joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100294e1
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
and dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call sub.advapi32.dll_RegQueryValueExW
nop
add rsp, 0x38
ret

Function at 0x1002caad
Capabilities:
Get disk size

Disassembly:
push rsi
sub rsp, 0x30
cmp qword [rcx + 0x78], 0
je 0x1002cae7
mov rsi, rcx
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, qword [rcx + 0x48]
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1002cae7
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x80], rax
mov al, 1
jmp 0x1002cae9
xor eax, eax
add rsp, 0x30
pop rsi
ret

Function at 0x1002cb45
Capabilities:
Get disk size

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
lea r8, [rsp + 0x28]
and qword [r8], 0
lea r9, [rsp + 0x30]
and qword [r9], 0
xor edi, edi
mov rcx, rdx
xor edx, edx
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1002cb87
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov edi, 1
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1002cb94
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x1002cbd7
xor ecx, ecx
mov edx, 0x20
call fcn.1003dd4b
lea r8, [rsp + 0x30]
mov dword [r8 + 8], eax
mov dword [r8 + 0xc], edx
lea rax, [rsp + 0x2c]
mov qword [r8], rax
mov rcx, rsi
mov rdx, r8
call fcn.10028963
jmp 0x1002cbe5
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x1002ffc6
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, rdx
mov r14, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x1003007c
mov r13, rax
movsxd rdi, dword [rsp + 0x2c]
lea r15, [rsp + 0x30]
mov qword [r15], 8
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
shl rdi, 3
xor ebp, ebp
lea rsi, [rsp + 0x60]
lea r12, [rsp + 0x48]
cmp rdi, rbp
je 0x10030060
mov rbx, qword [r13 + rbp]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rax, [rbx + rax*2]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
and word [rsp + 0x58], 0
mov rcx, rsi
mov rdx, r12
call fcn.10028c48
mov rcx, r15
mov rdx, rsi
call fcn.1002e797
add rbp, 8
jmp 0x1003001e
mov rcx, r13
call sub.kernel32.dll_LocalFree
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r14], xmm0
jmp 0x1003008b
mov qword [r14], 8
xorps xmm0, xmm0
movups xmmword [r14 + 8], xmm0
mov rax, r14
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x10035b61
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 0x10], 1
jne 0x10035c23
lea rcx, [0x10119372]
call sub.oleaut32.dll_SysAllocString
mov r14, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa0]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, r14
mov r8, rbx
mov r9d, 0x30
call rax
mov ebp, eax
mov rcx, r14
call fcn.1010cf34
mov rcx, rbx
call fcn.1010cf34
test ebp, ebp
js 0x10035c23
mov rbx, qword [rsp + 0x38]
lea rcx, [rsi + 0x20]
call fcn.10034ba0
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x10035c32
mov qword [rdi], 2
mov rcx, rsi
call fcn.10034a48
mov rax, rdi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1003602a
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov r14, rcx
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0x3c00
and dword [rsp + 0x70], 0
mov ebx, 3
sub ebx, 1
jb 0x100360f5
mov ecx, dword [rsp + 0x2c]
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x100360b7
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x70], eax
cmp eax, 0x6f
jne 0x1003609e
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x10036050
test eax, eax
jne 0x100360ed
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
and qword [rsp + 0x30], 0
jmp 0x1003613f
lea rdx, str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code
lea rcx, [rsp + 0x80]
mov r8d, 0x32
call fcn.10045478
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x1003613f
mov rcx, rsi
call sub.msvcrt.dll_free
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov qword [rcx], rax
lea rax, [0x10119478]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x10], 0
lea rbx, [fcn.100fb590]
mov qword [rcx + 8], rbx
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x30]
call fcn.100dc650
cmp qword [rsp + 0x30], 0
jne 0x100361d6
movups xmm0, xmmword [rsp + 0x38]
lea rdi, [rsp + 0x70]
movups xmmword [rdi], xmm0
lea rbx, [rsp + 0x98]
lea r15, [rsp + 0x80]
lea rsi, [rsp + 0x50]
mov rcx, r15
mov rdx, rdi
call fcn.10035ec2
cmp qword [rsp + 0x80], 0
je 0x100361c4
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, r14
mov rdx, rsi
call fcn.1003ad42
test rax, rax
je 0x100361ba
movzx ecx, word [rbx + 4]
mov word [rax + 0x6d], cx
mov ecx, dword [rbx]
mov dword [rax + 0x69], ecx
mov rcx, rsi
call fcn.1003487d
jmp 0x1003616d
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_free
cmp qword [rsp + 0x30], 0
je 0x100361e0
lea rcx, [rsp + 0x30]
call fcn.1003487d
nop
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1003727e
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
xorps xmm6, xmm6
lea rdi, [rsp + 0x90]
movaps xmmword [rdi], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
mov dword [rdi], 0x40
mov rcx, rdi
call sub.kernel32.dll_GlobalMemoryStatusEx
mov rax, qword [rdi + 8]
mov qword [rsi + 0x30], rax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x50], xmm6
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x10037345
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
xor r9d, r9d
sub rdi, r8
cmovb rdi, r9
mov r11, qword [rsp + 0x70]
mov rax, r11
mul rdi
mov rdi, rax
mov r10, 0xffffffffffffffff
cmovo rdi, r10
mov rcx, qword [rsp + 0x28]
sub rcx, r8
cmovb rcx, r9
mov rax, r11
mul rcx
cmovo rax, r10
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x48], rax
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x100400b4
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, qword [rcx]
test rsi, rsi
je 0x100400ce
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rdx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThe_global_thread_pool_has_already_been_initialized.
lea rsi, [rsp + 0x20]
mov r8d, 0x11
mov rcx, rsi
call fcn.10079cc0
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call fcn.1003ff74
cmp qword [rdi], 0
je 0x10040138
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x30], r8
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.100f6910
mov rsi, qword [rsp + 0x50]
mov bl, byte [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.1003e6cb
test bl, bl
je 0x100401a2
lea rdx, [0x1011a569]
lea rsi, [rsp + 0x20]
mov r8d, 0x11
mov rcx, rsi
call fcn.10079cc0
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call fcn.1003ff74
cmp qword [rdi], 0
je 0x100401ab
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x30], r8
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.100f6910
mov bl, byte [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1003e6cb
test bl, bl
jne 0x100401ab
test rsi, rsi
jne 0x100400c3
add rsp, 0x70
pop rbx
pop rdi
pop rsi
jmp fcn.10047a05

