joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x40f92b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x40f92b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x40f946
cmp eax, 0x42
jne 0x40f92b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x40f9f6
cmp byte [r9 + r11], 0x5f
jne 0x40f9f6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x40fa5e
mov rcx, rsi
xor edx, edx
call fcn.0040b2f0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.0040b2f0
test al, al
jne 0x40faf1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x40f982
lea rdx, [0x0044e0bb]
mov r8d, 1
call fcn.00405540
test al, al
jne 0x40faf1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x40f93a
xor r14d, r14d
lea rbx, [0x0044e470]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x40f9b4
cmp byte [rax + rcx], 0x45
je 0x40fb13
sub r14, 1
jb 0x40f9d9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x40f9d9
mov r8d, 2
mov rdx, rbx
call fcn.00405540
test al, al
jne 0x40faf1
mov rcx, rsi
call fcn.0040caf0
test al, al
jne 0x40faf1
mov rax, qword [rsi]
test rax, rax
jne 0x40f9a0
jmp 0x40f93a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x40fab8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x40fa52
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x40fa3c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x40fa2b
add dl, 0xa9
jmp 0x40fa3a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x40fab8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x40fab8
movzx edx, bl
add rax, rdx
jae 0x40fa00
jmp 0x40fab8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x40fab8
cmp rax, rcx
jae 0x40fab5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x40fb0b
cmp qword [rsi + 0x20], 0
je 0x40fb04
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.0040f8d0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x40f93c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x40faf9
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x0044e430]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.00405540
test al, al
je 0x40faf9
mov dil, 2
jmp 0x40f93a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x40f93a
mov dil, 1
xor r8d, r8d
jmp 0x40faba
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x40f93a
Function at 0x412f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x00449078]
test ecx, ecx
je 0x412ff4
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x412f34
mov rdi, rax
cmp qword [rax + 8], 0
je 0x412f34
add rdi, 0x10
jmp 0x412fea
mov ecx, dword [0x00449078]
test ecx, ecx
je 0x413007
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x412fe8
mov rsi, rax
test rax, rax
jne 0x412fb7
mov qword [rsp + 0x28], 0
lea rax, [0x00449060]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x004591b8]
mov ecx, 0x18
mov edx, 8
call fcn.00446d90
test rax, rax
je 0x41302a
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x00449078]
test ecx, ecx
je 0x41301a
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x412fea
test rcx, rcx
je 0x412fea
lock dec qword [rcx]
jne 0x412fea
call fcn.00413080
jmp 0x412fea
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x00449060]
call fcn.004132c0
mov ecx, eax
jmp 0x412f16
lea rcx, [0x00449060]
call fcn.004132c0
mov ecx, eax
jmp 0x412f44
lea rcx, [0x00449060]
call fcn.004132c0
mov ecx, eax
jmp 0x412faf
mov ecx, 8
mov edx, 0x18
call fcn.00402980
ud2
Function at 0x4132c0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x413345
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x413386
cmp dword [rsp + 0x2c], 0
je 0x41336a
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4133a0
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00459140]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00459140], rsi
jne 0x413320
mov byte [0x00459138], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x41337c
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x4133ec
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x41336f
mov edi, dword [rsp + 0x28]
jmp 0x41337c
mov edi, dword [rsi + 0x18]
jmp 0x41337a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.00413450
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x00452538]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.00404b20
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x00452538]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.004134a0
ud2

