joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x004930b8]
test ecx, ecx
je 0x446906
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x44686d
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x446900
mov ecx, dword [0x004930b8]
test ecx, ecx
je 0x446928
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x446945
mov rsi, rax
test rax, rax
jne 0x4468fa
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x4468bf
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x446960
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x446960
mov rsi, rax
lea rax, [0x004930a0]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x004930b8]
test ecx, ecx
je 0x446950
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x446947
lea rcx, [0x004930a0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x446860
jmp 0x44686d
lea rcx, [0x004930a0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x44688c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x004930a0]
call fcn.00445af0
mov ecx, eax
jmp 0x4468f2
mov ecx, 8
mov edx, 0x10
call fcn.0040cdc0
ud2

Function at 0x4470a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x0049dcf8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x447111
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x447147
test eax, eax
js 0x447122
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x44713a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x0049dd60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.00444c90
mov rcx, rax
call fcn.00444d90
mov ecx, 7
int 0x29
ud2
Function at 0x447600
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00493078]
test ecx, ecx
je 0x44762d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x447646
cmp qword [rax + 8], 0
je 0x447646
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00493060]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x44761c
mov ecx, dword [0x00493078]
test ecx, ecx
je 0x4476f1
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x44770e
mov rsi, rax
test rax, rax
jne 0x4476d3
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x447698
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x447726
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x447726
mov rsi, rax
lea rax, [0x00493060]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00493078]
test ecx, ecx
je 0x447716
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00493060]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x447665
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00493060]
call fcn.00445af0
mov ecx, eax
jmp 0x4476cb
mov ecx, 8
mov edx, 0x20
call fcn.0040cdc0
ud2
Function at 0x44bad0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.00465040
mov rsi, rdx
test rax, rax
je 0x44bb93
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x44bb87
test rax, rax
je 0x44bb87
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x44bb76
cmp qword [r14 + 0x10], 0x11
jb 0x44bb65
mov rbx, qword [rbx - 8]
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rbx
call fcn.0049062c
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rsi
call fcn.0049062c
mov qword [rdi], 0
jmp 0x44bd07
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.004652b0
cmp dword [rsp + 0x40], 2
jne 0x44bc25
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x44bc06
test rcx, rcx
je 0x44bc06
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
cmp qword [r15 + 8], 0
je 0x44bbf5
cmp qword [r15 + 0x10], 0x11
jb 0x44bbe4
mov r14, qword [r14 - 8]
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, r14
call fcn.0049062c
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rbx
call fcn.0049062c
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x44bc77
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x44bcf3
mov rbx, qword [rsp + 0x40]
jmp 0x44bc79
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x44bce2
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x44bce2
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x44bcff
mov qword [rdi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x44bcff
call fcn.0049068c
mov qword [rdi], 0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x468760
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.00447bf0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x468813
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.004653c0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x468813
mov rcx, rdi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x4687e7
test rsi, rsi
je 0x468811
mov rcx, qword [0x004ac108]
xor esi, esi
xor edx, edx
mov r8, rdi
call fcn.0049062c
jmp 0x468813
call fcn.0049068c
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x46880c
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rdi
call fcn.0049062c
mov rsi, rbx
jmp 0x468813
xor esi, esi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x469730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x004930d8]
test ecx, ecx
je 0x469760
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x469779
mov rdi, rax
cmp qword [rax + 8], 0
je 0x469779
add rdi, 0x10
jmp 0x46986e
lea rcx, [0x004930c0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x46974d
mov ecx, dword [0x004930d8]
test ecx, ecx
je 0x46984f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x46986c
mov rsi, rax
test rax, rax
jne 0x46981e
mov qword [rsp + 0x28], 0
lea rax, [0x004930c0]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x4697e0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x469888
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x469888
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x004930d8]
test ecx, ecx
je 0x469878
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x46986e
test rcx, rcx
je 0x46986e
lock dec qword [rcx]
jne 0x46986e
call fcn.004698b0
jmp 0x46986e
lea rcx, [0x004930c0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x469798
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004930c0]
call fcn.00445af0
mov ecx, eax
jmp 0x469816
mov ecx, 8
mov edx, 0x18
call fcn.0040cdc0
ud2
Function at 0x46a200
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rbx, r8
inc rbx
sete bpl
je 0x46a468
js 0x46a482
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x46a25b
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x46a459
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x46a459
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
cmp r14, 0x10
jae 0x46a2a8
test r14, r14
je 0x46a363
xor eax, eax
cmp byte [r15 + rax], 0
je 0x46a3e4
inc rax
cmp r14, rax
jne 0x46a290
jmp 0x46a363
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
je 0x46a2ee
cmp rax, r14
cmovae rax, r14
test rax, rax
je 0x46a2ee
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r15 + rcx], 0
je 0x46a3e4
inc rcx
cmp rax, rcx
jne 0x46a2d0
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x46a2f4
jmp 0x46a33e
lea rcx, [r14 - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x004963a0]
movabs rdx, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x46a33e
add rax, 0x10
cmp rax, rcx
jbe 0x46a310
cmp rax, r14
je 0x46a363
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x46a3e4
inc rax
cmp r14, rax
jne 0x46a350
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x30]
call fcn.0040cfb0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov rcx, rax
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x46a41a
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
jne 0x46a438
jmp 0x46a449
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test bpl, bpl
jne 0x46a449
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.0049062c
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
je 0x46a449
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rbx
call fcn.0049062c
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rbx
call fcn.0040cdc0
ud2
lea rcx, [0x004a25fe]
lea r8, str.library_alloc_src_ffic_str.rs
mov edx, 0x2b
call fcn.0040e950
ud2
call fcn.0040cd80
ud2
Function at 0x471340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.00447bf0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x4713b5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.00471260
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4713c3
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4713e3
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x4713d4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.00447dc0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x4713d4
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.0049062c
Function at 0x473280
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x4732bd
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x47336d
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x47336d
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x00473690]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x473360
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x47333b
cmp qword [rbx + 0x10], 0x11
jb 0x47332a
mov rdi, qword [rdi - 8]
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rdi
call fcn.0049062c
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rsi
call fcn.0049062c
call fcn.0049068c
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.0040cdc0
ud2
Function at 0x473940
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1078
call fcn.00490490
sub rsp, rax
movaps xmmword [rsp + 0x1060], xmm6
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x34], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x34]
mov qword [rsp + 0x58], r13
lea rbp, [0x0046b200]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x473ad5
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x60]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x4739d3
cmp dword [rsp + 0x38], 0
jne 0x473ada
mov r15d, dword [rsp + 0x3c]
test r15, r15
je 0x473ada
cmp r15d, 0x1000
ja 0x473b1a
xor r12d, r12d
nop word cs:[rax + rax]
cmp r12, r15
ja 0x473b06
lea rdx, [rsp + r12]
add rdx, 0x60
mov r8d, r15d
sub r8d, r12d
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x473ad5
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x473a70
cmp dword [rsp + 0x38], 0
jne 0x473ada
mov eax, dword [rsp + 0x3c]
add r12, rax
cmp r12, r15
jne 0x473a20
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r14
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x4739d3
call fcn.0049068c
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1060]
add rsp, 0x1078
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.0040f290
jmp 0x473b2e
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.0040e5b0
ud2

