joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43d099
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x43d0aa
cmp eax, 2
je 0x43d11c
jmp 0x43d149
push 0xbbf966b4
push dword [0x44f6f0]
call fcn.00441f60
add esp, 8
test eax, eax
je 0x43d0e7
mov ecx, dword [esi]
test ecx, ecx
je 0x43d114
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43d0f0
cmp dword [esp], 0
je 0x43d0f0
mov dword [esi + 4], 3
jmp 0x43d114
mov dword [esi + 4], 1
jmp 0x43d149
lea eax, [esp + 4]
push eax
call fcn.004427e0
add esp, 4
test al, al
je 0x43d114
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43d111
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43d149
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x457718]
call fcn.00441f60
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43d1e4
mov ecx, dword [esi]
mov dword [esp], 0xb08f8e8d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edx, eax
and edx, 1
mov ebx, eax
or ebx, 0xd825ce5d
add ebx, edx
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0x2e
mov byte [esp + eax], bl
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 4
jb 0x43d160
mov eax, dword [esp]
mov edx, dword [0x44f6fc]
test edx, edx
je 0x43d1e4
xor esi, esi
mov ebx, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43d1c0
inc esi
cmp edx, esi
jne 0x43d1b0
jmp 0x43d1e4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d1e4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44f704]
push edx
call fcn.0043f170
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43ded0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov dword [esp + 0x28], 0x9fea99ea
mov dword [esp + 0x2c], 0xa3ce9df8
mov dword [esp + 0x30], 0xa794a1cc
mov dword [esp + 0x34], 0xabc6a5c0
mov dword [esp + 0x38], 0xafaea9c4
mov word [esp + 0x3c], 0
mov eax, 0x2db257dc
mov ecx, 0x5b64afb8
movzx esi, byte [esp + eax - 0x2db257b4]
mov edi, ecx
and edi, 0x5a60057c
mov edx, eax
xor edx, 0xbf3c8abe
add edx, edi
xor edx, esi
neg edx
lea esi, [edx + edx]
and esi, 6
xor edx, 0xfc
sub edx, esi
add dl, 2
mov byte [esp + eax - 0x2db257b4], dl
inc eax
add ecx, 2
cmp eax, 0x2db257f2
jne 0x43df10
lea eax, [esp + 0x28]
push eax
call fcn.00441a90
add esp, 4
mov dword [0x457718], eax
mov dword [esp + 0x24], 0xdd0b44ee
test eax, eax
je 0x43df77
mov dword [esp + 0x24], 0x7fa8d66b
mov ebp, 0x995e9abe
xor eax, eax
cmp ebp, 0x18f8135
setl al
mov eax, dword [eax*4 + 0x44d188]
mov ecx, 0x787ba887
xor ecx, dword [0x44d190]
add eax, ecx
inc eax
jmp eax
Function at 0x441a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x939291c0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa4
xor cl, byte [esp + eax + 4]
add cl, 0xcc
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne case.default.0x441ad7
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x20], 0
sete cl
jmp dword [ecx*4 + 0x44e0dc]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [0x44e108]
mov edi, dword [edx]
xor ecx, ecx
cmp edi, edx
setne cl
mov dword [esp + 8], edx
jmp dword [ecx*4 + 0x44e0e4]
mov ebx, dword [edi + 0x30]
xor ecx, ecx
test ebx, ebx
setne cl
jmp dword [ecx*4 + 0x44e0ec]
jmp esi
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441f60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp + 4], 0x2322cbdd
mov dword [esp + 8], 0
lea ecx, [esp + 4]
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov ebx, edx
and ebx, 0xa4716810
mov ebp, esi
xor ebp, 0xadc74bf7
sub ebp, ebx
lea ebx, [ebp + 1]
and ebx, edi
add edi, ebp
inc edi
add ebx, ebx
sub edi, ebx
mov ebx, edi
and ebx, 0x27
add ebx, ebx
xor edi, 0xd8
sub ebx, edi