Function at 0x4139a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00449098]
test ecx, ecx
je 0x413a3f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x4139c9
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x413a2e
mov ecx, dword [0x00449098]
test ecx, ecx
je 0x413a52
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x413a34
mov rsi, rax
test rax, rax
jne 0x413a28
movzx eax, byte [0x004591b8]
mov ecx, 0x10
mov edx, 8
call fcn.00446d90
test rax, rax
je 0x413a75
mov rsi, rax
lea rax, [0x00449080]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x00449098]
test ecx, ecx
je 0x413a65
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x413a36
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00449080]
call fcn.004132c0
mov ecx, eax
jmp 0x4139b5
lea rcx, [0x00449080]
call fcn.004132c0
mov ecx, eax
jmp 0x4139d5
lea rcx, [0x00449080]
call fcn.004132c0
mov ecx, eax
jmp 0x413a20
mov ecx, 8
mov edx, 0x10
call fcn.00402980
ud2
Function at 0x414700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00449058]
test ecx, ecx
je 0x4147bd
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x414730
cmp qword [rax + 8], 0
je 0x414730
add rax, 0x10
jmp 0x4147b7
mov ecx, dword [0x00449058]
test ecx, ecx
je 0x4147d0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4147b5
mov rsi, rax
test rax, rax
jne 0x41479b
movzx eax, byte [0x004591b8]
mov ecx, 0x20
mov edx, 8
call fcn.00446d90
test rax, rax
je 0x4147f3
mov rsi, rax
lea rax, [0x00449040]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00449058]
test ecx, ecx
je 0x4147e3
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x4147b7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00449040]
call fcn.004132c0
mov ecx, eax
jmp 0x414715
lea rcx, [0x00449040]
call fcn.004132c0
mov ecx, eax
jmp 0x414740
lea rcx, [0x00449040]
call fcn.004132c0
mov ecx, eax
jmp 0x414793
mov ecx, 8
mov edx, 0x20
call fcn.00402980
ud2
Function at 0x4164c0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
xor esi, esi
mov r14d, 0xffffffff
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x416540
jmp 0x41652f
jae 0x4165e4
cmp r8, 0x201
jae 0x416540
mov r12d, 0x200
lea r13, [rsp + 0x68]
mov rbp, r8
jmp 0x416587
sub r8, r15
sub rdi, r15
cmp rdi, r8
jae 0x416567
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.004153a0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x38]
cmp rsi, r14
mov r15d, 0xffffffff
cmovb r15, rsi
mov qword [rsp + 0x40], r15
mov rdi, rsi
mov r12, r15
mov r13, qword [rsp + 0x20]
mov rbp, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, ebp
mov rdx, r13
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x4165ab
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x41663d
mov r8d, ebx
cmp rbp, r8
jne 0x416520
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x41665d
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
cmp r8, 0x201
jb 0x41652f
jmp 0x416540
cmp r12, r8
jb 0x416677
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.00416fc0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
test rsi, rsi
je 0x416628
mov rcx, qword [0x00459118]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov byte [rcx + 0x18], 2
test rsi, rsi
jne 0x416615
jmp 0x416628
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.00405860
jmp 0x41668c
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r12
mov r8, rax
call fcn.004054c0
ud2
Function at 0x41a7c0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.00433560
mov rsi, rdx
test rax, rax
je 0x41a88b
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x41a87f
test rax, rax
je 0x41a87f
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x41a86e
cmp qword [r14 + 0x10], 0x11
jb 0x41a85d
mov rbx, qword [rbx - 8]
mov rcx, qword [0x00459118]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00459118]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov qword [rdi], 0
jmp 0x41a9fd
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
je 0x41a93a
test byte [rsp + 0x41], 4
je 0x41a8e3
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x78]
mov rcx, rsi
mov edx, 9
mov r9d, 8
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x41a93a
mov r12d, dword [rsp + 0x60]
mov r15d, dword [rsp + 0x64]
test rsi, rsi
je 0x41a966
mov qword [rsp + 0x40], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x41a9e9
mov rbx, qword [rsp + 0x40]
jmp 0x41a968
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x41a9d8
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x41a9d8
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x41a9f5
mov qword [rdi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x41a9f5
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x438280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x004490b8]
test ecx, ecx
je 0x438374
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x4382b4
mov rdi, rax
cmp qword [rax + 8], 0
je 0x4382b4
add rdi, 0x10
jmp 0x43836a
mov ecx, dword [0x004490b8]
test ecx, ecx
je 0x438387
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x438368
mov rsi, rax
test rax, rax
jne 0x438337
mov qword [rsp + 0x28], 0
lea rax, [0x004490a0]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x004591b8]
mov ecx, 0x18
mov edx, 8
call fcn.00446d90
test rax, rax
je 0x4383aa
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x004490b8]
test ecx, ecx
je 0x43839a
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x43836a
test rcx, rcx
je 0x43836a
lock dec qword [rcx]
jne 0x43836a
call fcn.004383e0
jmp 0x43836a
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004490a0]
call fcn.004132c0
mov ecx, eax
jmp 0x438296
lea rcx, [0x004490a0]
call fcn.004132c0
mov ecx, eax
jmp 0x4382c4
lea rcx, [0x004490a0]
call fcn.004132c0
mov ecx, eax
jmp 0x43832f
mov ecx, 8
mov edx, 0x18
call fcn.00402980
ud2
Function at 0x43f370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.00414df0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x43f3e5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.0043f2a0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x43f3f3
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43f413
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x43f404
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.00414f90
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x43f404
mov rcx, qword [0x00459118]
xor edx, edx
mov r8, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
Function at 0x441700
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1078
call fcn.00446de0
sub rsp, rax
movaps xmmword [rsp + 0x1060], xmm6
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rsp + 0x34], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x34]
mov qword [rsp + 0x58], r13
lea rbp, [0x004390c0]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x441895
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x60]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x441793
cmp dword [rsp + 0x38], 0
jne 0x44189a
mov r15d, dword [rsp + 0x3c]
test r15, r15
je 0x44189a
cmp r15d, 0x1000
ja 0x4418da
xor r12d, r12d
nop word cs:[rax + rax]
cmp r12, r15
ja 0x4418c6
lea rdx, [rsp + r12]
add rdx, 0x60
mov r8d, r15d
sub r8d, r12d
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x441895
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x441830
cmp dword [rsp + 0x38], 0
jne 0x44189a
mov eax, dword [rsp + 0x3c]
add r12, rax
cmp r12, r15
jne 0x4417e0
mov dword [rsp + 0x34], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r14
mov r8d, 0x1000
mov r9, rbx
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x441793
call sub.kernel32.dll_GetLastError
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1060]
add rsp, 0x1078
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.00405f20
jmp 0x4418ee
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.004054c0
ud2

Function at 0x441910
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x441941
mov rax, qword [rsp + 0x30]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x00435b70]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00404b20
ud2
Function at 0x447e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004597c4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x447f30
mov rax, qword [0x004597c8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x447e5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x447f16
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x447e40
mov rcx, rsi
call fcn.00448a50
test rax, rax
mov r12, rax
je 0x447f68
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004597c8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00448ba0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x004597c8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x447f4b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x447f0f
sub eax, 0x40
and eax, 0xffffffbf
je 0x447f0f
add rbx, qword [0x004597c8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x447f37
add dword [0x004597c4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ntdll.dll_memcpy
xor ebx, ebx
jmp 0x447e67
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00447da0
mov rax, qword [0x004597c8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00447da0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00447da0
nop
nop dword [rax + rax]

Function at 0x4486c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00459aa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00459a80]
test rbx, rbx
je 0x448714
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x44870b
test rsi, rsi
je 0x44870b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4486f0
lea rcx, [0x00459aa0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x448a50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00452860]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x448a70
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.00448930
test eax, eax
je 0x448a68
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x448acd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x448ac4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x448a68
add rdx, 0x28
cmp rdx, r9
jne 0x448ab0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret