joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ab16ea0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.6ab12140
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x6ab16f89
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x6ab17022
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x6ab16fc4
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x6ab16fb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x6ab1701f
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x6ab17039
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x6ab16ff9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x6ab16ff9
mov rcx, rbx
call r13
jmp 0x6ab16ff9

Function at 0x6ab17190
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.global_lock_spinlock
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x6ab17980
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x6ab17a50
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x6ab184c0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_cond]
lea rcx, str.cond_locked_shmem_cond
mov edx, 8
jmp sym.__shmem_winpthreads_grab
Function at 0x6ab19640
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x6ab19660
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab

Function at 0x6ab19c70
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x6ab19c90
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x6ab1a240
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x6ab2f080], 0
jne 0x6ab1a307
mov byte [0x6ab2f080], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x6ab1a39a
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rsi
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x6ab1a2f7
call rsi
lea rdx, [rax + 0x60]
mov rcx, rbx
call sym.fputs
call rsi
lea rcx, [0x6ab301d1]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x6ab1a32d
call sym.__cxa_rethrow
call rsi
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x6ab1a2ce
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x6ab1a2f2
call sym.abort
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x6ab1a395
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rcx
mov dword [rbp - 0x30], 0x7373654d
mov dword [rbp - 0x2c], 0x42656761
mov dword [rbp - 0x28], 0x41786f
mov dword [rbp - 0x20], 0x64616f4c
mov dword [rbp - 0x1c], 0x7262694c
mov dword [rbp - 0x18], 0x41797261
mov byte [rbp - 0x14], 0
mov dword [rbp - 0x10], 0x50746547
mov dword [rbp - 0xc], 0x41636f72
mov dword [rbp - 8], 0x65726464
mov word [rbp - 4], 0x7373
mov byte [rbp - 2], 0
mov dword [rbp + 0x20], 0x72657375
mov word [rbp + 0x24], 0x3233
mov byte [rbp + 0x26], 0
call fcn.1400011b7
xor edi, edi
mov r11, rax
mov r9d, edi
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x88]
add rdx, rax
mov r10d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x24]
add r10, rax
mov r14d, dword [rdx + 0x1c]
add rsi, rax
mov ebx, dword [rdx + 0x18]
add r14, rax
test ebx, ebx
je 0x140001124
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r10]
lea rax, [rbp - 0x10]
add rcx, r11
nop word [rax + rax]
movsx edx, byte [rcx]
test dl, dl
je 0x1400010ee
movsx r8d, byte [rax]
cmp r8b, dl
jne 0x14000110b
inc rax
inc rcx
cmp byte [rax], dil
jne 0x1400010d0
movzx edx, byte [rcx]
movsx ecx, byte [rax]
movsx r8d, dl
sub r8d, ecx
test r8d, r8d
je 0x140001116
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x1400010c0
jmp 0x140001124
mov eax, r8d
mov r8d, edx
sub r8d, eax
jmp 0x1400010f8
mov eax, r9d
movzx ecx, word [rsi + rax*2]
mov edi, dword [r14 + rcx*4]
add rdi, r11
lea rdx, [rbp - 0x20]
mov qword [r15 + 0x10], rdi
mov rcx, r11
call rdi
lea rcx, [rbp + 0x20]
mov qword [r15 + 8], rax
call rax
mov r8, qword [r15 + 0x10]
lea rdx, [rbp - 0x30]
mov rcx, rax
call r8
lea r11, [rsp + 0x50]
mov qword [r15], rax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400011b7
Capabilities:
Access peb ldr_data