mov byte [ecx], bl
inc ecx
dec esi
add edx, 0xfffffffe
cmp esi, 0xfffffff8
jne 0x441f90
Function at 0x442a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x442a30
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x442a4b
mov eax, 0xffffffff
jmp 0x442a4e
add eax, 0xa
push eax
call fcn.0040c6f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x442a91
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x442a80
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf4f5fafb
mov byte [esp + 4], 0
mov ecx, 0x51b37a56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x51b37a56]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x365
xor esi, 0x2c0c8365
and edx, 0x10a3789a
sub edx, esi
mov esi, edx
and esi, 0xe7769c51
xor edx, 0x677e9c51
lea edx, [edx + esi*2]
add edx, 0x54c1b4d9
mov esi, edx
xor esi, 0x73
and edx, 0xc
add edx, edx
sub edx, esi
mov byte [esp + ecx - 0x51b37a56], dl
inc ecx
cmp ecx, 0x51b37a5b
jne 0x442b00
mov esi, dword [esp]
mov ecx, dword [0x44f6fc]
test ecx, ecx
je 0x442bb1
xor edx, edx
mov ebx, dword [0x44f700]
cmp dword [ebx + edx*8], 0x1affabda
je 0x442b80
inc edx
cmp ecx, edx
jne 0x442b70
jmp 0x442bb1
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x442bb1
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x44f704]
push ecx
mov edi, eax
call fcn.0043f170
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c700
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x442bf0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x442c0b
mov eax, 0xffffffff
jmp 0x442c0e
add eax, 0xa
push eax
call fcn.0040c6f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x442c51
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x442c40
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
add ecx, edi
mov word [esp], cx
mov edx, ecx
and edx, 2
xor ecx, 2
lea ecx, [ecx + edx*2]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xf4f5fafb
mov byte [esp + 0x24], 0
mov ecx, 0x51b37a56
nop
nop
movzx edx, byte [esp + ecx - 0x51b37a36]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x365
xor esi, 0x2c0c8365
and edx, 0x10a3789a
sub edx, esi
mov esi, edx
and esi, 0xe7769c51
xor edx, 0x677e9c51
lea edx, [edx + esi*2]
add edx, 0x54c1b4d9
mov esi, edx
xor esi, 0x73
and edx, 0xc
add edx, edx
sub edx, esi
mov byte [esp + ecx - 0x51b37a36], dl
inc ecx
cmp ecx, 0x51b37a5b
jne 0x442cd0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44f6fc]
test ecx, ecx
je 0x442d89
xor edx, edx
mov edi, dword [0x44f700]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x442d60
inc edx
cmp ecx, edx
jne 0x442d50
jmp 0x442d89
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x442d89
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x44f704]
push ecx
mov edi, eax
call fcn.0043f170
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040c700
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x442d9f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xf4f5fafb
mov byte [esp + 4], 0
mov eax, 0x51b37a56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x51b37a56]
mov ecx, eax
and ecx, edx
add ecx, ecx
sub edx, ecx
add edx, eax
mov ecx, edx
and ecx, 0x365
xor ecx, 0x2c0c8365
and edx, 0x10a3789a
sub edx, ecx
mov ecx, edx
and ecx, 0xe7769c51
xor edx, 0x677e9c51
lea ecx, [edx + ecx*2]
add ecx, 0x54c1b4d9
mov edx, ecx
xor edx, 0x73
and ecx, 0xc
add ecx, ecx
sub ecx, edx
mov byte [esp + eax - 0x51b37a56], cl
inc eax
cmp eax, 0x51b37a5b
jne 0x442de0
mov eax, dword [esp]
mov edx, dword [0x44f6fc]
test edx, edx
je 0x442e88
xor ebx, ebx
mov ecx, dword [0x44f700]
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x442e60
