joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bffeb
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r12, qword [rcx]
mov r13d, 0xffffffff
xorps xmm6, xmm6
lea rbp, [rsp + 0x34]
lea r15, [0x1401a5b60]
lea r14, [rsp + 0x40]
test rsi, rsi
je 0x1400c00c6
mov rcx, qword [r12]
cmp rsi, r13
mov r8d, 0xffffffff
cmovb r8, rsi
and dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
and qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov r9, r14
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x1400c00a0
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x1400c0069
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x1400c00a5
mov ecx, dword [rsp + 0x3c]
test rcx, rcx
je 0x1400c00b2
mov rax, rsi
sub rax, rcx
jb 0x1400c00e2
add rbx, rcx
mov rsi, rax
jmp 0x1400c0026
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rbx, rax
jmp 0x1400c00b9
lea rbx, str.failed_to_write_whole_buffer
mov rcx, qword [rdi + 8]
call fcn.1400b9a94
mov qword [rdi + 8], rbx
test rsi, rsi
setne al
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_srciomod.rs
mov rdx, rsi
call fcn.14007e7f0
ud2

Function at 0x1400c0c9d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402850b8]
test ecx, ecx
je 0x1400c0cb6
dec ecx
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue
lea rcx, [0x1402850a0]
call fcn.14017e120
mov ecx, eax
jmp 0x1400c0cad
Function at 0x1400c1833
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.1400c3bcb
test rax, rax
je 0x1400c186b
mov edx, 4
mov rcx, rax
call fcn.140030e40
jmp 0x1400c18a4
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400c0c5b
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.1400c0d05
Function at 0x1400ca20e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402850f8]
test ecx, ecx
je 0x1400ca227
dec ecx
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue
lea rcx, [0x1402850e0]
call fcn.14017e120
mov ecx, eax
jmp 0x1400ca21e

Function at 0x1400d402b
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x1400d409e
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x1400d406d
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400d41f9
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x1400d4112
cmp qword [rax + r12 + 0x10], r8
jne 0x1400d4112
mov rbx, qword [rax + r12]
xor r9d, r9d
cmp r8, r9
je 0x1400d41cc
mov rdx, r9
mov r9b, byte [rbx + r9*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x1400d4109
mov r9b, byte [rbx + rdx*8 + 5]
cmp r9b, byte [r15 + rdx*8 + 5]
jne 0x1400d4109
mov r10d, dword [rbx + rdx*8]
lea r9, [rdx + 1]
cmp r10d, dword [r15 + rdx*8]
je 0x1400d40d7
cmp rdx, r8
jae 0x1400d41cc
mov qword [rsp + 0x28], r14
mov rbx, rcx
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, r15
mov r14, r11
call fcn.1400d4224
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r14
mov r8, r13
call fcn.1400d2d50
mov eax, dword [rbp]
cmp eax, 0x2a
jne 0x1400d41ac
mov rdx, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1400d4213
mov edi, dword [rsp + 0x4c]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.14011d02d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], edi
mov word [rsi + r12 + 0x1c], bp
mov dword [rbx + 4], edi
mov dword [rbx], 0x2a
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov edx, dword [rsi - 4]
lea rdi, [rbx + 8]
mov ecx, 0xf
rep movsq qword [rdi], qword [rsi]
mov dword [rbx], eax
mov dword [rbx + 4], edx
mov r14, qword [rsp + 0x28]
jmp 0x1400d41da
mov eax, dword [rax + r12 + 0x18]
mov dword [rcx + 4], eax
mov dword [rcx], 0x2a
mov rdx, qword [r14 + 8]
mov rcx, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14011d02d
lea rcx, [0x1402d0a00]
lea r8, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov edx, 0x39
call fcn.14007f700
ud2
lea r8, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.5_src_nfa_thompson_map.rs
mov rcx, rdi
call fcn.14007e870
ud2
Function at 0x14015c292
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rdi, rcx
call fcn.14015c41e
cmp rax, 2
jb 0x14015c2cb
mov rcx, rax
cmp qword [rax + 8], 0
je 0x14015c2cb
add rcx, 0x10
jmp 0x14015c3ef
call fcn.14015c41e
cmp rax, 1
je 0x14015c3ed
mov rsi, rax
test rax, rax
jne 0x14015c31b
mov ecx, 0x18
mov edx, 8
call fcn.1400c8ed5
mov rsi, rax
lea rax, [0x140285118]
mov qword [rsi], rax
and qword [rsi + 8], 0
mov ecx, dword [0x140285130]
test ecx, ecx
je 0x14015c40b
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
mov qword [rsp + 0x20], rsi
je 0x14015c34f
mov rax, qword [rdi]
and qword [rdi], 0
test rax, rax
je 0x14015c34f
mov rax, qword [rdi + 8]
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + 0x10]
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], rax
jmp 0x14015c3ef
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.14015c447
mov rcx, rdi
call fcn.14015c481
mov rbx, rax
mov r14, rdx
movabs r12, 0x736f6d6570736575
xor r12, rax
movabs r13, 0x646f72616e646f6d
xor r13, rdx
movabs rbp, 0x6c7967656e657261
xor rbp, rax
movabs rsi, 0x7465646279746573
xor rsi, rdx
mov r15d, 1
xor eax, eax
xorps xmm6, xmm6
test rax, rax
jne 0x14015c335
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
movups xmmword [rdi + 0x30], xmm6
and qword [rdi + 0x40], 0
mov rcx, rdi
mov rdx, r15
call fcn.14013965d
mov rcx, rdi
call fcn.140089259
inc r15
jmp 0x14015c3a9
xor ecx, ecx
mov rax, rcx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140285118]
call fcn.14017e120
mov ecx, eax
jmp 0x14015c313

