joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011b60
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
mov ebx, 1
sub ebx, 1
nop
nop
add ebx, 1
mov eax, ebx
and eax, 0xffffffff
lea rdx, [0x10001f1b0]
lea rcx, [rdx + rax*8 - 8]
movabs rdx, 0
call fcn.100004be0
mov eax, ebx
and eax, 0xffffffff
lea rdx, [0x10001f1f0]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100011b88
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0x10]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
cmp eax, 0
jle 0x100011c58
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
mov r9d, 0
movabs r8, 0xa
call fcn.100005790
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.10000d8c0
mov ebx, eax
mov eax, ebx
sub eax, 3
cmp eax, 3
jae 0x100011c57
lea rcx, [0x1000119d0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100011a90]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop
mov rcx, rbp
call fcn.100011b40
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x140005de0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
mov al, byte [rax + 2]
test al, al
setne al
ret

Function at 0x140005e00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
call sub.kernel32.dll_DebugActiveProcess
test eax, eax
je 0x140005e2a
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 1
add rsp, 0x28
jmp sub.kernel32.dll_TerminateProcess
nop
add rsp, 0x28
ret

Function at 0x140009910
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movabs r12, 0x8000000000000000
call fcn.140002310
lea rax, str.__Q:_z_vVP
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x30], 0x784755fe
mov edx, dword [rsp + 0x30]
call fcn.140008a20
mov ecx, 0xaf691686
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0x1a
mov dword [rsp + 0x28], ecx
mov byte [rsp + 0x2c], al
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x28]
mov r8d, 5
call fcn.1400f3e60
cmp qword [rsp + 0x58], r12
jne 0x140009afd
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor ecx, ecx
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x140009ad5
call fcn.140010d30
mov ecx, 0x7d0
call fcn.14000b210
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov r14d, 1
mov ecx, 0x5edd5
mov edx, 1
call fcn.140011db0
test rax, rax
je 0x140009b37
mov rbx, rax
lea rdx, [0x1401199a8]
mov r8d, 0x5edd5
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rax, [0x14017877d]
nop word cs:[rax + rax]
lea ecx, [r14 - 1]
and ecx, 0x1e
movzx ecx, byte [rcx + rax]
xor byte [rbx + r14 - 1], cl
cmp r14, 0x5edd5
je 0x140009a3d
mov ecx, r14d
and ecx, 0x1f
movzx ecx, byte [rcx + rax]
xor byte [rbx + r14], cl
add r14, 2
jmp 0x140009a10
mov ecx, 0x40000
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_HeapCreate
mov r14, rax
mov r8d, 0x5edd5
mov rcx, rax
mov edx, 8
call fcn.140115ddc
mov r15, rax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140009ac2
mov ecx, 0xfa0
call fcn.14000b210
lea rcx, [rsp + 0x30]
call fcn.14000b9c0
mov rdx, qword [rsp + 0x30]
cmp rdx, r12
je 0x140009aa1
test rdx, rdx
je 0x140009aa1
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.140011dc0
mov r8d, 0x5edd5
mov rcx, r15
mov rdx, rbx
call sub.msvcrt.dll_memmove
call r15
mov rcx, r14
xor edx, edx
mov r8, r15
call fcn.140115dec
mov edx, 0x5edd5
mov r8d, 1
mov rcx, rbx
call fcn.140011dc0
mov byte [rdi], 0
test rsi, rsi
je 0x140009aee
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.140011dc0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, [0x140119990]
mov qword [rsp + 0x20], rax
lea r9, [0x140119910]
lea r8, [rsp + 0x30]
mov ecx, 1
xor edx, edx
call fcn.140100780
jmp 0x140009b46
mov ecx, 1
mov edx, 0x5edd5
call fcn.1400f33e0
ud2
Function at 0x14000f100
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400239c0
test rax, rax
je 0x14000f162
mov rbx, rax
mov r14, rdx
mov rax, qword [rdx]
test rax, rax
je 0x14000f14b
mov rcx, rbx
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14000f1ba
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call fcn.140011dc0
jmp 0x14000f1ba
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x1401795c8]
lea rdx, [rsp + 0x40]
mov r9d, 8
call fcn.140023300
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140020ad0

Function at 0x140010d30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
lea rsi, [rsp + 0x50]
