joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f6d0
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov edi, dword [rcx + 0x10]
mov edx, 1
mov ecx, edi
call fcn.140042704
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140042704

Function at 0x14000f710
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov edi, dword [rcx + 8]
mov edx, 1
mov ecx, edi
call fcn.140042704
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140042704

Function at 0x140010340
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400ba028]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1400103af
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1400103db
test eax, eax
js 0x1400103bb
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1400103d1
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1400ba088]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call sym.std::io::Write::write_fmt::hdc620d2dd22aa030
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call sym.core::ptr::drop_in_place_core::result::Result____std::io::error::Error__::hfcc0b544997c6b8c
mov ecx, 7
int 0x29
ud2
Function at 0x140010d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x140045098]
test esi, esi
je 0x140010db3
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140010daa
je 0x140010d59
test rdi, rdi
je 0x140010d5d
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x140010d5f
mov rbx, qword [rdi + 8]
jmp 0x140010d5f
xor eax, eax
jmp 0x140010daa
xor ebx, ebx
movzx eax, byte [0x1400c2030]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x140010dc6
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140042704
test rdi, rdi
je 0x140010da7
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::hae0938d07776a6a0
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x140010d30
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x140010de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x1400450b8]
test esi, esi
je 0x140010e7e
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140010e75
je 0x140010e73
movzx eax, byte [0x1400c2030]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je 0x140010e91
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140042704
test rdi, rdi
je 0x140010e6e
mov rax, qword [rdi]
test rax, rax
je 0x140010e61
lock dec qword [rax]
jne 0x140010e61
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::h2e9684c2aaf21016
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x140010e75
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::h09a9b347479260fe
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
jmp 0x140010dfd
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3
Function at 0x140010f90
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x140011025
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x140011064
cmp dword [rbp], 0
je 0x140011048
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140011079
mov edi, eax
mov rax, qword [sym.std::sys::thread_local::guard::windows::tls_callback::hb3b522923a445e95]
mov rax, qword [0x1400c20d8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400c20d8], rsi
jne 0x140011000
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140011059
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x1400110bb
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001104d
mov edi, dword [rbp + 4]
jmp 0x140011059
mov edi, dword [rsi + 0x18]
jmp 0x140011057
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call sym.core::panicking::assert_failed::h0803915418e34f99
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.library_std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call sym.core::panicking::assert_failed::h42eecccc4207c29f
int3
Function at 0x1400111c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
cmp edx, 3
je 0x1400111dc
test edx, edx
jne 0x140011345
mov bl, 1
mov rdi, qword [0x1400c20d8]
nop word cs:[rax + rax]
test rdi, rdi
je 0x140011230
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x14001139a
mov rdi, qword [rdi + 8]
test esi, esi
je 0x1400111f0
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400111f0
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140042704
mov rcx, rsi
call r14
jmp 0x1400111f0
test bl, 1
jne 0x140011345
mov bl, 1
mov rdi, qword [0x1400c20d8]
nop word cs:[rax + rax]
test rdi, rdi
je 0x140011290
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x14001139a
mov rdi, qword [rdi + 8]
test esi, esi
je 0x140011250
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140011250
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140042704
mov rcx, rsi
call r14
jmp 0x140011250
test bl, 1
jne 0x140011345
mov bl, 1
mov rdi, qword [0x1400c20d8]
nop word cs:[rax + rax]
test rdi, rdi
je 0x1400112f0
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x14001139a
mov rdi, qword [rdi + 8]
test esi, esi
je 0x1400112b0
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400112b0
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140042704
mov rcx, rsi
call r14
jmp 0x1400112b0
test bl, 1
jne 0x140011345
mov bl, 1
mov rdi, qword [0x1400c20d8]
nop
test rdi, rdi
je 0x140011340
mov esi, dword [rdi + 0x18]
mov r14, qword [rdi]
test r14, r14
je 0x14001139a
mov rdi, qword [rdi + 8]
test esi, esi
je 0x140011300
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140011300
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov rsi, rax
call fcn.140042704
mov rcx, rsi
call r14
jmp 0x140011300
test bl, 1
je 0x140011350
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rbx, qword [0x1400c20d8]
nop word [rax + rax]
test rbx, rbx
je 0x140011345
mov esi, dword [rbx + 0x18]
mov r14, qword [rbx]
test r14, r14
je 0x14001139a
mov rbx, qword [rbx + 8]
test esi, esi
je 0x140011360
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140011360
mov rdi, rax
mov ecx, esi
xor edx, edx
call fcn.140042704
mov rcx, rdi
call r14
jmp 0x140011360
lea rcx, str.library_std_src_sys_thread_localkeywindows.rs
call sym.core::option::unwrap_failed::h38ae581b954ce070
ud2

