joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d9d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call fcn.14000ef90
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
jmp 0x14000da48
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call fcn.14000efb0
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call fcn.14000ef90
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
jbe 0x14000d9f9
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000daa0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x14000dac8
mov rcx, qword [rbp + 0x10]
call fcn.14000d840
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140051640]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140051650]
mov dword [rax], 1
mov rax, qword [0x140051660]
mov dword [rax], 1
mov rax, qword [0x1400515f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140051630]
mov dword [0x14005800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140051700]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400516e0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400515a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r15d, 0x7fffffff
lea rsi, str.failed_to_write_whole_buffer
test rdi, rdi
je 0x1400014ad
cmp rdi, r15
mov r8d, 0x7fffffff
cmovb r8, rdi
mov rcx, r14
mov rdx, rbx
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x1400014b1
test eax, eax
je 0x1400014c0
movsxd rcx, eax
mov rax, rdi
sub rax, rcx
jb 0x1400014cf
add rbx, rcx
mov rdi, rax
jmp 0x140001471
xor esi, esi
jmp 0x1400014c0
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str._rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_std_srciomod.rs
mov rdx, rdi
call sym.core::slice::index::slice_start_index_len_fail::h8d3d56967d6340e8
int3
Function at 0x140007f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140007fe0
cmp r10, r11
jb 0x140008057
cmp r10, rdx
ja 0x140008069
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140007fe2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140007fc0
jmp 0x140008044
ja 0x140007fea
mov r11, r10
cmp rax, r8
jne 0x140007f8e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140008020
mov rdi, r8
sub ecx, edx
jns 0x14000803b
jmp 0x140008046
cmp r8, rsi
je 0x140008078
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140008046
xor al, 1
cmp rdi, rsi
jne 0x140008000
jmp 0x140008046
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::h786748ba81f41b02
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
lea rcx, str.librarycore_srcunicodeprintable.rs
call sym.core::option::unwrap_failed::h38ae581b954ce070
int3

Function at 0x14000e660
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000e685
cmp rax, rcx
je 0x14000e68b
cmp rdx, 4
jae 0x14000e692
xor eax, eax
xor r8d, r8d
jmp 0x14000e730
pop rbp
jmp sym.core::str::count::do_count_chars::h0eb3508aff42cff4
xor eax, eax
jmp 0x14000e747
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140049400]
movdqa xmm3, xmmword [0x140049410]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000e6c0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000e747
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000e730
pop rbp
ret
Function at 0x140011ed0
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov edi, dword [rcx + 0x10]
mov edx, 1
mov ecx, edi
call fcn.140045a1c
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140045a1c

Function at 0x140011f10
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.140045a1c
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140045a1c
Function at 0x140013440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x140048098]
test esi, esi
je 0x1400134e3
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400134da
je 0x140013489
test rdi, rdi
je 0x14001348d
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x14001348f
mov rbx, qword [rdi + 8]
jmp 0x14001348f
xor eax, eax
jmp 0x1400134da
xor ebx, ebx
movzx eax, byte [0x140058030]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x1400134f6
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140045a1c
test rdi, rdi
je 0x1400134d7
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::hae0938d07776a6a0
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x140013460
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x140013510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x1400480b8]
test esi, esi
je 0x1400135ae
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400135a5
je 0x1400135a3
movzx eax, byte [0x140058030]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x1400135c1
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140045a1c
test rdi, rdi
je 0x14001359e
mov rax, qword [rdi]
test rax, rax
je 0x140013591
lock dec qword [rax]
jne 0x140013591
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::h2e9684c2aaf21016
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x1400135a5
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::h09a9b347479260fe
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x14001352d
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3
Function at 0x1400136c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x140013755
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x140013794
cmp dword [rbp], 0
je 0x140013778
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400137b7
mov edi, eax
mov rax, qword [sym.std::sys::thread_local::guard::windows::tls_callback::hb3b522923a445e95]
mov rax, qword [0x140058108]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140058108], rsi
jne 0x140013730
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140013789
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x1400137f9
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001377d
mov edi, dword [rbp + 4]
jmp 0x140013789
mov edi, dword [rsi + 0x18]
jmp 0x140013787
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rdx, [0x1400501c0]
lea r9, str.library_std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 4]
lea r8, [rbp - 0x38]
call sym.core::panicking::assert_failed::h0803915418e34f99
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.library_std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call sym.core::panicking::assert_failed::h42eecccc4207c29f
int3
Function at 0x1400138f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
cmp edx, 3
je 0x14001390c
test edx, edx
jne 0x140013a75
mov bl, 1
mov rdi, qword [0x140058108]
nop word cs:[rax + rax]
test rdi, rdi
je 0x140013960
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x140013aca
mov rdi, qword [rdi + 8]
test esi, esi
je 0x140013920
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140013920
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140045a1c
mov rcx, rsi
call r14
jmp 0x140013920
test bl, 1
jne 0x140013a75
mov bl, 1
mov rdi, qword [0x140058108]
nop word cs:[rax + rax]
test rdi, rdi
je 0x1400139c0
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x140013aca
mov rdi, qword [rdi + 8]
test esi, esi
je 0x140013980
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140013980
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140045a1c
mov rcx, rsi
call r14
jmp 0x140013980
test bl, 1
jne 0x140013a75
mov bl, 1
mov rdi, qword [0x140058108]
nop word cs:[rax + rax]
test rdi, rdi
je 0x140013a20
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x140013aca
mov rdi, qword [rdi + 8]
test esi, esi
je 0x1400139e0
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400139e0
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140045a1c
mov rcx, rsi
call r14
jmp 0x1400139e0
test bl, 1
jne 0x140013a75
mov bl, 1
mov rdi, qword [0x140058108]
nop
test rdi, rdi
je 0x140013a70
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x140013aca
mov rdi, qword [rdi + 8]
test esi, esi
je 0x140013a30
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140013a30
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140045a1c
mov rcx, rsi
call r14
jmp 0x140013a30
test bl, 1
je 0x140013a80
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rbx, qword [0x140058108]
nop word [rax + rax]
test rbx, rbx
je 0x140013a75
mov esi, dword [rbx + 0x18]
mov r14, qword [rbx]
test r14, r14
je 0x140013aca
mov rbx, qword [rbx + 8]
test esi, esi
je 0x140013a90
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140013a90
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140045a1c
mov rcx, rdi
call r14
jmp 0x140013a90
lea rcx, str.library_std_src_sys_thread_localkeywindows.rs
call sym.core::option::unwrap_failed::h38ae581b954ce070
ud2

Function at 0x140013b10
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call fcn.140045a1c
mov rax, qword [rdi]
test rax, rax
je 0x140013b44
lock dec qword [rax]
jne 0x140013b44
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::h2e9684c2aaf21016
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140045a1c
Function at 0x140013bc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140048058]
add eax, dword [rax]
test esi, esi
je 0x140013c48
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140013c3f
je 0x140013c3d
movzx eax, byte [0x140058030]
mov ecx, 0x18
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x140013c58
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140045a1c
test rdi, rdi
je 0x140013c38
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x140013c3f
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::h2c279e50529633ce
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x140013bd9
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3
Function at 0x140016a90
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x60], xmm6
mov rax, r8
mov rsi, rcx
mov dword [rbp - 0x40], 0
xorps xmm6, xmm6
movups xmmword [rbp - 0x38], xmm6
mov dword [rbp - 0x28], 7
mov qword [rbp - 0x24], 0
mov word [rbp - 0x1c], 0
mov byte [rbp - 0x20], 1
lea r8, [rbp - 0x40]
mov rcx, rdx
mov rdx, rax
call sym.std::sys::pal::windows::fs::File::open::hc26adf99dd0cd861
mov rdi, rdx
test rax, rax
je 0x140016b0e
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rdi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
jmp 0x140016cb1
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
mov dword [rbp + 0x50], 0
lea rdx, [rbp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileInformationByHandle
test eax, eax
je 0x140016bb7
test dword [rbp + 0x20], 0x400
je 0x140016b61
mov qword [rbp + 0x18], 0
lea r8, [rbp + 0x18]
mov rcx, rdi
mov edx, 9
mov r9d, 8
call sub.KERNEL32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x140016bb7
mov r12d, dword [rbp + 0x40]
mov r15d, dword [rbp + 0x44]
test rdi, rdi
je 0x140016bfd
mov qword [rbp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x140016c80
mov rbx, qword [rbp + 0x20]
jmp 0x140016bff
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
mov rcx, rdi
movaps xmm6, xmmword [rbp + 0x60]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140045bec
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x140016c6f
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.140045bec
test r15, r15
je 0x140016c6f
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x140016ca9
mov qword [rsi], 0
mov rcx, rbx
call fcn.140045bec
jmp 0x140016ca9
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x40], 1
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rax
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
mov rcx, rdi
call fcn.140045bec
movaps xmm6, xmmword [rbp + 0x60]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x14002c490
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm15
movaps xmmword [rbp + 0xc0], xmm14
movaps xmmword [rbp + 0xb0], xmm13
movaps xmmword [rbp + 0xa0], xmm12
movaps xmmword [rbp + 0x90], xmm11
movaps xmmword [rbp + 0x80], xmm10
movaps xmmword [rbp + 0x70], xmm9
movaps xmmword [rbp + 0x60], xmm8
movaps xmmword [rbp + 0x50], xmm7
movaps xmmword [rbp + 0x40], xmm6
mov rsi, r8
mov rbx, rdx
cmp rdx, 0x21
jb 0x14002c967
mov r15, r9
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x30], rax
mov edi, dword [rbp + 0x150]
lea rax, [rsi - 0x20]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r9
Function at 0x1400337e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
add byte [rax - 0x77], cl
invalid
movabs rdi, 0x8000000000000000
lea rcx, [rbp - 0x60]
call sym.std::sys::pal::windows::to_u16s::inner::hbb51883a1ae0978b
mov rax, qword [rbp - 0x60]
cmp rax, rdi
jne 0x14003382b
lea rcx, [rbp - 0x58]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], rdi
jmp 0x140033a64
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x408], 2
mov qword [rbp + 0x410], 0
mov r8d, 0x200
mov eax, 2
add al, byte [rax]
add byte [rax], al
Function at 0x140036c10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140048078]
adc al, 1
add byte [rbp - 0x7c7bf00a], al
add byte [rax], al
invalid
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140036ca5
je 0x140036ca3
movzx eax, byte [0x140058030]
mov ecx, 0x10
adc byte [rax], al
add byte [rax], al
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x140036cc1
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
ret
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140045a1c
test rdi, rdi
je 0x140036c9e
mov rax, qword [rdi]
test rax, rax
je 0x140036c91
lock dec qword [rax]
jne 0x140036c91
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::hcef4d9ea6db501ca
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x140036ca5
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::haa3306ec31336e60
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x140036c2d
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x140036d30
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call fcn.140045a1c
mov rax, qword [rdi]
test rax, rax
je 0x140036d64
lock dec qword [rax]
jne 0x140036d64
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::hcef4d9ea6db501ca
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140045a1c