joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402037f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140302d10]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140203861
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140203897
test eax, eax
js 0x140203872
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14020388a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140302d78]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140202630
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140201950
mov ecx, 7
int 0x29
ud2

Function at 0x140203f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140284940]
test ecx, ecx
je 0x140203fe3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140203f30
cmp qword [rax + 8], 0
je 0x140203f30
add rax, 0x10
jmp 0x140203fdd
mov ecx, dword [0x140284940]
test ecx, ecx
je 0x140203ff6
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140203fdb
mov rsi, rax
test rax, rax
jne 0x140203fc1
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140203f82
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140204019
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140204019
mov rsi, rax
lea rax, [0x140284928]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140284940]
test ecx, ecx
je 0x140204009
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x140203fdd
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140284928]
call fcn.140202220
mov ecx, eax
jmp 0x140203f15
lea rcx, [0x140284928]
call fcn.140202220
mov ecx, eax
jmp 0x140203f40
lea rcx, [0x140284928]
call fcn.140202220
mov ecx, eax
jmp 0x140203fb9
mov ecx, 8
mov edx, 0x20
call fcn.140004360
ud2
Function at 0x140206210
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor edi, edi
mov ebx, 0xffffffff
xor esi, esi
xor r14d, r14d
cmp r8, 0x201
jae 0x140206280
jmp 0x14020626f
jae 0x140206325
cmp r8, 0x201
jae 0x140206280
mov r15d, 0x200
lea r12, [rsp + 0x68]
mov r13, r8
jmp 0x1402062c7
sub r8, r14
sub rsi, r14
cmp rsi, r8
jae 0x1402062a7
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.1402049a0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x38]
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x40], r14
mov rsi, rdi
mov r15, r14
mov r12, qword [rsp + 0x20]
mov r13, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r13d
mov rdx, r12
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x1402062ec
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x14020637e
mov r8d, ebp
cmp r13, r8
jne 0x140206260
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x14020639e
add r13, r13
cmp r13, rbx
cmovae r13, rbx
mov r8, r13
cmp r8, 0x201
jb 0x14020626f
jmp 0x140206280
cmp r15, r8
jb 0x1402063b8
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.140206a70
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rdi, rdi
je 0x140206369
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, qword [rsp + 0x20]
call fcn.14027f164
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rdi, rdi
jne 0x140206356
jmp 0x140206369
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14003e7d0
jmp 0x1402063cd
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14003e430
ud2
Function at 0x140207fe0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.140220f80
mov rdi, rdx
test rax, rax
je 0x140208074
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.140201890
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1402211a0
cmp dword [rsp + 0x38], 2
jne 0x1402080a3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x1402080ef
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x14020811b
lea rcx, [rsp + 0x88]
call fcn.140201890
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x140208179
mov qword [rsp + 0x80], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1402081f5
mov rbx, qword [rsp + 0x80]
jmp 0x14020817b
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1402081e4
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x1402081e4
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x140208221
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x140208221
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140201890
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
jmp 0x140208063
Function at 0x1402218f0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
lea rcx, [rsp + 0xa8]
call fcn.140204570
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140221a5b
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x1402219b0
jmp 0x14022198f
jae 0x140221a71
cmp r8, 0x201
jae 0x1402219b0
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x1402219f7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x1402219d7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1402049a0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x140221a22
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140221aa6
mov r8d, r15d
cmp r12, r8
jne 0x140221980
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x140221b3a
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x14022198f