Function at 0x10047700
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.100a5dd0
dec eax
ret

Function at 0x10047a05
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsi + 0x20]
add rsp, 0x50
pop rsi
ret
Function at 0x10048cbf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x10110118]
jmp 0x100490a3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049088
mov rbx, rax
test rax, rax
jne 0x10049076
mov ecx, 0x18
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x10049092
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x10], rdi
mov rcx, rdi
call fcn.10049010
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x10049858
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.100db070
ud2
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100490d2
cmp qword [rax], 0
je 0x100490d2
add rax, 8
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1004901e
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test rdx, rdx
je 0x1004988b
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
and qword [rdx], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
cmp rcx, 1
je 0x10049898
lea rcx, [rsp + 0x28]
call fcn.100498d3
call fcn.10048cae
mov rcx, rax
call fcn.10047fa1
movups xmm0, xmmword [rsi]
lea rdi, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x28]
movups xmmword [rcx], xmm0
call fcn.100498d3
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x10049010
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.100a5dd0
dec eax
ret
Function at 0x1004901e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x10110118]
jmp 0x100490a3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049088
mov rbx, rax
test rax, rax
jne 0x10049076
mov ecx, 0x18
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x10049092
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x10], rdi
mov rcx, rdi
call fcn.10049010
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x10049858
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.100db070
ud2
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100490d2
cmp qword [rax], 0
je 0x100490d2
add rax, 8
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1004901e
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test rdx, rdx
je 0x1004988b
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
and qword [rdx], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
cmp rcx, 1
je 0x10049898
lea rcx, [rsp + 0x28]
call fcn.100498d3
call fcn.10048cae
mov rcx, rax
call fcn.10047fa1
movups xmm0, xmmword [rsi]
lea rdi, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x28]
movups xmmword [rcx], xmm0
call fcn.100498d3
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x100490a3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x10110118]
jmp 0x100490a3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049088
mov rbx, rax
test rax, rax
jne 0x10049076
mov ecx, 0x18
mov edx, 8
call fcn.100028d0
test rax, rax
je 0x10049092
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x10], rdi
mov rcx, rdi
call fcn.10049010
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x10049858
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.100db070
ud2
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049010
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x100490d2
cmp qword [rax], 0
je 0x100490d2
add rax, 8
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1004901e
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
test rdx, rdx
je 0x1004988b
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
and qword [rdx], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
cmp rcx, 1
je 0x10049898
lea rcx, [rsp + 0x28]
call fcn.100498d3
call fcn.10048cae
mov rcx, rax
call fcn.10047fa1
movups xmm0, xmmword [rsi]
lea rdi, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x28]
movups xmmword [rcx], xmm0
call fcn.100498d3
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x10049e20
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.100a5dd0
dec eax
ret

Function at 0x10049e2e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049e91
mov rbx, rax
test rax, rax
jne 0x10049e7b
mov ecx, 0x10
call fcn.1004a12b
mov rbx, rax
and dword [rax + 8], 0
mov qword [rax], rdi
mov rcx, rdi
call fcn.10049e20
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
add rbx, 8
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1004a23f
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10049f9c
cmp dword [rax + 8], 0
je 0x10049f9c
add rax, 0xc
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x10049e2e
test rdx, rdx
je 0x1004a25a
mov eax, dword [rdx]
and dword [rdx], 0
mov r8d, 0x53db1ca7
cmp eax, 1
jne 0x1004a260
mov r8d, dword [rdx + 4]
jmp 0x1004a260
mov r8d, 0x53db1ca7
lea rax, [rcx + 4]
mov dword [rcx], 1
mov dword [rcx + 4], r8d
ret
mov rdx, rcx
lea rcx, [0x101101d0]
jmp 0x10049f6d