Disassembly:
xor r8, r8
xor rax, rax
xor r10, r10
add r10, 0x60
mov rax, qword gs:[r10]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret
Function at 0x140001890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
call fcn.140035d70
lea rdx, [0x1400106d0]
xor ecx, ecx
call sub.KERNEL32.dll_AddVectoredExceptionHandler
mov dword [rbp], 0x5000
mov rcx, rbp
call sub.KERNEL32.dll_SetThreadStackGuarantee
call sub.KERNEL32.dll_GetCurrentThread
mov r8, qword [0x140037010]
lea rdx, str.main
mov rcx, rax
call r8
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x1400018ee
dec ecx
jmp 0x1400018fc
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x14000190b
call fcn.140010890
mov byte [0x140044040], 0
lea rcx, [0x140044038]
mov qword [0x140044038], rax
mov qword [rbp], 0
lea rsi, [rbp + 8]
mov qword [rbp + 8], rcx
mov ecx, dword [0x140044100]
test ecx, ecx
je 0x14000193e
dec ecx
jmp 0x14000194c
lea rcx, [0x1400440e8]
call fcn.14000eea0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140001a63
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x140001968
dec ecx
jmp 0x140001976
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x14000199a
mov r14, qword [rbp]
mov rsi, qword [rbp + 8]
mov rdi, r14
shl rdi, 4
cmp qword [rsi + rdi], rax
je 0x1400019db
jmp 0x140001a6b
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
shl rax, 4
mov rdi, qword [rcx + rax]
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x1400019b8
dec ecx
jmp 0x1400019c6
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov edi, dword [rbp]
mov rsi, qword [rbp + 8]
and edi, 1
shl edi, 4
mov rax, qword [0x140046038]
mov ecx, dword [0x140044100]
test ecx, ecx
je 0x1400019f0
dec ecx
jmp 0x1400019fe
lea rcx, [0x1400440e8]
call fcn.14000eea0
mov ecx, eax
add rsi, rdi
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xor esi, esi
lea rcx, [0x14000160a]
call fcn.140001430
mov eax, dword [0x140044034]
cmp eax, 3
je 0x140001a53
mov byte [rbp - 0x18], 1
lea rax, [rbp - 0x18]
mov qword [rbp - 0x58], rax
lea rax, str.std_src_rt.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140044034]
lea r9, [0x14003d138]
lea r8, [rbp - 0x58]
xor edx, edx
call fcn.140010900
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov r14, qword [rbp]
mov rsi, qword [rbp + 8]
mov qword [rbp - 0x28], r14
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x10], 0
mov byte [rbp - 0xc], 0
lea rax, str.fatal_runtime_error:_code_running_before_main_must_not_use_thread::current_n
mov qword [rbp], rax
mov qword [rbp + 8], 1
lea rax, [rbp + 0x38]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
lea rcx, [rbp - 0x10]
mov rdx, rbp
call fcn.14000f130
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x30]
call fcn.14000f240
mov ecx, 7
int 0x29
ud2
Function at 0x14000b6d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000b6f5
cmp rax, rcx
je 0x14000b6fb
cmp rdx, 4
jae 0x14000b702
xor eax, eax
xor r8d, r8d
jmp 0x14000b7a0
pop rbp
jmp fcn.140002be0
xor eax, eax
jmp 0x14000b7b7
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140038380]
movdqa xmm3, xmmword [0x140038390]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000b730
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000b7b7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000b7a0
pop rbp
ret

Function at 0x14000eea0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x14000ef35
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x14000ef74
cmp dword [rbp], 0
je 0x14000ef58
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000ef89
mov edi, eax
mov rax, qword [0x140046038]
mov rax, qword [0x1400440c0]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400440c0], rsi
jne 0x14000ef10
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14000ef69
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x14000efcb
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14000ef5d
mov edi, dword [rbp + 4]
jmp 0x14000ef69
mov edi, dword [rsi + 0x18]
jmp 0x14000ef67
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.14000ffc3
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call fcn.140002920
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.14001000a
int3
Function at 0x14000fea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140037060]
test esi, esi
je 0x14000ff28
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14000ff1f
je 0x14000ff1d
movzx eax, byte [0x140044030]
mov ecx, 0x18
call fcn.1400324c0
test rax, rax
je 0x14000ff38
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14000ff18
mov edx, 8
mov rcx, rdi
call fcn.140001c80
mov rax, rsi
jmp 0x14000ff1f
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140037048]
call fcn.14000eea0
mov esi, eax
jmp 0x14000feb9
mov ecx, 8
mov edx, 0x18
call fcn.140001f39
int3

Function at 0x140010890
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400440b8]
nop word cs:[rax + rax]
cmp rax, 0xffffffffffffffff
je 0x1400108f3
lea rsi, [rax + 1]
lock cmpxchg qword [0x1400440b8], rsi
jne 0x1400108b0
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x1400108e3
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
jmp 0x1400108d1
call fcn.1400111b0
int3
Function at 0x140010ad0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [rcx]
cmp byte [rax], 0
mov byte [rax], 0
je 0x140010c38
mov byte [rbp + 7], 0
mov eax, dword [0x140044080]
cmp eax, 3
jne 0x140010c01
cmp byte [rbp + 7], 0
jne 0x140010c14
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x140010c1b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140010c2e
mov rcx, qword [0x140044048]
cmp rax, rcx
jne 0x140010b44
mov eax, dword [0x140044050]
cmp eax, 0xffffffff
je 0x140010c14
inc eax
jmp 0x140010b65
mov rcx, rax
mov dl, 1
xor eax, eax
lock cmpxchg byte [0x140044054], dl
jne 0x140010c14
mov qword [0x140044048], rcx
mov eax, 1
mov dword [0x140044050], eax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 1
mov qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
mov byte [rbp - 3], 0
mov dword [rbp - 7], 0
cmp qword [0x140044058], 0
jne 0x140010c44
mov qword [0x140044058], 0xffffffffffffffff
lea rcx, [0x140044060]
call fcn.140010d30
movups xmm0, xmmword [rbp - 0x20]
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x140044070], xmm1
movups xmmword [0x140044060], xmm0
inc qword [0x140044058]
dec dword [0x140044050]
jne 0x140010c14
mov qword [0x140044048], 0
xor eax, eax
xchg byte [0x140044054], al
cmp al, 2
jne 0x140010c14
lea rcx, [0x140044054]
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
jmp 0x140010c14
lea rcx, [rbp + 7]
call fcn.140010c9a
cmp byte [rbp + 7], 0
je 0x140010b07
add rsp, 0x48
pop rsi
pop rbp
ret
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
jmp 0x140010b17
call fcn.140010890
jmp 0x140010b25
lea rcx, str.std_src_synconce.rs
call fcn.140004720
lea rcx, str.std_srcio_stdio.rs
call fcn.140003e10
ud2
Function at 0x140011270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
test rcx, rcx
jne 0x140011388
mov ecx, dword [0x140044100]
test ecx, ecx
je 0x140011355
dec ecx
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x140011368
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x14001137b
movzx eax, byte [0x140044030]
mov ecx, 0x30
call fcn.1400324c0
test rax, rax
je 0x1400113c0
mov rsi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x18], 0
mov qword [rax + 0x10], rdi
mov byte [rax + 0x28], 0
mov qword [rbp - 0x40], 1
mov qword [rbp - 0x38], rax
mov rax, qword [0x140046038]
lock inc qword [rsi]
jle 0x14001141d
mov ecx, dword [0x140044100]
test ecx, ecx
je 0x140011327
dec ecx
jmp 0x140011339
lea rdi, [rbp - 0x38]
lea rcx, [0x1400440e8]
call fcn.14000eea0
mov ecx, eax
add rsi, 0x10
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400440e8]
call fcn.14000eea0
mov ecx, eax
jmp 0x140011295
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
jmp 0x1400112af
call fcn.140010890
mov rdi, rax
jmp 0x1400112c0
cmp rcx, 1
je 0x1400113cf
lea rax, str.use_of_std::thread::current___is_not_possible_after_the_threads_n_________local_data_has_been_destroyed
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.std_src_threadcurrent.rs
lea rcx, [rbp - 0x40]
call fcn.140002920
mov ecx, 8
mov edx, 0x30
call fcn.140001f39
mov dword [rbp - 0x10], 0
mov byte [rbp - 0xc], 0
lea rax, str.fatal_runtime_error:__n_n____________Attempted_to_access_thread_local_data_while_allocating_said_data._n_n____________Do_not_access_functions_that_allocate_in_the_global_allocator__n_n____________This_is_a_bug_in_the_global_allocator._n_n_________n
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [rbp - 8]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.14000f130
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call fcn.14000f240
mov ecx, 7
int 0x29
ud2

