joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [ecx]
mov esi, ecx
mov edi, dword [esp + 0x18]
movzx ecx, byte [ebp + 0x15]
mov ebx, dword [ebp + 4]
test cl, cl
mov byte [esp + 3], cl
je 0x413d65
bswap ebx
mov ecx, ebx
shr ebx, 4
and ecx, 0xf0f0f0f
and ebx, 0xf0f0f0f
shl ecx, 4
or ebx, ecx
mov ecx, ebx
shr ebx, 2
and ecx, 0x33333333
and ebx, 0x33333333
lea ecx, [ebx + ecx*4]
mov ebx, ecx
shr ecx, 1
and ebx, 0x55555555
and ecx, 0x55555555
lea ebx, [ecx + ebx*2]
xor ecx, ecx
sub cl, byte [ebp + 0x14]
mov eax, ecx
shr ebx, cl
and al, 0x1f
test edi, edi
mov byte [esp + 2], al
je 0x413d97
nop
movzx ecx, byte [edx]
inc edx
xor cl, bl
shr ebx, 8
movzx ecx, cl
xor ebx, dword [esi + ecx*4 + 4]
dec edi
jne 0x413d50
jmp 0x413d97
xor ecx, ecx
sub cl, byte [ebp + 0x14]
mov eax, ecx
shl ebx, cl
and al, 0x1f
test edi, edi
mov byte [esp + 2], al
je 0x413d97
mov eax, ebp
nop word [eax + eax]
movzx ebp, byte [edx]
mov ecx, ebx
shl ebx, 8
inc edx
shr ecx, 0x18
xor ebp, ecx
xor ebx, dword [esi + ebp*4 + 4]
dec edi
jne 0x413d80
mov ebp, eax
cmp byte [esp + 3], 0
movzx ecx, byte [esp + 2]
mov eax, ebx
bswap eax
setne dh
xor edi, edi
cmp byte [ebp + 0x16], 0
cmovne ecx, edi
mov edi, eax
setne dl
shr eax, 4
and edi, 0xf0f0f0f
and eax, 0xf0f0f0f
xor dl, dh
shl edi, 4
or eax, edi
mov edi, eax
shr eax, 2
and edi, 0x33333333
and eax, 0x33333333
lea eax, [eax + edi*4]
mov edi, eax
shr eax, 1
and edi, 0x55555555
and eax, 0x55555555
test dl, dl
lea eax, [eax + edi*2]
cmove eax, ebx
shr eax, cl
xor eax, dword [ebp + 8]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x413ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov eax, dword [section..data]
test eax, eax
je 0x413ecc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x413ee2
cmp dword [eax + 4], 0
mov esi, eax
je 0x413ee2
add esi, 8
mov eax, esi
add esp, 8
pop esi
ret
mov ecx, section..data
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x413eba
mov eax, dword [section..data]
test eax, eax
je 0x413f5d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor esi, esi
cmp eax, 1
jne 0x413f01
mov eax, esi
add esp, 8
pop esi
ret
test eax, eax
mov esi, eax
jne 0x413f72
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x413f2a
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x413fb5
mov dword [0x45f508], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x413fb5
mov dword [eax], section..data
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [section..data]
test eax, eax
jne 0x413f69
mov ecx, section..data
call fcn.004525d0
jmp 0x413f6a
mov ecx, section..data
call fcn.004525d0
jmp 0x413eec
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00450e20
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x413ec2
test ecx, ecx
je 0x413ec2
lock dec dword [ecx]
jne 0x413ec2
lea ecx, [esp + 4]
call fcn.004141d0
jmp 0x413ec2
mov ecx, 4
mov edx, 0xc
call fcn.00450740
int3
Function at 0x414040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x45f010]
test eax, eax
je 0x41410e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41406a
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x414149
mov eax, dword [0x45f010]
test eax, eax
je 0x41412d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x414147
mov esi, eax
test eax, eax
jne 0x4140ec
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x4140b1
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x41416f
mov dword [0x45f508], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x41416f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x45f010
mov esi, eax
mov eax, dword [0x45f010]
test eax, eax
je 0x41414f
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.0043be70
test eax, eax
je 0x41415b
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
lock dec dword [eax]
jne 0x414107
mov ecx, eax
call fcn.00414210
mov dword [esi], edi
mov dword [esi + 4], ebx
jmp 0x414149
mov ecx, 0x45f010
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x41405d
jmp 0x41406a
mov ecx, 0x45f010
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x414088
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov ecx, 0x45f010
call fcn.004525d0
jmp 0x4140e4
mov ecx, 0x459cb0
mov edx, 0x5e
push 0x459d10
call fcn.00450c80
mov ecx, 8
mov edx, 0x10
call fcn.00450740
int3
Function at 0x419960
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x250
mov esi, ecx
push 0
push 2
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x419a63
mov edi, eax
lea eax, [esp + 0x28]
push 0x228
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push eax
push edi
call dword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x419a74
xor ebx, ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp], 4
mov dword [esp + 0x14], edi
jmp 0x419a2b
mov dword [esp], ecx
lea ecx, [esp + 4]
mov edx, ebx
call fcn.00417330
mov ecx, dword [esp]
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
shl ebx, 4
mov dword [esp], eax
mov dword [eax + ebx], ebp
mov dword [eax + ebx + 8], edi
mov dword [eax + ebx + 4], esi
mov dword [eax + ebx + 0xc], ecx
lea eax, [esp + 0x24]
mov ebx, dword [esp + 0xc]
inc ebx
mov dword [esp + 0xc], ebx
push eax
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x419a9d
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
push 0x104
call fcn.00416e60
add esp, 4
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp ebp, 0x80000000
je 0x419abb
mov ecx, dword [esp + 0x2c]
cmp ebx, dword [esp + 4]
je 0x4199e0
mov eax, dword [esp]
