joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407970
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rcx], xmm0
aeskeygenassist xmm1, xmm0, 1
pshufd xmm1, xmm1, 0xff
movdqa xmm2, xmm0
pslldq xmm2, 4
movdqa xmm3, xmm0
pslldq xmm3, 8
movdqa xmm4, xmm0
pslldq xmm4, 0xc
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
pxor xmm4, xmm1
movdqa xmmword [rcx + 0x10], xmm4
aeskeygenassist xmm0, xmm4, 2
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x20], xmm3
aeskeygenassist xmm0, xmm3, 4
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x30], xmm4
aeskeygenassist xmm0, xmm4, 8
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x40], xmm3
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x50], xmm4
aeskeygenassist xmm0, xmm4, 0x20
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x60], xmm3
aeskeygenassist xmm0, xmm3, 0x40
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x70], xmm4
aeskeygenassist xmm0, xmm4, 0x80
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x80], xmm3
aeskeygenassist xmm0, xmm3, 0x1b
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x90], xmm4
aeskeygenassist xmm0, xmm4, 0x36
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0xa0], xmm3
ret
Function at 0x40fc50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x40fce0
cmp r10, r11
jb 0x40fd56
cmp r10, rdx
ja 0x40fd6a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x40fce2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x40fcc0
jmp 0x40fd44
ja 0x40fcea
mov r11, r10
cmp rax, r8
jne 0x40fc84
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x40fd20
mov rdi, r8
sub ecx, edx
jns 0x40fd3b
jmp 0x40fd46
cmp r8, rsi
je 0x40fd7b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x40fd46
xor al, 1
cmp rdi, rsi
jne 0x40fd00
jmp 0x40fd46
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r11
mov rdx, r10
call fcn.00410490
ud2
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r10
call fcn.0040fed0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_repos_rust_1.70.0_library_alloc_src_collections_btree_navigate.rs
lea r8, str.library_core_src_unicode_printable.rs
mov edx, 0x2b
call fcn.0040f020
ud2
Function at 0x417290
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
sub r8, rdx
cmp r8, 0x20
jae 0x4172b1
cmp rcx, rdx
je 0x4172bc
cmp r8, 4
jae 0x4172bf
xor eax, eax
mov rcx, rdx
jmp 0x41734c
mov rcx, rdx
mov rdx, r8
jmp fcn.0040e250
xor eax, eax
ret
mov rcx, r8
and rcx, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x00454200]
movdqa xmm3, xmmword [0x00454210]
pxor xmm1, xmm1
movzx r9d, word [rdx + rax]
movd xmm4, r9d
movzx r9d, word [rdx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp rcx, rax
jne 0x4172e0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp rcx, r8
je 0x417369
add rcx, rdx
add rdx, r8
nop
xor r8d, r8d
cmp byte [rcx], 0xc0
lea r9, [rcx + 1]
setge r8b
add rax, r8
mov rcx, r9
cmp r9, rdx
jne 0x417350
ret
Function at 0x417590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x4175eb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x4175eb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x417606
cmp eax, 0x42
jne 0x4175eb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x4176b6
cmp byte [r9 + r11], 0x5f
jne 0x4176b6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x41771e
mov rcx, rsi
xor edx, edx
call fcn.00412800
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.00412800
test al, al
jne 0x4177b8
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x417642
lea rdx, [0x00bab5ac]
mov r8d, 1
call fcn.0040bf40
test al, al
jne 0x4177b8
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x4175fa
xor r14d, r14d
lea rbx, [0x00bab5a6]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x417674
cmp byte [rax + rcx], 0x45
je 0x4177e1
sub r14, 1
jb 0x417699
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x417699
mov r8d, 2
mov rdx, rbx
call fcn.0040bf40
test al, al
jne 0x4177b8
mov rcx, rsi
call fcn.004177f0
test al, al
jne 0x4177b8
mov rax, qword [rsi]
test rax, rax
jne 0x417660
jmp 0x4175fa
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x41777f
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x417712
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x4176fc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x4176eb
add dl, 0xa9
jmp 0x4176fa
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x41777f
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x41777f
movzx edx, bl
add rax, rdx
jae 0x4176c0
jmp 0x41777f
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x41777f
cmp rax, rcx
jae 0x41777c
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x4177c0
cmp qword [rsi + 0x20], 0
je 0x4177da
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.00417590
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x4175fa
jmp 0x4177b8
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4177cf
lea rax, [0x00bab571]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.0040bf40
test al, al
je 0x4177cf
mov dil, 2
jmp 0x4175fa
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x41778a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x4175fa
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x4175fa
Function at 0x41e4a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1088
call fcn.00451170
sub rsp, rax
movaps xmmword [rsp + 0x1070], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x70]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x0044c7b0]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x41e63b
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x41e53e
cmp dword [rsp + 0x34], 0
jne 0x41e640
mov r15d, dword [rsp + 0x38]
test r15, r15
je 0x41e640
cmp r15d, 0x1000
ja 0x41e680
xor r12d, r12d
nop dword [rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x70
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x41e63b
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x41e5d0
cmp dword [rsp + 0x34], 0
jne 0x41e640
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
je 0x41e5fd
jbe 0x41e580
jmp 0x41e66c
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov r8d, 0x1000
mov r9, rbx
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x41e53e
call sub.kernel32.dll_GetLastError
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1070]
add rsp, 0x1088
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_sys_windows_pipe.rs
mov rcx, r12
mov rdx, r15
call fcn.00410490
jmp 0x41e694
lea r8, str.library_std_src_sys_windows_pipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.0040fed0
ud2
Function at 0x41f0d0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
movaps xmm0, xmmword [0x00454220]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.0042b180
mov rdi, rdx
test rax, rax
je 0x41f18d
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x41f181
mov rbx, rdi
dec rbx
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x41f170
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x41f162
mov r8, qword [r8 - 8]
