joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, edx
call 0x48b620
pop edx
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x48b749
mov dword [ebp - 0x1c], ecx
lea ecx, [eax + 0xd]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
jmp 0x48b690
mov ebx, edx
mov byte [eax + 0xc], 1
mov dword [ebp - 0x10], ecx
sub ebx, ecx
jb 0x48b7b9
mov esi, eax
mov eax, dword [eax + 4]
add eax, ecx
mov edx, 0xfffffff5
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
push ebx
push eax
call fcn.0048b8a0
add esp, 0xc
movzx eax, byte [ebp - 0x28]
mov edi, dword [ebp - 0x24]
cmp al, 4
jne 0x48b6f0
mov eax, dword [ebp - 0x28]
mov byte [esi + 0xc], 0
movzx ecx, al
mov ecx, dword [ecx*4 + 0x48b834]
add ecx, dword [ebp - 0x20]
jmp ecx
test al, al
jne 0x48b6c8
cmp edi, 6
jne 0x48b6c8
mov edi, ebx
mov byte [esi + 0xc], 0
test edi, edi
je 0x48b776
mov ecx, dword [ebp - 0x10]
add ecx, edi
mov edx, dword [esi + 8]
mov eax, esi
cmp ecx, edx
jb 0x48b690
jmp 0x48b74e
mov byte [ecx], 4
jmp 0x48b7b1
mov eax, dword [ebp - 0x1c]
test ecx, ecx
mov byte [eax], 4
je 0x48b7b1
cmp edx, ecx
jb 0x48b7d4
mov dword [esi + 8], 0
jmp 0x48b7b1
mov eax, dword [ebp - 0x1c]
mov byte [eax], 2
mov dword [eax + 4], 0x581494
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x48b7b1
mov edx, dword [esi + 8]
mov edi, edx
sub edi, ecx
jb 0x48b7ca
mov eax, esi
mov dword [esi + 8], 0
je 0x48b7b1
mov eax, dword [esi + 4]
add ecx, eax
push edi
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [esi + 8], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, eax
push 0x57d3c0
call fcn.00469960
add esp, 4
ud2
push 0x57ce00
call fcn.0046a750
push 0x57ce00
call fcn.0046a750
cmp dword [ebx + 4], 0
mov dword [ebp - 0x18], eax
je 0x48b806
cmp dword [ebx + 8], 9
jb 0x48b7f6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
push edi
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
jmp 0x48b81b
mov edx, dword [ebp - 0x10]
mov ecx, esi
call 0x48b850
push dword [ebp - 0x18]
call fcn.005638c0
call fcn.0046f3f0
nop
inc ebp
add dword [eax], eax
add byte [eax + eax], bl
add byte [eax], al
mov esi, 0xf7000000
add byte [eax], al
add bh, bl
add byte [eax], al
add byte [edi], cl
pop ds
test byte [eax], al
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
push edi
push esi
test edx, edx
je 0x48b880
mov eax, dword [ecx + 8]
mov esi, ecx
mov edi, eax
sub edi, edx
jb 0x48b884
mov dword [esi + 8], 0
je 0x48b880
mov eax, dword [esi + 4]
add edx, eax
push edi
push edx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [esi + 8], edi
pop esi
pop edi
pop ebp
ret
mov ecx, edx
mov edx, eax
push 0x57ce00
call fcn.0046a750
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x48bb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x48bb8f
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0x103
je 0x48bbb1
test eax, eax
js 0x48bb9d
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov al, 4
jmp 0x48bba8
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x57e3e0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
call fcn.00489f30
add esp, 4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.0048a020
mov ecx, 7
int 0x29
ud2
Function at 0x48c4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x56d168]
test eax, eax
je 0x48c4e5
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x48c4fa
cmp dword [eax + 4], 0
je 0x48c4fa
add eax, 8
pop esi
pop ebp
ret
mov ecx, 0x56d168
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x48c4d9
mov eax, dword [0x56d168]
test eax, eax
je 0x48c579
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x48c58e
mov esi, eax
test eax, eax
jne 0x48c561
movzx eax, byte [0x592110]
mov eax, dword [0x5920d8]
test eax, eax
jne 0x48c533
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48c59f
mov dword [0x5920d8], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48c59f
mov dword [eax], 0x56d168
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x56d168]
test eax, eax
je 0x48c593
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
pop esi
pop ebp
ret
mov ecx, 0x56d168
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x48c50f
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x56d168
call fcn.0048a7c0
jmp 0x48c55a
mov ecx, 4
mov edx, 0x10
call fcn.00429f60
nop

Function at 0x48fe90
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push eax
call fcn.0048c4c0
test eax, eax
je 0x48fea8
cmp dword [eax], 0
sete al
add esp, 4
pop ebp
ret
lea eax, [ebp - 1]
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destructionlibrary_std_src_threadlocal.rs
mov edx, 0x46
push 0x57d878
push 0x57cd64
push eax
call fcn.0046f0c0
nop word cs:[eax + eax]
nop
Function at 0x491b30
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x32], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x36], 0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0xc]
push esi
push eax
call fcn.004aca00
add esp, 8
cmp byte [esp + 0xc], 4
jne 0x491ba5
mov esi, dword [esp + 0x10]
jmp 0x491bc0
movzx eax, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
cmp eax, 3
je 0x491c5c
cmp eax, 4
jne 0x491d0e
lea ebx, [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.004ad150
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x491c1b
cmp byte [esp + 0x20], 3
jne 0x491d3c
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp + 8], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x491d2b
cmp dword [ebx + 8], 9
jae 0x491d16
mov eax, dword [esp + 8]
jmp 0x491d1d
cmp dword [esp + 0x54], 0
jne 0x491d3c
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 4], eax
je 0x491c83
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_GetCurrentProcess
push 2
push 0
push 0
push ebx
push eax
push esi
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x491d44
mov eax, dword [esp + 0x18]
jmp 0x491c85
mov ebx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [esp + 4], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x491d00
cmp dword [ebx + 8], 9
jae 0x491ceb
mov eax, dword [esp + 4]
jmp 0x491cf2
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.KERNEL32.dll_CreateFileMappingA
test eax, eax
je 0x491cda
mov ebx, eax
push dword [esp + 4]
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [esp + 0x14], eax
push ebx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x491cda
mov eax, dword [esp + 8]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [esp + 4]
mov dword [edi + 0xc], ecx
mov dword [edi], 1
jmp 0x491d4f
mov dword [edi], 0
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
jmp 0x491d4f
mov eax, dword [esp + 4]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov dword [edi], 0
jmp 0x491d55
mov eax, dword [esp + 8]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 4]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov dword [edi], 0
jmp 0x491d4f
call sub.KERNEL32.dll_GetLastError
mov dword [edi], 0
push esi
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ad300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, ecx
lea ecx, [ebp - 0x444]
push dword [ebp + 8]
call fcn.0048cac0
add esp, 4
mov eax, dword [ebp - 0x444]
cmp eax, 0x80000000
jne 0x4ad342
lea ecx, [ebp - 0x444]
call fcn.0048cd90
mov dword [esi], 0x80000000
jmp 0x4ad4ef
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x20], esi
mov esi, 0x200
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], ecx
cmp esi, 0x201
jae 0x4ad3b0
jmp 0x4ad39e
jbe 0x4ad438
cmp esi, 0x201
jae 0x4ad3b0
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x4ad3e4
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x4ad3d5
mov edx, edi
lea ecx, [ebp - 0x34]
push esi
call fcn.0048cf20
add esp, 4
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], edi
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push ebx
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov esi, eax
test eax, eax
jne 0x4ad408
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4ad4fa
cmp esi, edi
jne 0x4ad390
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x4ad517
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4ad39e
jmp 0x4ad3b0
mov edx, dword [ebp - 0x28]
cmp esi, edx
ja 0x4ad530
mov edx, ebx
lea ecx, [ebp - 0x44]
push esi
call fcn.0048e930
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x4ad476
push dword [ebp - 0x18]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
cmp edi, 0x80000000
jne 0x4ad4c8
mov eax, dword [ebp - 0x20]
cmp bl, 3
mov dword [eax], 0x80000000
jne 0x4ad4d9
mov edi, dword [esi]
mov ebx, esi
mov esi, dword [esi + 4]
mov eax, dword [esi]
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x4ad4b8
cmp dword [esi + 8], 9
jb 0x4ad4aa
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
push ebx
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
jmp 0x4ad4d9
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
cmp dword [ebp - 0x24], 0
je 0x4ad4ef
push dword [ebp - 0x1c]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
mov edi, 0x80000000
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp dword [ebp - 0x14], 0
jne 0x4ad466
jmp 0x4ad476
mov edx, 0x28
mov ecx, 0x5811c4
push 0x57ea48
call fcn.0046b100
add esp, 4
jmp 0x4ad53f
mov ecx, esi
push 0x57ea38
call fcn.0046a750
add esp, 4
ud2
Function at 0x4ae050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
call fcn.004ae067

Function at 0x4ae190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x4ae1d8
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0xc0000011
jne 0x4ae1e8
mov dword [esi + 4], 0
jmp 0x4ae1f9
cmp eax, 0x103
je 0x4ae211
test eax, eax
js 0x4ae203
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4ae1fc
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x57e3e0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
call fcn.00489f30
add esp, 4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.0048a020
mov ecx, 7
int 0x29
ud2

Function at 0x4b1050
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push 0x10
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x4b1099
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
lea edi, [esp + 8]
lea esi, [esp + 0x20]
mov byte [esp + 8], 0
mov dword [esp + 0x28], 0x57e56c
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], fcn.004adc50
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x28]
mov edx, 0x57e598
call fcn.00469660
ud2
Function at 0x4b3550
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x56d198]
test eax, eax
je 0x4b3645
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4b3580
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4b3640
mov eax, dword [0x56d198]
test eax, eax
je 0x4b3663
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4b367c
mov esi, eax
test eax, eax
jne 0x4b3602
movzx eax, byte [0x592110]
mov eax, dword [0x5920d8]
test eax, eax
jne 0x4b35c5
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4b3695
mov dword [0x5920d8], eax
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4b3695
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x56d198
mov esi, eax
mov eax, dword [0x56d198]
test eax, eax
je 0x4b3686
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4b3621
movaps xmm0, xmmword [esp]
jmp 0x4b362f
lea ecx, [esp + 0x10]
call fcn.004b1050
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x4b367e
mov ecx, 0x56d198
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4b3573
jmp 0x4b3580
mov ecx, 0x56d198
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4b359d
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x56d198
call fcn.0048a7c0
jmp 0x4b35fb
mov ecx, 8
mov edx, 0x20
call fcn.00429f60
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x4b36c4
dec eax
jmp 0x4b36cb
mov ecx, esi
call fcn.0048a7c0
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
push edi
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4b36ea
dec eax
jmp 0x4b36f1
mov ecx, esi
call fcn.0048a7c0
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret
Function at 0x4e9000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [edx + 0x4c], 0
je 0x4e9014
mov eax, dword [ecx + 0xb8]
cmp eax, dword [edx + 0x50]
jbe 0x4e9046
xor eax, eax
ret
xor eax, eax
cmp dword [edx + 0x9c], 0x80000000
je 0x4e9045
cmp dword [edx + 0xa4], 8
jb 0x4e9045
mov eax, dword [edx + 0xa0]
mov ecx, 0x68707363
mov edx, 0x5f657265
xor ecx, dword [eax]
xor edx, dword [eax + 4]
or edx, ecx
sete al
ret
push ebp
mov ebp, esp
mov ecx, str.called__Option::unwrap____on_a__None__value_home_rafalh_.cargo_registry_src_index.crates.io_6f17d22bba15001f_serde_json_1.0.81_src_read.rs
mov edx, 0x2b