inc ebx
cmp edx, ebx
jne 0x442e50
jmp 0x442e88
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x442e88
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x44f704]
push edx
call fcn.0043f170
add esp, 0x20
test edi, edi
je 0x442e92
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x442e9e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xf4f5fafb
mov byte [esp + 4], 0
mov eax, 0x51b37a56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x51b37a56]
mov edi, eax
and edi, ebx
add edi, edi
sub ebx, edi
add ebx, eax
mov edi, ebx
and edi, 0x365
xor edi, 0x2c0c8365
and ebx, 0x10a3789a
sub ebx, edi
mov edi, ebx
and edi, 0xe7769c51
xor ebx, 0x677e9c51
lea ebx, [ebx + edi*2]
add ebx, 0x54c1b4d9
mov edi, ebx
xor edi, 0x73
and ebx, 0xc
add ebx, ebx
sub ebx, edi
mov byte [esp + eax - 0x51b37a56], bl
inc eax
cmp eax, 0x51b37a5b
jne 0x442ee0
mov eax, dword [esp]
mov ebx, dword [0x44f6fc]
test ebx, ebx
je 0x442f8e
xor ebp, ebp
mov edi, dword [0x44f700]
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x442f60
inc ebp
cmp ebx, ebp
jne 0x442f50
jmp 0x442f8e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x442f8e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x44f704]
push ebx
call fcn.0043f170
add esp, 0x30
cmp eax, 0x103
jne 0x443059
mov dword [esp], 0xf4f5fafb
mov byte [esp + 4], 0
mov eax, 0x51b37a56
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x51b37a56]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x365
xor edx, 0x2c0c8365
and ecx, 0x10a3789a
sub ecx, edx
mov edx, ecx
and edx, 0xe7769c51
xor ecx, 0x677e9c51
lea ecx, [ecx + edx*2]
add ecx, 0x54c1b4d9
mov edx, ecx
xor edx, 0x73
and ecx, 0xc
add ecx, ecx
sub ecx, edx
mov byte [esp + eax - 0x51b37a56], cl
inc eax
cmp eax, 0x51b37a5b
jne 0x442fb0
mov eax, dword [esp]
mov ecx, dword [0x44f6fc]
test ecx, ecx
je 0x443051
xor edx, edx
mov edi, dword [0x44f700]
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x443030
inc edx
cmp ecx, edx
jne 0x443020
jmp 0x443051
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x443051
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x44f704]
push ecx
call fcn.0043f170
add esp, 0x18
test eax, eax
js 0x443059
mov eax, dword [esp + 8]
test esi, esi
je 0x44306c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44306a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x443260
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
lea ebp, [ecx + ebx]
mov word [esp + 8], bp
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf4f5fafb
mov byte [esp + 4], 0
mov eax, 0x51b37a56
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x51b37a56]
mov ecx, eax
and ecx, edi
add ecx, ecx
sub edi, ecx
add edi, eax
mov ecx, edi
and ecx, 0x365
xor ecx, 0x2c0c8365
and edi, 0x10a3789a
sub edi, ecx
mov ecx, edi
and ecx, 0xe7769c51
xor edi, 0x677e9c51
lea ebx, [edi + ecx*2]
add ebx, 0x54c1b4d9
mov ecx, ebx
xor ecx, 0x73
and ebx, 0xc
add ebx, ebx
sub ebx, ecx
mov byte [esp + eax - 0x51b37a56], bl
inc eax
cmp eax, 0x51b37a5b
jne 0x4432e0
mov eax, dword [esp]
mov edi, dword [0x44f6fc]
test edi, edi
je 0x443385
xor ebx, ebx
mov ebp, dword [0x44f700]
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x443361
inc ebx
cmp edi, ebx
jne 0x443350
jmp 0x443385
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x443385
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push dword [0x44f704]
push edi
call fcn.0043f170
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10006e32
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10006e2a
je 0x10006e28
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10006dbe