mov rcx, qword [0x00bb5140]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00bb5140]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov qword [rsi], 0
jmp 0x41f345
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
je 0x41f249
test byte [rsp + 0x41], 4
je 0x41f1ee
mov qword [rsp + 0x80], 0
lea r8, [rsp + 0x80]
mov rcx, rdi
mov edx, 9
mov r9d, 8
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x41f249
mov r12d, dword [rsp + 0x60]
mov r15d, dword [rsp + 0x64]
test rdi, rdi
je 0x41f2ae
mov qword [rsp + 0x40], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x41f331
mov rbx, qword [rsp + 0x40]
jmp 0x41f2b0
call sub.kernel32.dll_GetLastError
mov r14d, eax
mov al, 1
test al, al
jne 0x41f336
shl r14, 0x20
or r14, 2
lea rbx, [r14 - 1]
mov rcx, qword [r14 - 1]
mov rax, qword [r14 + 7]
call qword [rax]
mov rax, qword [r14 + 7]
cmp qword [rax + 8], 0
je 0x41f298
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x41f28a
mov r8, qword [r8 - 8]
mov rcx, qword [0x00bb5140]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00bb5140]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
jmp 0x41f336
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x41f320
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x41f320
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x41f33d
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x41f33d
call sub.kernel32.dll_GetLastError
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x425f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x425fb0
test ecx, ecx
jne 0x426000
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x425fbc
test ecx, ecx
jne 0x426000
mov rcx, rdi
call fcn.00425e60
movzx eax, al
test bpl, bpl
jne 0x426007
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x425ff3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x00426178]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x425ff3.2
xor eax, eax
test bpl, bpl
je 0x425fcc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x426159
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x42603a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x4260b9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x426080
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x42609b
inc rax
dec rdi
cmp rax, 1
jne 0x426060
jmp 0x4260b9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x42609b
cmp ebx, 0x5c
je 0x42609b
inc rax
dec rdi
cmp rax, 1
jne 0x426080
jmp 0x4260b9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x426167
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x4260e3
mov al, 9
cmp rdx, 2
je 0x4260e7
cmp rdx, 1
jne 0x4260f7
cmp byte [r8], 0x2e
jne 0x4260f7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x4260f7
mov al, 0xa
jmp 0x4260f7
cmp byte [r8], 0x2e
jne 0x4260f7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x425ff3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x425ff3.2
mov ecx, 2
jmp case.0x425ff3.2
lea r8, str.library_std_src_path.rs
call fcn.0040ff60
ud2
lea r8, str.library_std_src_path.rs
call fcn.0040ff60
ud2
Function at 0x43e1b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x43e1e6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x0043dc90]
mov qword [rsp + 0x48], rax
lea rax, [0x00badcc0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_sys_windows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.0040efe0
ud2

Function at 0x43e310
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x43e38e
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x43e3cf
cmp dword [rsp + 0x2c], 0
je 0x43e3b3
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x43e3e9
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00bb5108]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00bb5108], rsi
jne 0x43e370
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x43e3c5
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x43e43f
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x43e3b8
mov edi, dword [rsp + 0x28]
jmp 0x43e3c5
mov edi, dword [rsi + 0x18]
jmp 0x43e3c3
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.0043cdc0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x30], 0
lea rax, str.called__Result::unwrap____on_an__Err__value
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rdx, str.library_std_src_sys_windows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.0040efe0
ud2
mov qword [rsp + 0x30], 0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rax, str.called__Result::unwrap____on_an__Err__value
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.0043ce90
ud2
Function at 0x44a470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.00442f90
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x44a4b4
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44a51b
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x44a511
mov rbx, qword [rsp + 0x20]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x44a509
lea rdi, [rbx - 1]
mov rcx, qword [rbx - 1]
mov rax, qword [rbx + 7]
call qword [rax]
mov rax, qword [rbx + 7]
cmp qword [rax + 8], 0
je 0x44a4f8
mov r8, qword [rdi]
cmp qword [rax + 0x10], 0x11
jb 0x44a4ea
mov r8, qword [r8 - 8]
mov rcx, qword [0x00bb5140]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00bb5140]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov qword [rsi + 8], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x44a511
mov rcx, qword [0x00bb5140]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
Function at 0x44d5f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x004530d8]
test ecx, ecx
je 0x44d623
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x44d63c
mov rbx, rax
cmp qword [rax], 0
je 0x44d63c
add rbx, 8
jmp 0x44d751
lea rcx, [0x004530c0]
call fcn.0043e310
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x44d611
mov ecx, dword [0x004530d8]
test ecx, ecx
je 0x44d732
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x44d74f
mov rdi, rax
test rax, rax
jne 0x44d6de
mov qword [rsp + 0x20], 0
lea rax, [0x004530c0]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x00bb5140]
test rcx, rcx
jne 0x44d69c
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x44d76f
mov rcx, rax
mov qword [0x00bb5140], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x44d76f
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x004530d8]
test ecx, ecx
je 0x44d75c
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x44d6ff
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdx, rax
test rax, rax
je 0x44d703
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x44d703
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x44d751
test rcx, rcx
je 0x44d751
lock dec qword [rcx]
jne 0x44d751
call fcn.00443c80
jmp 0x44d751
lea rcx, [0x004530c0]
call fcn.0043e310
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x44d65b
xor ebx, ebx
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x004530c0]
call fcn.0043e310
mov ecx, eax
jmp 0x44d6d6
mov ecx, 0x20
mov edx, 8
call fcn.00408470
ud2