lea rdi, [rsp + 0x30]
nop word cs:[rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x140010e0b
mov rax, qword [rbx + 0x60]
movzx ecx, word [rbx + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.1400103f0
cmp dword [rsp + 0x50], 0
jne 0x140010e14
cmp dword [rsp + 0x54], 0xaddfe535
jne 0x140010d60
mov rsi, qword [rbx + 0x30]
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xa2b1807f
call fcn.140010e60
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xced7e31f
call fcn.140010e60
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0x91c3ed4a
call fcn.140010e60
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xb2036547
call fcn.140010e60
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xa596d8ce
call fcn.140010e60
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, str.src_ssn_solving.rs
mov qword [rsp + 0x20], rax
lea r9, fcn.140010640
lea r8, [rsp + 0x48]
mov ecx, 1
xor edx, edx
call fcn.140100780
ud2
Function at 0x140010e60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140010f8c
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140010f8c
mov ebx, r8d
mov qword [rsp + 0x28], rcx
mov eax, dword [rdi + rax + 0x88]
mov r14d, dword [rax + rdi + 0x20]
add r14, rdi
mov ecx, dword [rax + rdi + 0x14]
mov qword [rsp + 0x48], rcx
mov ebp, dword [rax + rdi + 0x18]
mov ecx, dword [rax + rdi + 0x1c]
add rcx, rdi
mov qword [rsp + 0x38], rcx
mov eax, dword [rax + rdi + 0x24]
add rax, rdi
mov qword [rsp + 0x40], rax
xor r13d, r13d
lea r15, [rsp + 0x50]
lea r12, [rsp + 0x60]
xor eax, eax
nop dword [rax]
cmp rax, rbp
je 0x140010fa3
mov rsi, rax
mov eax, dword [r14 + rax*4]
add rax, rdi
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rax + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140010f00
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.1400103f0
cmp dword [rsp + 0x50], 0
jne 0x140010fc4
lea rax, [rsi + 1]
cmp dword [rsp + 0x54], ebx
jne 0x140010ee0
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + rsi*2]
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x140010ff4
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + rcx*4]
cmp byte [rax + rdi], 0x4c
mov rcx, qword [rsp + 0x28]
jne 0x140010f8c
add rax, rdi
cmp byte [rax + 1], 0x8b
jne 0x140010f8c
cmp byte [rax + 2], 0xd1
jne 0x140010f8c
cmp byte [rax + 3], 0xb8
jne 0x140010f8c
cmp byte [rax + 6], 0
jne 0x140010f8c
cmp byte [rax + 7], 0
je 0x140010faa
xor r13d, r13d
mov qword [rcx], r13
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x28]
jmp 0x140010f8f
movzx edx, byte [rax + 4]
or dl, byte [rax + 5]
movzx edx, dl
mov qword [rcx + 8], rax
mov word [rcx + 0x10], dx
mov r13d, 1
jmp 0x140010f8f
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, str.src_ssn_solving.rs
mov qword [rsp + 0x20], rax
lea r9, fcn.140010640
lea r8, [rsp + 0x30]
mov ecx, 1
xor edx, edx
call fcn.140100780
ud2
lea r8, str.src_ssn_solving.rs
call fcn.140100360
mov rsi, rax
lea rcx, [rsp + 0x30]
call fcn.140010640
mov rcx, rsi
call fcn.140116420
call fcn.1401004b0
int3
Function at 0x140011a60
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rbx, qword [rdx]
add r9, r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
call fcn.14000e1f0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.140011db0
test rax, rax
je 0x140011c3e
mov r14, rax
mov qword [rsp + 0x38], 0x800
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x78]
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x48]
sub r12, r13
nop dword [rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140011b50
mov r8d, dword [rsp + 0x30]
cmp r12, r8
jae 0x140011b10
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.14000ca70
mov r14, qword [rsp + 0x40]
jmp 0x140011aff
test eax, eax
jne 0x140011b80
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
movabs rbx, 0x8000000000000000
jbe 0x140011c1a
movabs rax, 0xde00000002
jmp 0x140011b92
shl rax, 0x20
or rax, 2
movabs rbx, 0x8000000000000000
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140011bb6
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.140011dc0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140011bd1
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011dc0
mov rdi, qword [rsp + 0x50]
cmp rdi, rbx
jne 0x140011be9
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