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax], 0
or ecx, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x10006dd8
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x10145400]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x10006e4e
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10006e23
push 8
push 0x18
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [esp]
jmp 0x10006e2a
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10006d99
jmp 0x10006e2a
push 0x18
push 8
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop word [eax + eax]

Function at 0x1000ad40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1000ad78
mov edx, dword [ebp + 0xc]
not eax
nop word cs:[eax + eax]
nop
movzx ebx, byte [edx]
inc edx
xor bl, al
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x10127458]
dec ecx
jne 0x1000ad60
not eax
pop esi
pop ebx
pop ebp
ret
Function at 0x1000ad80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [edx + 8]
mov ebx, dword [edx + 0xc]
mov ecx, esi
or ecx, ebx
je 0x1000ae42
mov ecx, dword [ebp + 0x14]
xor eax, eax
cmp ecx, esi
sbb eax, ebx
mov eax, esi
cmovb eax, ecx
cmp eax, ecx
ja 0x1000ae99
mov ecx, dword [edx + 4]
lea edi, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
push dword [edx]
push edi
call dword [ecx + 0xc]
add esp, 0x10
movzx eax, byte [ebp - 0x28]
cmp al, 4
jne 0x1000ae59
mov eax, edi
mov edi, dword [ebp - 0x24]
mov ecx, ebx
cmp esi, edi
sbb ecx, 0
jb 0x1000aea5
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esi, edi
sbb ebx, 0
test edi, edi
mov dword [edx + 8], esi
mov dword [edx + 0xc], ebx
je 0x1000ae42
mov eax, dword [ebp + 0x14]
cmp edi, eax
ja 0x1000aed3
add edx, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx]
mov dword [ebp - 0x10], edx
xor edx, edx
not ecx
nop word cs:[eax + eax]
nop
movzx ebx, byte [eax + edx]
inc edx
xor bl, cl
shr ecx, 8
movzx esi, bl
xor ecx, dword [esi*4 + 0x10127458]
cmp edi, edx
jne 0x1000ae20
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
not ecx
jmp 0x1000ae4f
mov ecx, dword [edx + 0x14]
cmp ecx, dword [edx + 0x10]
jne 0x1000ae7b
add edx, 0x10
xor edi, edi
mov dword [eax + 4], edi
mov dword [edx], ecx
mov byte [eax], 4
jmp 0x1000ae91
movzx ecx, byte [ebp - 0x25]
movzx edx, word [ebp - 0x27]
movzx edi, al
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
shl edx, 8
shl ecx, 0x18
mov dword [eax + 4], esi
or ecx, edx
or edi, ecx
mov dword [eax], edi
jmp 0x1000ae91
push 0x10
push 0x101278b7
push 0x27
push eax
mov esi, eax
call sym.std::io::error::Error::new::h9b144b71a129f823
add esp, 0x10
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10128268
push ecx
push eax
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
mov dword [ebp - 0x28], str.number_of_read_bytes_exceeds_limit
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0
push 0x101282a4
push eax
call sym.core::panicking::panic_fmt::h653fda680bf9012e
push 0x101278c8
push eax
push edi
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
nop
Function at 0x1000b360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x10]
test ecx, ecx
je 0x1000b398
mov esi, dword [ebp + 0xc]
not edx
mov edi, ecx
nop word [eax + eax]
movzx ebx, byte [esi]
inc esi
xor bl, dl
shr edx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x10127458]
dec edi
jne 0x1000b380
not edx
mov dword [eax + 0x10], edx
add dword [eax + 8], ecx
adc dword [eax + 0xc], 0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000caf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0x10]