Function at 0x1400113e0
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call fcn.140042704
mov rax, qword [rdi]
test rax, rax
je 0x140011414
lock dec qword [rax]
jne 0x140011414
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::h2e9684c2aaf21016
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140042704
Function at 0x140011490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140045058]
add eax, dword [rax]

Function at 0x140014360
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x60], xmm6
mov rax, r8
mov rsi, rcx
mov dword [rbp - 0x40], 0
xorps xmm6, xmm6
movups xmmword [rbp - 0x38], xmm6
mov dword [rbp - 0x28], 7
mov qword [rbp - 0x24], 0
mov word [rbp - 0x1c], 0
mov byte [rbp - 0x20], 1
lea r8, [rbp - 0x40]
mov rcx, rdx
mov rdx, rax
call sym.std::sys::pal::windows::fs::File::open::hc26adf99dd0cd861
mov rdi, rdx
test rax, rax
je 0x1400143de
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rdi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
jmp 0x140014581
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
mov dword [rbp + 0x50], 0
lea rdx, [rbp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileInformationByHandle
test eax, eax
je 0x140014487
test dword [rbp + 0x20], 0x400
je 0x140014431
mov qword [rbp + 0x18], 0
lea r8, [rbp + 0x18]
mov rcx, rdi
mov edx, 9
mov r9d, 8
call sub.KERNEL32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x140014487
mov r12d, dword [rbp + 0x40]
mov r15d, dword [rbp + 0x44]
test rdi, rdi
je 0x1400144cd
mov qword [rbp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x140014550
mov rbx, qword [rbp + 0x20]
jmp 0x1400144cf
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 2
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
mov rcx, rdi
movaps xmm6, xmmword [rbp + 0x60]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.1400428b4
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x14001453f
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.1400428b4
test r15, r15
je 0x14001453f
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x140014579
mov qword [rsi], 0
mov rcx, rbx
call fcn.1400428b4
jmp 0x140014579
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x40], 1
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], rax
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], 0
mov rcx, rdi
call fcn.1400428b4
movaps xmm6, xmmword [rbp + 0x60]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x140029d60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm15
movaps xmmword [rbp + 0xc0], xmm14
movaps xmmword [rbp + 0xb0], xmm13
movaps xmmword [rbp + 0xa0], xmm12
movaps xmmword [rbp + 0x90], xmm11
movaps xmmword [rbp + 0x80], xmm10
movaps xmmword [rbp + 0x70], xmm9
movaps xmmword [rbp + 0x60], xmm8
movaps xmmword [rbp + 0x50], xmm7
movaps xmmword [rbp + 0x40], xmm6
mov rsi, r8
mov rbx, rdx
cmp rdx, 0x21
jb 0x14002a237
mov r15, r9
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x30], rax
mov edi, dword [rbp + 0x150]
lea rax, [rsi - 0x20]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r9
Function at 0x1400310b0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
add byte [rax - 0x77], cl
invalid
movabs rdi, 0x8000000000000000
lea rcx, [rbp - 0x60]
call sym.std::sys::pal::windows::to_u16s::inner::hbb51883a1ae0978b
mov rax, qword [rbp - 0x60]
cmp rax, rdi
jne 0x1400310fb
lea rcx, [rbp - 0x58]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], rdi
jmp 0x140031334
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x408], 2
mov qword [rbp + 0x410], 0
mov r8d, 0x200
mov eax, 2
add al, byte [rax]
add byte [rax], al

Function at 0x140031cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, r9
mov rdi, r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
add rsi, r8
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
mov byte [rbp - 0x30], 0x81

Function at 0x140034640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140045078]
test esi, esi
je 0x1400346de
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400346d5
je 0x1400346d3
movzx eax, byte [0x1400c2030]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::h1ca289f3d44bb24b
test rax, rax
je case.0x14002ac06.430
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.140042704
test rdi, rdi
je 0x1400346ce
mov rax, qword [rdi]
test rax, rax
je 0x1400346c1
lock dec qword [rax]
jne 0x1400346c1
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::hcef4d9ea6db501ca
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x1400346d5
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::haa3306ec31336e60
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
enter 0xfffffffffffffffd, 0xffffffffffffff89
invalid
jmp 0x14003465d
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
dec esp