jmp 0x1402219b0
lea rcx, [rsp + 0xb0]
call fcn.140201890
mov byte [rsi + 0x18], 2
jmp 0x140221b0a
cmp rdi, r8
jb 0x140221b54
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.140206a70
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x140221abd
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 2
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x140221ada
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, qword [rsp + 0x28]
call fcn.14027f164
cmp byte [rsp + 0x78], 2
jne 0x140221b1f
mov byte [rsi + 0x18], 2
lea rcx, [rsp + 0x60]
call fcn.140201890
cmp qword [rsp + 0x40], 0
je 0x140221b0a
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.14027f164
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x140221af7
jmp 0x140221b0a
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14003e7d0
jmp 0x140221b69
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.14003e430
ud2
Function at 0x140223950
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140302d10]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1402239ba
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1402239c9
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140223a00
cmp eax, 0x103
je 0x140223a0a
test eax, eax
js 0x1402239e6
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140223a00
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140302d78]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140202630
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140201950
mov ecx, 7
int 0x29
ud2

Function at 0x140225d60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1402849e0]
test ecx, ecx
je 0x140225e62
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140225d94
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140225d94
add rdi, 0x10
jmp 0x140225e58
mov ecx, dword [0x1402849e0]
test ecx, ecx
je 0x140225e75
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140225e56
mov rsi, rax
test rax, rax
jne 0x140225e25
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140225de6
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140225e98
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140225e98
mov rsi, rax
lea rax, [0x1402849c8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402849e0]
test ecx, ecx
je 0x140225e88
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140225e58
test rcx, rcx
je 0x140225e58
lock dec qword [rcx]
jne 0x140225e58
call fcn.140225eb0
jmp 0x140225e58
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402849c8]
call fcn.140202220
mov ecx, eax
jmp 0x140225d76
lea rcx, [0x1402849c8]
call fcn.140202220
mov ecx, eax
jmp 0x140225da4
lea rcx, [0x1402849c8]
call fcn.140202220
mov ecx, eax
jmp 0x140225e1d
mov ecx, 8
mov edx, 0x18
call fcn.140004360
ud2
Function at 0x140227d90
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140227dcd
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140227e7d
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140227e7d
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140227ef0]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140227e70
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140227e4b
cmp qword [rbx + 0x10], 0x11
jb 0x140227e3a
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, rdi
call fcn.14027f164
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, rsi
call fcn.14027f164
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.140004360
ud2

Function at 0x140227ff0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x140228026
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1402224b0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.14003d630
ud2
Function at 0x140228610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402849a0]
test ecx, ecx
je 0x1402286d9
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022863d
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1402286c8
mov ecx, dword [0x1402849a0]
test ecx, ecx
je 0x1402286ec
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1402286ce
mov rsi, rax
test rax, rax
jne 0x1402286c2
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14022868b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14022870f
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14022870f
mov rsi, rax
lea rax, [0x140284988]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1402849a0]
test ecx, ecx
je 0x1402286ff
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1402286d0
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140284988]
call fcn.140202220
mov ecx, eax
jmp 0x140228625
lea rcx, [0x140284988]
call fcn.140202220
mov ecx, eax
jmp 0x14022864d
lea rcx, [0x140284988]
call fcn.140202220
mov ecx, eax
jmp 0x1402286ba
mov ecx, 8
mov edx, 0x10
call fcn.140004360
ud2

Function at 0x14022d1e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x1402849c0]
test ecx, ecx
je 0x14022d2b2
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022d210
mov rsi, rax
cmp qword [rax + 8], 0
je 0x14022d210
add rsi, 0x10
jmp 0x14022d22d
mov ecx, dword [0x1402849c0]
test ecx, ecx
je 0x14022d2c5
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14022d236
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rsi
ret
mov rsi, rax
test rax, rax
jne 0x14022d2e2
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14022d26d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14022d330
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14022d330
mov rsi, rax
lea rax, [0x1402849a8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402849c0]
test ecx, ecx
jne 0x14022d2d8
lea rcx, [0x1402849a8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d2da
lea rcx, [0x1402849a8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d1f5
lea rcx, [0x1402849a8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d220
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
call fcn.1402284f0
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x14022d20a
test rcx, rcx
je 0x14022d20a
lock dec qword [rcx]
jne 0x14022d20a
lea rcx, [rsp + 0x28]
call fcn.14022d350
jmp 0x14022d20a
mov ecx, 8
mov edx, 0x18
call fcn.140004360
ud2
Function at 0x14022d4d0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x140284a00]
test ecx, ecx
je 0x14022d5eb
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022d500
cmp qword [rax + 8], 0
je 0x14022d500
add rax, 0x10
jmp 0x14022d5e5
mov ecx, dword [0x140284a00]
test ecx, ecx
je 0x14022d5fe
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14022d5c5
mov rsi, rax
test rax, rax
jne 0x14022d595
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14022d552
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14022d624
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14022d624
mov rsi, rax
lea rax, [0x1402849e8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140284a00]
test ecx, ecx
je 0x14022d611
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14022d5c9
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14022d5d1
xor eax, eax
jmp 0x14022d5e5
call fcn.140227ff0
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x1402849e8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d4e5
lea rcx, [0x1402849e8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d510
lea rcx, [0x1402849e8]
call fcn.140202220
mov ecx, eax
jmp 0x14022d58d
mov ecx, 8
mov edx, 0x20
call fcn.140004360
ud2
Function at 0x14022de20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x14022dffb
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022de55
cmp qword [rax + 8], 0
je 0x14022de55
add rax, 0x10
jmp 0x14022df09
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x14022e028
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14022df10
mov rdi, rax
test rax, rax
jne 0x14022deea
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14022dea7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14022e095
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x38
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14022e095
mov rdi, rax
lea rax, [0x140285098]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x14022e04d
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
mov qword [rdi + 8], 1
lea rax, [rdi + 0x10]
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi + 0x30], 0
mov qword [rax], 0
mov rax, qword [0x140284a08]
cmp rax, 2
jne 0x14022e00e
lea rbx, [0x140284a18]
mov rcx, rbx
call sub.kernel32.dll_AcquireSRWLockExclusive
mov rax, qword [0x14036c238]
shl rax, 1
test rax, rax
jne 0x14022e018
xor edi, edi
movzx eax, byte [0x140284a20]
test al, al
jne 0x14022e060
mov rbx, qword [rsi]
mov rsi, qword [0x140284a38]
mov rcx, rsi
cmp rsi, qword [0x140284a30]
jne 0x14022df80
lea rcx, [0x140284a28]
mov rdx, rsi
call fcn.140241770
mov rcx, qword [0x140284a38]
mov rax, qword [0x140284a28]
mov qword [rax + rcx*8], rbx
inc rcx
mov qword [0x140284a38], rcx
mov rcx, qword [rax + rsi*8]
test rsi, rsi
je 0x14022dfc2
nop
lea r8, [rsi - 1]
mov rdx, r8
shr rdx, 1
mov r9, qword [rax + rdx*8]
cmp r9, rcx
jbe 0x14022dfc6
mov qword [rax + rsi*8], r9
mov rsi, rdx
cmp r8, 2
jae 0x14022dfa0
jmp 0x14022dfc9
xor edx, edx
jmp 0x14022dfc9
mov rdx, rsi
mov qword [rax + rdx*8], rcx
test dil, dil
jne 0x14022dfe8
movabs rax, 0x7fffffffffffffff
mov rcx, qword [0x14036c238]
test rcx, rax
jne 0x14022e03b
lea rcx, [0x140284a18]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.14027f1bc
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x14022de3a
call fcn.14022dc40
jmp 0x14022df21
call fcn.140207f90
mov edi, eax
xor dil, 1
jmp 0x14022df45
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x14022de65
call fcn.140207f90
test al, al
jne 0x14022dfe8
mov byte [0x140284a20], 1
jmp 0x14022dfe8
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x14022dee2
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x38], dil
lea rax, [0x1403041e0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.14022f950
lea r8, [rsp + 0x30]
mov edx, 0x2b
call fcn.1400427e0
ud2
mov ecx, 8
mov edx, 0x38
call fcn.140004360
ud2