mov esi, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov ebx, dword [edi]
mov ecx, esi
sub ecx, eax
add eax, ebx
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [edi + 0xc], esi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x1c]
mov edi, dword [edi + 8]
lea eax, [edx + 0x20]
sub esi, edi
add ebx, edi
push esi
push ebx
push eax
push edx
push ecx
call sym.flate2::zio::read::h7a5e76e58c39fd6c
add esp, 0x14
cmp byte [ebp - 0x1c], 4
jne 0x1000cb86
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x1000cbb1
cmp edx, esi
ja 0x1000cc23
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
add esi, 0x68
mov ecx, dword [esi]
not ecx
nop dword [eax + eax]
movzx eax, byte [ebx]
inc ebx
xor al, cl
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10127458]
dec edx
jne 0x1000cb60
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
not ecx
mov dword [esi], ecx
add edi, edx
jae 0x1000cba1
jmp 0x1000cbc8
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
cmp dl, 4
jne 0x1000cbf3
mov edx, dword [ebp - 0x10]
add edi, edx
jb 0x1000cbc8
cmp edi, dword [ebp - 0x24]
ja 0x1000cc12
mov ecx, dword [ebp + 0x10]
mov byte [eax], 4
mov dword [ecx + 8], edi
jmp 0x1000cc0a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x6c]
cmp ecx, dword [eax + 0x68]
jne 0x1000cbd2
add eax, 0x68
mov dword [eax], ecx
mov eax, dword [ebp + 8]
add edi, edx
jae 0x1000cba1
push 0x10128258
call sym.core::num::overflow_panic::add::h8a079b6fb45eaa16
lea eax, [ebp - 0x14]
push 0x10
push 0x101278b7
push 0x27
push eax
call sym.std::io::error::Error::new::h9b144b71a129f823
add esp, 0x10
movzx edx, byte [ebp - 0x14]
mov eax, dword [ebp + 8]
cmp dl, 4
je 0x1000cb9a
movzx ecx, byte [ebp - 0x11]
movzx edi, word [ebp - 0x13]
mov esi, dword [ebp - 0x10]
mov byte [eax + 3], cl
mov word [eax + 1], di
mov byte [eax], dl
mov dword [eax + 4], esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10128248
push 0x29
push str.assertion_failed:_filled___self.buf.init_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrarycore_srcio_borrowed_buf.rs
call sym.core::panicking::panic::h2de0902fd6c3d9b1
push 0x101278c8
push esi
push edx
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
nop
Function at 0x1000cc30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 0x14]
call 0x1000cc41
pop eax
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x1000cd02
mov esi, dword [ebp + 0x10]
jmp 0x1000cc68
test ebx, ebx
je 0x1000cd02
push ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
call sym.__LT_zip..crc32..Crc32Reader_LT_R_GT__u20_as_u20_std..io..Read_GT_::read::h171890a4a4b3e28d
add esp, 0x10
movzx eax, byte [ebp - 0x1c]
cmp eax, 4
jne 0x1000cca0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000cd11
mov ecx, ebx
sub ecx, eax
jb 0x1000cd28
add esi, eax
mov ebx, ecx
jmp 0x1000cc60
mov eax, dword [eax*4 + 0x1000cd68]
add eax, dword [ebp - 0x20]
jmp eax
mov eax, dword [ebp + 8]
mov byte [eax], 4
jmp 0x1000cd20
movsd xmm0, qword [0x10128158]
mov eax, dword [ebp + 8]
movsd qword [eax], xmm0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101281ac
push ebx
push eax
call sym.core::slice::index::slice_start_index_len_fail::h7e8587be95abf61b
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x1000cd53
mov edx, dword [ebp - 0x10]
push dword [edx + 8]
push eax
push ecx
call sym.___rust_dealloc
add esp, 0xc
push 4
push 0xc
push edi
call sym.___rust_dealloc
add esp, 0xc
push esi
call sym.__Unwind_Resume
nop
leave
add byte [eax], al
add byte [ebx], ch
add byte [eax], al
adc dword [eax], eax
add byte [eax], al
jae 0x1000cd76
add byte [eax], al
nop dword [eax + eax]