jmp 0x140011c03
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140012850
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.140011640
mov rax, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x68], al
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x140011bc0
jmp 0x140011bd1
mov ecx, 1
mov edx, 0x800
call fcn.1400f33e0
ud2
Function at 0x1400120f0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1060
call fcn.140115830
sub rsp, rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ebx, dword [rdx + 8]
mov r14, qword [rax]
mov dword [rsp + 0x44], 0x800
lea r15, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x44]
mov rcx, r14
mov edx, ebx
mov r8, r15
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x14001216d
cmp eax, 0x103
jne 0x1400121a5
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rsi], rax
jmp 0x1400121d8
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
jae 0x1400121ea
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.1400f5be0
mov rcx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x1400121b9
mov rax, qword [rsp + 0x50]
jmp 0x1400121c3
movabs rcx, 0x8000000000000000
shl rax, 0x20
or rax, 2
jmp 0x1400121c8
movabs rax, 0x900000002
mov rdx, qword [rsp + 0x58]
inc ebx
mov dword [rdi + 8], ebx
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov rax, rsi
add rsp, 0x1060
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.C:Userswin10_x64.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinreg_0.52.0_src_reg_key.rs
mov edx, 0x800
mov rcx, r8
mov r8, rax
call fcn.140106450
int3
Function at 0x140012230
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x10b8
call fcn.140115830
sub rsp, rax
mov rsi, rcx
mov rax, qword [rdx]
mov qword [rsp + 0x70], rdx
mov ecx, dword [rdx + 8]
mov dword [rsp + 0x48], ecx
mov r15, qword [rax]
mov dword [rsp + 0x40], 0x800
lea rcx, [rsp + 0xb8]
mov r8d, 0x1000
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x4c], 0
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.140011db0
test rax, rax
je 0x1400124bf
mov r12, rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], 0x800
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
lea rsi, [rsp + 0x44]
lea rdi, [rsp + 0x4c]
lea r13, [rsp + 0xb8]
lea rbp, [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
sub rbx, rax
nop word cs:[rax + rax]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, r15
mov edx, dword [rsp + 0x48]
mov r8, r13
mov r9, rbp
call sub.advapi32.dll_RegEnumValueW
cmp eax, 0xea
jne 0x140012355
inc dword [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
cmp rbx, r8
jae 0x140012300
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
call fcn.140013e50
mov r12, qword [rsp + 0x58]
jmp 0x1400122e3
mov r14d, eax
test eax, eax
je 0x140012383
cmp r14d, 0x103
mov rdi, qword [rsp + 0x68]
movabs rbx, 0x8000000000000000
jne 0x1400123d6
mov sil, 1
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x1400123ea
jmp 0x1400123fa
mov r8d, dword [rsp + 0x40]
cmp r8, 0x801
mov rdi, qword [rsp + 0x68]
movabs rbx, 0x8000000000000000
jae 0x1400124ce
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xb8]
call fcn.1400f5be0
mov rdx, qword [rsp + 0xa0]
cmp rdx, rbx
jne 0x140012458
movabs r14, 0xd00000002
jmp 0x1400123de
shl r14, 0x20
or r14, 2
xor esi, esi
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400123fa
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call fcn.140011dc0
test sil, sil
je 0x140012407
inc rbx
mov rdx, rbx
jmp 0x14001241b
mov rdx, rbx
mov r9d, dword [rsp + 0x48]
inc r9d
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], r9d
mov qword [rdi], rdx
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r8
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rdi + 0x18], xmm0
mov rcx, qword [rsp + 0x90]
mov qword [rdi + 0x28], rcx
mov byte [rdi + 0x30], al
mov rax, rdi
add rsp, 0x10b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x4c]
cmp eax, 0xb
jbe 0x14001249d
movabs r14, 0xde00000002
test rdx, rdx
je 0x1400123de
mov r8d, 1
call fcn.140011dc0
jmp 0x1400123de
mov r9, qword [rsp + 0x60]
mov qword [rsp + 0x90], r9
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
mov r14, rcx
jmp 0x14001240a
mov ecx, 1
mov edx, 0x800
call fcn.1400f33e0