Function at 0x10049f6d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049e91
mov rbx, rax
test rax, rax
jne 0x10049e7b
mov ecx, 0x10
call fcn.1004a12b
mov rbx, rax
and dword [rax + 8], 0
mov qword [rax], rdi
mov rcx, rdi
call fcn.10049e20
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
add rbx, 8
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1004a23f
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10049f9c
cmp dword [rax + 8], 0
je 0x10049f9c
add rax, 0xc
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x10049e2e
test rdx, rdx
je 0x1004a25a
mov eax, dword [rdx]
and dword [rdx], 0
mov r8d, 0x53db1ca7
cmp eax, 1
jne 0x1004a260
mov r8d, dword [rdx + 4]
jmp 0x1004a260
mov r8d, 0x53db1ca7
lea rax, [rcx + 4]
mov dword [rcx], 1
mov dword [rcx + 4], r8d
ret
mov rdx, rcx
lea rcx, [0x101101d0]
jmp 0x10049f6d
Function at 0x1004a438
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x10049e91
mov rbx, rax
test rax, rax
jne 0x10049e7b
mov ecx, 0x10
call fcn.1004a12b
mov rbx, rax
and dword [rax + 8], 0
mov qword [rax], rdi
mov rcx, rdi
call fcn.10049e20
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
add rbx, 8
mov rcx, rbx
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1004a23f
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.10049e20
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10049f9c
cmp dword [rax + 8], 0
je 0x10049f9c
add rax, 0xc
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x10049e2e
test rdx, rdx
je 0x1004a25a
mov eax, dword [rdx]
and dword [rdx], 0
mov r8d, 0x53db1ca7
cmp eax, 1
jne 0x1004a260
mov r8d, dword [rdx + 4]
jmp 0x1004a260
mov r8d, 0x53db1ca7
lea rax, [rcx + 4]
mov dword [rcx], 1
mov dword [rcx + 4], r8d
ret
mov rdx, rcx
lea rcx, [0x101101d0]
jmp 0x10049f6d

Function at 0x1004ba0c
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.100a5dd0
dec eax
ret

Function at 0x1004ec05
Capabilities:
Modify service

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
je 0x1004ec1c
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1004c22b

Function at 0x1004ec25
Capabilities:
Modify service

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
je 0x1004ec3c
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1004c22b
Function at 0x10079690
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor r12d, r12d
mov r15d, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x10079710
jmp 0x100796ff
jae 0x100797b4
cmp r8, 0x201
jae 0x10079710
mov esi, 0x200
lea rdi, [rsp + 0x68]
mov rbp, r8
jmp 0x10079756
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x10079737
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.100676d0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x38]
cmp r12, r15
mov ebx, 0xffffffff
cmovb rbx, r12
mov qword [rsp + 0x40], rbx
mov r13, r12
mov rsi, rbx
mov rdi, qword [rsp + 0x20]
mov rbp, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, ebp
mov rdx, rdi
call sub.kernel32.dll_GetCurrentDirectoryW
mov r14d, eax
test eax, eax
jne 0x1007977b
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x10079812
mov r8d, r14d
cmp rbp, r8
jne 0x100796f0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x10079832
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov r8, rbp
cmp r8, 0x201
jb 0x100796ff
jmp 0x10079710
cmp rsi, r8
jb 0x1007984c
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.100898c0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rsi, qword [rsp + 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x100797fb
add r12, r12
mov r8d, 2
mov rcx, qword [rsp + 0x20]
mov rdx, r12
call fcn.100028e0
mov rax, rsi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x100797e5
jmp 0x100797fb
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.100e76b0
jmp 0x10079861
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.100ee380
ud2
Function at 0x1008ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1008ab93
test ecx, ecx
jne 0x1008abe2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x1008aba0
test ecx, ecx
jne 0x1008abe2
mov rcx, rdi
call fcn.1008aa40
movzx r10d, al
test bl, bl
jne 0x1008abe9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x1008abd6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x1008ad5c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x1008abd6.2
xor r10d, r10d
test bl, bl
je 0x1008abb0
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1008ad3e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x1008ac1b
xor edi, edi
jmp 0x1008ac98
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x1008ac60
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x1008ac7b
inc rsi
dec rax
cmp rsi, 1
jne 0x1008ac40
jmp 0x1008ac98
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x1008ac7b
cmp ebx, 0x5c
je 0x1008ac7b
inc rsi
dec rax
cmp rsi, 1
jne 0x1008ac60
jmp 0x1008ac98
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x1008ad4c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x1008acc2
mov al, 9
cmp rdx, 2
je 0x1008acc6
cmp rdx, 1
jne 0x1008acd6
cmp byte [r9], 0x2e
jne 0x1008acd6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x1008acd6
mov al, 0xa
jmp 0x1008acd6
cmp byte [r9], 0x2e
jne 0x1008acd6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x1008abd6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x1008abd6.2
mov esi, 2
jmp case.0x1008abd6.2
lea r8, [0x10122378]
call fcn.100ee2a0
ud2
lea r8, [0x10122390]
call fcn.100ee2a0
ud2