push 0x57a2a4
call fcn.0046b100
nop dword [eax]
Function at 0x4ec910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
call fcn.004ec924
Function at 0x51eef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov edi, dword [edx + 0x10]
mov esi, dword [edx + 0x14]
call fcn.0051ef0a
Function at 0x538960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
cmp dword [ecx], 2
je 0x538b5e
mov eax, dword [ecx + 0x70]
mov esi, ecx
test eax, eax
je 0x53898f
cmp dword [esi + 0x74], 0
je 0x53898f
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
movzx eax, byte [esi + 0x40]
cmp eax, 6
je 0x5389ee
cmp eax, 3
jb 0x5389ee
je 0x5389d8
cmp eax, 4
jne 0x538a3c
mov ebx, dword [esi + 0x4c]
mov eax, dword [esi + 0x48]
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x5389cd
mov edi, dword [ebp - 0x10]
nop dword [eax + eax]
mov ecx, edi
call fcn.004e5c20
add edi, 0x18
dec ebx
jne 0x5389c0
cmp dword [esi + 0x44], 0
je 0x5389ee
push dword [ebp - 0x10]
jmp 0x5389e1
cmp dword [esi + 0x44], 0
je 0x5389ee
push dword [esi + 0x48]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
movzx eax, byte [esi + 0x58]
cmp eax, 6
je 0x538ae9
cmp eax, 3
jb 0x538ae9
je 0x538a6a
cmp eax, 4
jne 0x538a82
mov ebx, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x538a2d
mov edi, dword [ebp - 0x10]
nop dword [eax + eax]
mov ecx, edi
call fcn.004e5c20
add edi, 0x18
dec ebx
jne 0x538a20
cmp dword [esi + 0x5c], 0
je 0x538ae9
push dword [ebp - 0x10]
jmp 0x538a73
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x538ab0
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], ecx
mov ecx, 1
mov dword [ebp - 0x18], edx
jmp 0x538ab4
cmp dword [esi + 0x5c], 0
je 0x538ae9
push dword [esi + 0x60]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
jmp 0x538ae9
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x538ad4
mov edx, dword [esi + 0x60]
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], ecx
mov ecx, 1
mov dword [ebp - 0x18], edx
jmp 0x538ad8
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.00559420
movzx eax, byte [esi + 0x58]
cmp eax, 6
jne 0x5389fb
jmp 0x538ae9
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.00559420
mov eax, dword [esi + 0x78]
cmp eax, 0x80000000
je 0x538b07
test eax, eax
je 0x538b07
push dword [esi + 0x7c]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
cmp byte [esi + 0x3c], 2
je 0x538b5e
mov eax, dword [esi + 0x28]
test eax, eax
je 0x538b28
cmp dword [esi + 0x2c], 0
je 0x538b28
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x538b43
cmp dword [esi + 0x20], 0
je 0x538b43
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 8]
test eax, eax
je 0x538b5e
cmp dword [esi + 0xc], 0
je 0x538b5e
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x558220
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x558294
mov dword [ebp - 0x10], ecx
xor edi, edi
mov eax, 0x811c9dc5
mov ecx, 0x1b3
nop word cs:[eax + eax]
nop dword [eax + eax]
mov dword [ebp - 0x14], edx
movzx edx, byte [esi]
imul edi, ecx
inc esi
xor edx, eax
mov eax, 0x100
mov ebx, edx
imul ebx, eax
mov eax, edx
mul ecx
add edx, ebx
add edi, edx
mov edx, dword [ebp - 0x14]
dec edx
jne 0x558250
mov ecx, 0x1b3
xor eax, 0xff
mov esi, 0x100
imul esi, eax
mul ecx
imul edi, ecx
mov ecx, dword [ebp - 0x10]
add edx, esi
add edi, edx
jmp 0x55829e
mov edi, 0x1c9d3adb
mov eax, 0x639f298e
mov edx, eax
push edi
call fcn.00539b40
add esp, 4
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x5582f4
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
shl ecx, 2
add edx, 0xfffffff4
lea ecx, [ecx + ecx*2]
test ecx, ecx
je 0x5582f4
add ecx, 0xfffffff4
cmp dword [edx + 0x14], 0
lea esi, [edx + 0xc]
mov edx, esi
je 0x5582c0
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x20]
mov edx, dword [eax + 4]
push dword [eax + 8]
call fcn.0046eab0
add esp, 4
cmp dword [ebp - 0x20], 0
jne 0x5582fc
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
jmp 0x5582f4
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.unexpected_invalid_UTF_8_code_point_home_rafalh_.cargo_registry_src_index.crates.io_6f17d22bba15001f_clap_3.1.18_src_parse_matches_arg_matches.rs
mov edx, 0x23
push 0x5816e4
call fcn.0046f130