lea rax, str.C:Userswin10_x64.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinreg_0.52.0_src_reg_key.rs
mov edx, 0x800
mov rcx, r8
mov r8, rax
call fcn.140106450
ud2
Function at 0x140023e90
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140023ef6
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x140023eb8
add rdi, rbx
sub rsi, rbx
je 0x140023ef6
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140023eb0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x140023eb0
and ebp, 0x7fffffff
jmp 0x140023ef8
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140028200
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [0x14017b5d0]
lea r9, [0x14017b5c0]
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x140028286
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400282c6
cmp qword [rsi], 0
je 0x14002826b
mov rcx, rsi
call fcn.140065d10
mov qword [rsi], rbx
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm0
mov rax, qword [rsi]
mov qword [rdi], rax
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
jmp 0x1400282d2
lea rbx, [rsp + 0x38]
mov ecx, eax
call fcn.14006e4f0
mov r14, rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edx
cmp qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 1
jne 0x1400282b7
mov rcx, rbx
call fcn.140065d10
test r14, r14
je 0x1400282c6
lea rcx, [rsp + 0x48]
call fcn.14006ef90
mov byte [rdi + 0x18], 2
mov rcx, rsi
call fcn.140026c80
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028610
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 8], 0
je 0x1400286d1
lea r14, [rsi + 8]
lea rcx, [0x14017b5f2]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x30
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x30]
mov rdx, r14
call fcn.140032300
mov rcx, rbx
call fcn.140115a84
mov rcx, qword [rsp + 0x30]
call fcn.140115a84
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call fcn.1400655d0
lea rcx, [rsp + 0x38]
call fcn.1400655d0
cmp qword [rsp + 0x40], 0
mov r14, qword [rsp + 0x48]
je 0x1400286df
test r14, r14
je 0x1400286d1
lea rcx, [rsp + 0x48]
call fcn.14006ef90
mov byte [rdi + 0x18], 2
mov rcx, rsi
call fcn.140026c80
jmp 0x14002870c
cmp qword [rsi + 0x10], 0
je 0x1400286f2
lea rbx, [rsi + 0x10]
mov rcx, rbx
call fcn.140065d10
mov qword [rsi + 0x10], r14
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x18], rax
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400292a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x140118390]
jmp 0x140047e50
Function at 0x14002c420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [str._A_a_]
jmp 0x140047d70
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x140047e17
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140047e0f
je 0x140047db0
test rdi, rdi
je 0x140047db4
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x140047db6
mov rbx, qword [rdi + 8]
jmp 0x140047db6
xor eax, eax
jmp 0x140047e0f
xor ebx, ebx
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.140011db0
test rax, rax
je 0x140047e31
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x140047e0c
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call fcn.140011dc0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400cec50
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140047d94
jmp 0x140047e0f
mov ecx, 8
mov edx, 0x10
call fcn.1400f3400
int3

Function at 0x14002c430
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x140118190]
jmp 0x140047ca0
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x140047d43
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x140047d3b
je 0x140047d39
test rdi, rdi
je 0x140047cdc
cmp dword [rdi], 0
mov dword [rdi], 0
je 0x140047cdc
mov rdi, qword [rdi + 4]
jmp 0x140047cde
xor edi, edi
mov rax, qword [0x1401a9e18]
movzx eax, byte [rax]
mov ecx, 0xc
mov edx, 4
call fcn.140011db0
test rax, rax
je 0x140047d5d
mov qword [rax], rdi
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x140047d34
mov edx, 0xc
mov r8d, 4
mov rcx, rdi
call fcn.140011dc0
mov rax, rsi
jmp 0x140047d3b
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400cec50
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x140047cc4
jmp 0x140047d3b
mov ecx, 4
mov edx, 0xc
call fcn.1400f3400
int3

Function at 0x140031be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x140118390]
jmp 0x140047e50