Function at 0x473b50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x473b86
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call fcn.0049068c
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.004667d0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.0040dbf0
ud2
Function at 0x47a580
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x0049dcf8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x47a5ea
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x47a5f5
xor eax, eax
jmp 0x47a605
cmp eax, 0x103
je 0x47a64b
test eax, eax
js 0x47a61a
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
add rsp, 0xa8
pop rdi
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edi, eax
mov ecx, eax
call fcn.00448c30
cmp al, 0xb
jne 0x47a636
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x47a610
shl rdi, 0x20
or rdi, 2
mov qword [rsi + 8], rdi
mov qword [rsi], 1
jmp 0x47a610
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x0049dd60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.00444c90
mov rcx, rax
call fcn.00444d90
mov ecx, 7
int 0x29
ud2

Function at 0x47a7d0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x004930f8]
test ecx, ecx
je 0x47a7fd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x47a816
cmp qword [rax + 8], 0
je 0x47a816
add rax, 0x10
add rsp, 0x30
pop rsi
ret
lea rcx, [0x004930e0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x47a7ec
mov ecx, dword [0x004930f8]
test ecx, ecx
je 0x47a8fd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x47a91a
mov rsi, rax
test rax, rax
jne 0x47a8ab
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x47a868
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x47a935
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x47a935
mov rsi, rax
lea rax, [0x004930e0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x004930f8]
test ecx, ecx
je 0x47a922
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x47a8db
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x47a8e3
call fcn.00473b50
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x004930e0]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x47a835
xor eax, eax
add rsp, 0x30
pop rsi
ret
lea rcx, [0x004930e0]
call fcn.00445af0
mov ecx, eax
jmp 0x47a8a3
mov ecx, 8
mov edx, 0x20
call fcn.0040cdc0
ud2
Function at 0x47dc50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x00493148]
test ecx, ecx
je 0x47dd4c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x47dc89
mov rcx, qword [rax + 8]
add rax, 0x10
test rcx, rcx
cmove rax, rcx
jne 0x47dd8d
mov ecx, dword [0x00493148]
test ecx, ecx
je 0x47dd6e
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x47dd8b
mov rdi, rax
test rax, rax
jne 0x47dd1e
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x47dcdb
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x47dda7
mov rcx, rax
mov qword [0x004ac108], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x47dda7
mov rdi, rax
lea rax, [0x00493130]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x00493148]
test ecx, ecx
je 0x47dd94
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x47dd38
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x47dd3a
mov rcx, qword [rsi + 8]
jmp 0x47dd3a
xor ecx, ecx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
jmp 0x47dd8d
lea rcx, [0x00493130]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x47dc74
jmp 0x47dc89
lea rcx, [0x00493130]
call fcn.00445af0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x47dca8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x00493130]
call fcn.00445af0
mov ecx, eax
jmp 0x47dd16
mov ecx, 8
mov edx, 0x18
call fcn.0040cdc0
ud2