jmp 0x4199f9
lea ecx, [esi + 4]
mov edx, 0x27
push 0x21
push 0x4564b0
jmp 0x419a8a
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esi + 4]
mov edx, 0x27
push 0x20
push str.Could_not_get_first_process_dataCould_not_create_process_snapshotKill_process_if_found:
call fcn.004189d0
add esp, 8
mov dword [esi], 0x80000000
jmp 0x419b23
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
movsd xmm0, qword [esp + 4]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x419b23
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test ebx, ebx
mov dword [eax + 8], edi
mov dword [eax + 4], esi
mov dword [eax], 0x80000000
je 0x419b0a
mov esi, dword [esp + 8]
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
add esi, 4
jmp 0x419af6
add esi, 0x10
dec ebx
je 0x419b0a
cmp dword [esi - 4], 0
je 0x419af0
push dword [esi]
push 0
push dword [0x45f508]
call edi
jmp 0x419af0
cmp dword [esp + 4], 0
je 0x419b23
push dword [esp + 8]
push 0
push dword [0x45f508]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x250
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b070
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [edx + 0x1008]
mov al, 4
test ebx, ebx
je 0x41b176
mov eax, dword [edx + 4]
mov dword [esp + 0xc], ebx
mov esi, dword [edx]
mov edi, edx
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
mov ebp, dword [eax + 0x1c]
mov eax, esp
push 4
push ecx
push esi
push eax
call ebp
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x41b164
mov eax, ebx
not eax
mov dword [esp + 0xc], eax
push 4
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], esi
push esi
lea eax, [esp + 0xc]
push eax
call ebp
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x41b164
cmp ebx, 0x1001
mov dword [esp + 0x10], ebp
jae 0x41b180
lea ebp, [edi + 8]
xor ecx, ecx
mov eax, 0xffffffff
lea esi, [esp + 0xc]
nop dword [eax]
movzx edx, byte [ebp + ecx]
inc ecx
xor dl, al
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x456a40]
cmp ebx, ecx
jne 0x41b100
not eax
mov dword [esp + 0xc], eax
push 4
push esi
mov esi, dword [esp + 0x1c]
push esi
lea eax, [esp + 0xc]
push eax
call dword [esp + 0x20]
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x41b164
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push eax
call dword [esp + 0x20]
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x41b164
mov ecx, dword [esp + 8]
mov dword [edi + 0x1008], 0
mov al, 4
jmp 0x41b176
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov esi, dword [esp + 1]
mov dword [ecx + 4], edx
mov dword [ecx + 1], esi
mov byte [ecx], al
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, ebx
mov edx, 0x1000
push 0x456ebc
call fcn.00450930
int3
Function at 0x43b1b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x44f480
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x45f50c]
test al, al
je 0x43b381
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43b1fc
cmp eax, 3
jne 0x43b37a
mov ebx, dword [0x45f510]
test ebx, ebx
je 0x43b37a
mov dword [ebp - 0x20], 0
jmp 0x43b227
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43b258
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43b3cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43b220
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43b220
test byte [ebp - 0x20], 1
je 0x43b37a
mov ebx, dword [0x45f510]
test ebx, ebx
je 0x43b37a
mov dword [ebp - 0x20], 0
jmp 0x43b287
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43b2b8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43b3cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43b280
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43b280
test byte [ebp - 0x20], 1
je 0x43b37a
mov ebx, dword [0x45f510]
test ebx, ebx
je 0x43b37a
mov dword [ebp - 0x20], 0
jmp 0x43b2e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43b318
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43b3cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43b2e0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43b2e0
test byte [ebp - 0x20], 1
je 0x43b37a
mov ebx, dword [0x45f510]
test ebx, ebx
je 0x43b37a
mov dword [ebp - 0x20], 0
jmp 0x43b347
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43b374
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43b3cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43b340
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43b340
test byte [ebp - 0x20], 1
jne 0x43b394
movzx eax, byte [0x45c440]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x45f510]
jmp 0x43b39f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43b37a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43b3cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43b39c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x43b39c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs
mov edx, 0x2b
push 0x45b4a4
call fcn.00450990
add esp, 4
ud2
Function at 0x43c130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45f074]
test eax, eax
je 0x43c158
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43c16e
cmp dword [eax + 4], 0
mov edi, eax
je 0x43c16e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f074
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x43c148
mov eax, dword [0x45f074]
test eax, eax
je 0x43c222
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43c23c
mov esi, eax
test eax, eax
jne 0x43c1e9
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x43c1b5
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43c24f
