a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14012215e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1403610d8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1403610d8], rsi
jne 0x1401220e0
mov byte [0x1403610d0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14012213c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x1401221a8
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14012212f
mov edi, dword [rsp + 0x28]
jmp 0x14012213c
mov edi, dword [rsi + 0x18]
jmp 0x14012213a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call sym.core::panicking::assert_failed::hbf4817ca54be2dc8
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call sym.core::panicking::panic_fmt::hc685bd5fdf74c15e
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call sym.core::panicking::assert_failed::habaea397e80e5efc
int3