Function at 0x140034760
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [rcx + 8]
mov edx, 1
mov ecx, esi
call fcn.140042704
mov rax, qword [rdi]
test rax, rax
je 0x140034794
lock dec qword [rax]
jne 0x140034794
mov rcx, qword [rdi]
call sym.alloc::sync::Arc_T_A_::drop_slow::hcef4d9ea6db501ca
mov edx, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, esi
xor edx, edx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.140042704
fild word [rax]
invalid
Function at 0x14003b890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rbp - 0x28]
call sym.std::sys::pal::windows::to_u16s::inner::hbb51883a1ae0978b
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
cmp rcx, rbx
jne 0x14003b8ce
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x14003b8f4
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call sym.std::sys::pal::windows::args::from_wide_to_user_path::hcbaeed1edf546d7c
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x14003b90d
lea rcx, [rbp - 8]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14003b92f
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14003b900
mov qword [rsi], rbx
test r14, r14
je 0x14003b900
mov edx, 2
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp sym.__rust_dealloc
Function at 0x14003d670
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10a8
call sym.___chkstk_ms
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1010], xmm6
mov rsi, rdx
mov r14, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm6, xmm6
lea r12, [rbp + 0x1004]
lea rdi, [sym.std::sys::pal::windows::pipe::AnonPipe::alertable_io_internal::callback::h5da267c70eb56f29]
lea rbx, [rbp + 0xfc0]
mov qword [rbp + 0xfe8], r14
mov dword [rbp + 0x1004], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
mov qword [rbp + 0xfd8], r12
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r13
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x14003d8a6
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rbp + 0x1004], 0
je 0x14003d720
mov eax, dword [rbp + 0x1008]
mov r15d, dword [rbp + 0x100c]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
xor edx, edx
test eax, eax
setne dl
cmovne r15, rcx
mov qword [rbp + 0xff0], rdx
mov qword [rbp + 0xff8], r15
jne 0x14003d8cb
test r15, r15
je 0x14003d877
cmp r15, 0x1000
ja 0x14003da44
xor r14d, r14d
nop dword [rax + rax]
mov r8d, r15d
sub r8d, r14d
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0x1004], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
mov qword [rbp + 0xfd8], r12
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x14003d84c
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rbp + 0x1004], 0
je 0x14003d7e0
mov ecx, dword [rbp + 0x1008]
mov eax, dword [rbp + 0x100c]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xff0], r8
mov qword [rbp + 0xff8], rdx
jne 0x14003d86b
add r14, rax
cmp r14, r15
je 0x14003d840
jbe 0x14003d790
jmp 0x14003da30
mov r14, qword [rbp + 0xfe8]
jmp 0x14003d6d1
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xff0], 1
mov qword [rbp + 0xff8], rax
lea rcx, [rbp + 0xff8]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3466fc80fe41233f
call sub.KERNEL32.dll_GetLastError
mov r15d, eax
shl r15, 0x20
or r15, 2
mov qword [rbp + 0xff0], 1
mov qword [rbp + 0xff8], r15
mov rcx, r15
mov eax, ecx
and eax, 3
shr rcx, 0x20
cmp eax, 2
jne 0x14003d8f0
call sym.std::sys::pal::windows::decode_error_kind::hdc0cfabf5bb02582
cmp ecx, 0x28
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r14
mov rdx, r15
call sym.core::slice::index::slice_index_order_fail::h786748ba81f41b02
jmp 0x14003da58
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call sym.core::slice::index::slice_end_index_len_fail::hdaa9bbd2fcad4cbb
ud2
Function at 0x1400432a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140043310
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400c2164]
mov rbx, rcx
test esi, esi
jle 0x140043440
mov rax, qword [0x1400c2168]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14004335b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400433e5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140043340
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140043462
mov rax, qword [0x1400c2168]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400c2168]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140043447
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400433de
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400433f0
add dword [0x1400c2164], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400c2168]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400433de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140043368
mov rax, qword [0x1400c2168]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400439f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400c21c0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400c21a0]
test rbx, rbx
je 0x140043a4c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140043a43
test eax, eax
jne 0x140043a43
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140043a28
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]