Function at 0x14015c41e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140285130]
test ecx, ecx
je 0x14015c437
dec ecx
add rsp, 0x28
jmp sub.KERNEL32.dll_TlsGetValue
lea rcx, [0x140285118]
call fcn.14017e120
mov ecx, eax
jmp 0x14015c42e
Function at 0x140167430
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.140167403
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.1400aa54d
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1401674cd
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.1401bf48e
mov rbx, qword [rsp + 0x40]
jmp 0x140167498
test eax, eax
jne 0x1401674ef
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14016750d
movabs rax, 0xde00000002
jmp 0x1401674f7
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1401b5091
jmp 0x140167521
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1401c635c
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140173310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x14017336b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14017336b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x140173386
cmp eax, 0x42
jne 0x14017336b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140173436
cmp byte [r8 + r11], 0x5f
jne 0x140173436
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14017349e
mov rcx, rsi
xor edx, edx
call fcn.14016edd0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14016edd0
test al, al
jne 0x140173531
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401733c2
lea rdx, [0x140368cce]
mov r8d, 1
call fcn.14007f3e0
test al, al
jne 0x140173531
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14017337a
xor r14d, r14d
lea rbx, [0x140336d88]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1401733f4
cmp byte [rax + rcx], 0x45
je 0x140173553
sub r14, 1
jb 0x140173419
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140173419
mov r8d, 2
mov rdx, rbx
call fcn.14007f3e0
test al, al
jne 0x140173531
mov rcx, rsi
call fcn.140170600
test al, al
jne 0x140173531
mov rax, qword [rsi]
test rax, rax
jne 0x1401733e0
jmp 0x14017337a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x1401734f8
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x140173492
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14017347c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14017346b
add dl, 0xa9
jmp 0x14017347a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1401734f8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1401734f8
movzx edx, bl
add rax, rdx
jae 0x140173440
jmp 0x1401734f8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1401734f8
cmp rax, rcx
jae 0x1401734f5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14017354b
cmp qword [rsi + 0x20], 0
je 0x140173544
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140173310
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14017337c
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140173539
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_____::closureshim_as_mut_const___dyn___unsafe_extern__
lea rdx, [0x140336d68]
test r9b, r9b
cmovne rdx, rax
call fcn.14007f3e0
test al, al
je 0x140173539
mov dil, 2
jmp 0x14017337a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14017337a
mov dil, 1
xor r9d, r9d
jmp 0x1401734fa
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14017337a
Function at 0x14017ccd7
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14017cd03
xor eax, eax
jmp 0x14017cd08
call fcn.1400bab37
nop
add rsp, 0x38
ret
Function at 0x14017e120
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x14017e1a5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x14017e1e6
cmp dword [rsp + 0x2c], 0
je 0x14017e1ca
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14017e20e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1403b0208]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1403b0208], rsi
jne 0x14017e180
mov byte [0x1403b0200], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14017e1dc
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14017e25a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14017e1cf
mov edi, dword [rsp + 0x28]
jmp 0x14017e1dc
mov edi, dword [rsi + 0x18]
jmp 0x14017e1da
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x14033f1f8]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.14017e840
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Malformed_XML.
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.14007e560
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Malformed_XML.
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14017e880
ud2
Function at 0x14017e710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1402851a8]
test ecx, ecx
je 0x14017e7f0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14017e744
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14017e744
add rdi, 0x10
jmp 0x14017e7e6
mov ecx, dword [0x1402851a8]
test ecx, ecx
je 0x14017e803
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14017e7e4
mov rsi, rax
test rax, rax
jne 0x14017e7b3
movzx eax, byte [0x1403b0290]
mov ecx, 0x18
mov edx, 8
call fcn.140030db0
test rax, rax
je 0x14017e826
mov rsi, rax
lea rax, [0x140285190]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402851a8]
test ecx, ecx
je 0x14017e816
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14017e7e6
test rcx, rcx
je 0x14017e7e6
lock dec qword [rcx]
jne 0x14017e7e6
call fcn.14017e0d0
jmp 0x14017e7e6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140285190]
call fcn.14017e120
mov ecx, eax
jmp 0x14017e726
lea rcx, [0x140285190]
call fcn.14017e120
mov ecx, eax
jmp 0x14017e754
lea rcx, [0x140285190]
call fcn.14017e120
mov ecx, eax
jmp 0x14017e7ab
mov ecx, 8
mov edx, 0x18
call fcn.1400513e0
ud2