mov dword [0x45f508], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43c24f
mov dword [eax], 0x45f074
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45f074]
test eax, eax
je 0x43c243
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x43c153
test ecx, ecx
je 0x43c153
lock dec dword [ecx]
jne 0x43c153
call fcn.00414210
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f074
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43c18c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f074
call fcn.004525d0
jmp 0x43c1e1
mov ecx, 4
mov edx, 0xc
call fcn.00450740
int3

Function at 0x43caf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45f084]
test eax, eax
je 0x43cb94
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43cb13
cmp byte [eax + 4], 0
mov esi, eax
jne 0x43cb8d
mov eax, dword [0x45f084]
test eax, eax
je 0x43cbb3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43cbcd
mov esi, eax
test eax, eax
jne 0x43cb87
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x43cb5a
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43cbdf
mov dword [0x45f508], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43cbdf
mov dword [eax], 0x45f084
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x45f084]
test eax, eax
je 0x43cbd3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x45f084
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x43cb0b
jmp 0x43cb13
mov ecx, 0x45f084
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43cb31
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x45f084
call fcn.004525d0
jmp 0x43cb7f
mov ecx, 4
mov edx, 8
call fcn.00450740
int3
Function at 0x43d2e0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x43d334
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x43d357
test eax, eax
js 0x43d343
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x43d34f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x45af58
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043b7a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043b900
mov ecx, 7
int 0x29
ud2
Function at 0x43dce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45f064]
test eax, eax
je 0x43dd02
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43dd18
cmp dword [eax + 4], 0
je 0x43dd18
add eax, 8
pop esi
ret
mov ecx, 0x45f064
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x43dcf7
mov eax, dword [0x45f064]
test eax, eax
je 0x43dd9e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43ddb8
mov esi, eax
test eax, eax
jne 0x43dd87
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x43dd57
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43ddc8
mov dword [0x45f508], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43ddc8
mov dword [eax], 0x45f064
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45f064]
test eax, eax
je 0x43ddbc
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0x45f064
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43dd32
xor eax, eax
pop esi
ret
mov ecx, 0x45f064
call fcn.004525d0
jmp 0x43dd7f
mov ecx, 4
mov edx, 0x10
call fcn.00450740
int3
Function at 0x43eaf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x44f610
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x43ec03
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.0043eca0
mov ecx, eax
or ecx, edx
je 0x43ebef
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.0044fba0
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.0044fba0
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0044fba0
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_src_strpattern.rs
mov edx, 0x19
push 0x45a8a8
call fcn.00450990
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x45b5a0
push 0x4598e0
push eax
call fcn.00450c00
add esp, 0xc
ud2
Function at 0x444bd0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x444c1d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x444c2d
mov dword [esi + 4], 0
jmp 0x444c3f
cmp eax, 0x103
je 0x444c5b
test eax, eax
js 0x444c48
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x45af58
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043b7a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043b900
mov ecx, 7
int 0x29
ud2

Function at 0x4488a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45f0b4]
test eax, eax
je 0x4488c8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4488de
cmp dword [eax + 4], 0
mov edi, eax
je 0x4488de
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f0b4
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x4488b8
mov eax, dword [0x45f0b4]
test eax, eax
je 0x448992
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4489ac
mov esi, eax
test eax, eax
jne 0x448959
movzx eax, byte [0x45f57c]
mov eax, dword [0x45f508]
test eax, eax
jne 0x448925
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x4489bf
mov dword [0x45f508], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x4489bf
mov dword [eax], 0x45f0b4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45f0b4]
test eax, eax
je 0x4489b3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4488c3
test ecx, ecx
je 0x4488c3
lock dec dword [ecx]
jne 0x4488c3
call fcn.004489d0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f0b4
call fcn.004525d0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x4488fc
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f0b4
call fcn.004525d0
jmp 0x448951
mov ecx, 4
mov edx, 0xc
call fcn.00450740
int3