Function at 0x140013000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x14001306e
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]
Function at 0x140032180
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rdi, rcx
lea rax, str.stdoutstd_srciomod.rsfailed_to_write_whole_buffer
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 6
mov eax, dword [0x140044080]
cmp eax, 3
jne 0x140032312
mov ecx, dword [0x1400440e0]
test ecx, ecx
je 0x14003231c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rsi, rax
test rax, rax
je 0x14003232f
mov rax, qword [0x140044048]
cmp rsi, rax
jne 0x1400321fc
mov eax, dword [0x140044050]
cmp eax, 0xffffffff
je 0x1400323ac
inc eax
jmp 0x14003221a
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x140044054], cl
jne 0x14003233c
mov qword [0x140044048], rsi
mov eax, 1
mov dword [0x140044050], eax
lea rax, [0x140044048]
mov qword [rbp], rax
mov r14, rbp
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0
lea rdx, [0x14003c408]
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov r8, rdi
call fcn.140003860
mov r15, qword [rbp - 0x18]
test al, al
je 0x140032294
test r15, r15
jne 0x1400322db
lea rax, str.a_formatting_trait_implementation_returned_an_error_when_the_underlying_stream_did_not
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x40], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
lea rdx, [0x14003cfb8]
lea rcx, [rbp - 0x50]
call fcn.140002920
jmp 0x1400323aa
mov eax, r15d
and eax, 3
cmp eax, 1
jne 0x1400322d8
lea rdi, [r15 - 1]
mov rbx, qword [r15 - 1]
mov r15, qword [r15 + 7]
mov rax, qword [r15]
test rax, rax
je 0x1400322b8
mov rcx, rbx
call rax
cmp qword [r15 + 8], 0
je 0x1400322cb
mov rdx, qword [r15 + 0x10]
mov rcx, rbx
call fcn.140001c80
mov edx, 8
mov rcx, rdi
call fcn.140001c80
xor r15d, r15d
mov rcx, qword [rbp]
dec dword [rcx + 8]
jne 0x1400322fd
mov qword [rcx], 0
xor eax, eax
xchg byte [rcx + 0xc], al
cmp al, 2
jne 0x1400322fd
add rcx, 0xc
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
test r15, r15
jne 0x14003234d
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140031aed
jmp 0x1400321bc
lea rcx, [0x1400440c8]
call fcn.14000eea0
mov ecx, eax
jmp 0x1400321cc
call fcn.140010890
mov rsi, rax
jmp 0x1400321dd
lea rcx, [0x140044054]
call fcn.140013500
jmp 0x14003220e
mov qword [rbp], r15
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
lea rax, [0x140011480]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r14
lea rax, [0x1400311d0]
mov qword [rbp - 8], rax
lea rax, [0x14003ceb0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 2
lea rdx, str.std_srcio_stdio.rs
lea rcx, [rbp - 0x50]
call fcn.140002920
ud2
call fcn.140004740
mov rsi, rax
cmp qword [r15 + 8], 0
je 0x1400323c7
mov rdx, qword [r15 + 0x10]
mov rcx, rbx
call fcn.140001c80
mov edx, 8
mov rcx, rdi
call fcn.140001c80
jmp 0x1400323fa
mov rcx, qword [rbp]
call fcn.140010d00
mov rcx, rsi
call fcn.1400358e0
call fcn.140004946
int3
Function at 0x1400341b5
Capabilities:
Get thread local storage value
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x508
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x418], rdx
mov qword [rbp + 0x438], r8
lock inc qword [0x1400440b0]
jle 0x140034b24
mov r12d, r9d
mov rsi, rdx
mov rdi, rcx
call fcn.14000fea0
test rax, rax
jne 0x14003422c
lea rcx, [rbp + 0x428]
and dword [rcx], 0
mov byte [rcx + 4], 0
lea rax, [rbp + 0x438]
lea r8, [rbp + 0x3b8]
mov qword [r8], rax
lea rax, [0x140033fc0]
mov qword [r8 + 8], rax
lea rax, [rbp + 0x410]
mov qword [r8 + 0x10], rax
lea rax, [0x14003d688]
lea rdx, [rbp - 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], 3
and qword [rdx + 0x20], 0
lea rax, [0x140003820]
mov qword [r8 + 0x18], rax
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], 2
call fcn.14000f130
lea rcx, [rbp + 0x448]
jmp 0x140034c2a

Function at 0x140035f80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140036d40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140036d40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]