Function at 0x14017ee10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402851c8]
test ecx, ecx
je 0x14017eeaf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14017ee39
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x14017ee9e
mov ecx, dword [0x1402851c8]
test ecx, ecx
je 0x14017eec2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14017eea4
mov rsi, rax
test rax, rax
jne 0x14017ee98
movzx eax, byte [0x1403b0290]
mov ecx, 0x10
mov edx, 8
call fcn.140030db0
test rax, rax
je 0x14017eee5
mov rsi, rax
lea rax, [0x1402851b0]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1402851c8]
test ecx, ecx
je 0x14017eed5
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x14017eea6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402851b0]
call fcn.14017e120
mov ecx, eax
jmp 0x14017ee25
lea rcx, [0x1402851b0]
call fcn.14017e120
mov ecx, eax
jmp 0x14017ee45
lea rcx, [0x1402851b0]
call fcn.14017e120
mov ecx, eax
jmp 0x14017ee90
mov ecx, 8
mov edx, 0x10
call fcn.1400513e0
ud2
Function at 0x14017f470
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14033e8b8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14017f4e1
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14017f517
test eax, eax
js 0x14017f4f2
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14017f50a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14033e920]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14017e530
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14017d9d0
mov ecx, 7
int 0x29
ud2

Function at 0x14017fab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140285188]
test ecx, ecx
je 0x14017fb6d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14017fae0
cmp qword [rax + 8], 0
je 0x14017fae0
add rax, 0x10
jmp 0x14017fb67
mov ecx, dword [0x140285188]
test ecx, ecx
je 0x14017fb80
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14017fb65
mov rsi, rax
test rax, rax
jne 0x14017fb4b
movzx eax, byte [0x1403b0290]
mov ecx, 0x20
mov edx, 8
call fcn.140030db0
test rax, rax
je 0x14017fba3
mov rsi, rax
lea rax, [0x140285170]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140285188]
test ecx, ecx
je 0x14017fb93
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x14017fb67
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140285170]
call fcn.14017e120
mov ecx, eax
jmp 0x14017fac5
lea rcx, [0x140285170]
call fcn.14017e120
mov ecx, eax
jmp 0x14017faf0
lea rcx, [0x140285170]
call fcn.14017e120
mov ecx, eax
jmp 0x14017fb43
mov ecx, 8
mov edx, 0x20
call fcn.1400513e0
ud2
Function at 0x140181860
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x1401818d0
jmp 0x1401818bf
jae 0x140181975
cmp r8, 0x201
jae 0x1401818d0
mov r15d, 0x200
lea r12, [rsp + 0x68]
mov r13, r8
jmp 0x140181917
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x1401818f7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.140180510
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x38]
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, r14
mov r12, qword [rsp + 0x20]
mov r13, r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r13d
mov rdx, r12
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x14018193c
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1401819ca
mov r8d, ebp
cmp r13, r8
jne 0x1401818b0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401819ea
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x1401818bf
jmp 0x1401818d0
cmp r15, r8
jb 0x140181a04
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1401820c0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x1401819b5
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.140030e40
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x1401819a6
jmp 0x1401819b5
lea rcx, str.internal_error:_entered_unreachable_codeQ
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14007f700
jmp 0x140181a19
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14007f360
ud2
Function at 0x1401854c0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.14019ddc0
mov rdi, rdx
test rax, rax
je 0x140185554
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.14017d930
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14019dfe0
cmp dword [rsp + 0x38], 2
jne 0x140185583
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1401855cf
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x1401855fb
lea rcx, [rsp + 0x88]
call fcn.14017d930
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1401d11a4
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x140185659
mov qword [rsp + 0x80], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x1401856d5
mov rbx, qword [rsp + 0x80]
jmp 0x14018565b
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x1401856c4
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.1401d11a4
test r15, r15
je 0x1401856c4
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x140185701
mov qword [rsi], 0
mov rcx, rbx
call fcn.1401d11a4
jmp 0x140185701
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14017d930
mov qword [rsi], 0
mov rcx, rdi
call fcn.1401d11a4
jmp 0x140185543