joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x406b30
cmp edi, esi
jb 0x406b98
cmp edi, dword [esp + 0x1c]
ja 0x406bab
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x406b32
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x406b20
jmp 0x406b8f
ja 0x406b38
cmp eax, edx
mov esi, edi
jne 0x406af3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x406b70
mov ebp, esi
sub ecx, edx
jns 0x406b87
jmp 0x406b91
cmp esi, edi
je 0x406bc0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x406b91
xor al, 1
cmp ebp, edi
jne 0x406b50
jmp 0x406b91
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x43b080
call fcn.00438dd0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x43b080
call fcn.00438bc0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersMarkus.cargo_registry_srcindex.crates.io_1cd66030c949c28d_flate2_1.0.25_srczio.rsW
mov edx, 0x2b
push 0x43b090
call fcn.00438c30
add esp, 4
ud2
Function at 0x415bf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42a100
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x415c2e
test eax, eax
jne 0x415daa
mov ebx, dword [0x4499a8]
test ebx, ebx
je 0x415daa
mov dword [ebp - 0x20], 0
jmp 0x415c57
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x415c88
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x415dfb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415c50
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x415c50
test byte [ebp - 0x20], 1
je 0x415daa
mov ebx, dword [0x4499a8]
test ebx, ebx
je 0x415daa
mov dword [ebp - 0x20], 0
jmp 0x415cb7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x415ce8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x415dfb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415cb0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x415cb0
test byte [ebp - 0x20], 1
je 0x415daa
mov ebx, dword [0x4499a8]
test ebx, ebx
je 0x415daa
mov dword [ebp - 0x20], 0
jmp 0x415d17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x415d48
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x415dfb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415d10
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x415d10
test byte [ebp - 0x20], 1
je 0x415daa
mov ebx, dword [0x4499a8]
test ebx, ebx
je 0x415daa
mov dword [ebp - 0x20], 0
jmp 0x415d77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x415da4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x415dfb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415d70
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x415d70
test byte [ebp - 0x20], 1
jne 0x415dc4
movzx eax, byte [0x445c00]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4499a8]
jmp 0x415dcf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x415daa
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x415dfb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415dcc
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x415dcc
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersMarkus.cargo_registry_srcindex.crates.io_1cd66030c949c28d_flate2_1.0.25_srczio.rsW
mov edx, 0x2b
push 0x43f334
call fcn.00438c30
add esp, 4
ud2
Function at 0x416440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42a160
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x44904c]
test eax, eax
je 0x416530
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x416497
cmp dword [eax + 4], 0
mov edi, eax
je 0x416497
add edi, 8
jmp 0x41651d
mov eax, dword [0x44904c]
test eax, eax
je 0x41653f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41651b
mov esi, eax
test eax, eax
jne 0x4164ea
mov ecx, 0x10
call fcn.004261ac
test eax, eax
je 0x41655a
mov dword [eax], 0x44904c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x44904c]
test eax, eax
je 0x41654e
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x41651d
test ecx, ecx
je 0x41651d
lock dec dword [ecx]
jne 0x41651d
call fcn.004165b0
jmp 0x41651d
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x44904c
call fcn.00439530
jmp 0x41647b
mov ecx, 0x44904c
call fcn.00439530
jmp 0x4164a5
mov ecx, 0x44904c
call fcn.00439530
jmp 0x4164e2
mov ecx, 4
mov edx, 0x10
mov dword [ebp - 0x10], 0
call fcn.004389b0
ud2
Function at 0x416d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42a1d0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
cmp byte [eax], 0
mov byte [eax], 0
je 0x416f70
mov byte [ebp - 0x1d], 0
mov eax, dword [0x44994c]
cmp eax, 3
jne 0x416f20
cmp byte [ebp - 0x1d], 0
jne 0x416f32
mov eax, dword [0x44905c]
test eax, eax
je 0x416f43
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x416dbd
cmp byte [eax + 4], 0
mov esi, eax
jne 0x416e39
mov eax, dword [0x44905c]
test eax, eax
je 0x416f52
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x416dff
mov esi, eax
cmp eax, 1
jne 0x416e33
lea eax, [ebp - 0x20]
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destructionlibrary_std_src_threadlocal.rs
mov edx, 0x46
push 0x43e3a0
push 0x43daf4
push eax
call fcn.00438e40
add esp, 0xc
ud2
mov ecx, 8
call fcn.004261ac
test eax, eax
je 0x416fb2
mov dword [eax], 0x44905c
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x44905c]
test eax, eax
je 0x416f61
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
mov eax, dword [0x44996c]
add esi, 5
cmp eax, esi
jne 0x416e66
mov eax, dword [0x449970]
inc eax
jne 0x416e86
mov ecx, str.lock_count_overflow_in_reentrant_mutexlibrary_std_src_sync_remutex.rs
mov edx, 0x26
push 0x43e63c
call fcn.00438ec0
add esp, 4
ud2
lea eax, [0x449968]
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x416f32
mov dword [0x44996c], esi
mov eax, 1
mov dword [0x449970], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x26], 0
mov dword [ebp - 0x2a], 0
cmp dword [0x449950], 0
jne 0x416f89
lea ecx, [0x449954]
mov dword [0x449950], 0xffffffff
mov dword [ebp - 0x10], 1
call fcn.00417080
mov eax, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov dword [0x449964], eax
movsd qword [0x44995c], xmm1
movsd qword [0x449954], xmm0
inc dword [0x449950]
dec dword [0x449970]
jne 0x416f32
lea eax, [0x449968]
mov dword [0x44996c], 0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x416f32
lea ecx, [ebp - 0x1d]
call fcn.00439730
cmp byte [ebp - 0x1d], 0
je 0x416d9b
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x44905c
call fcn.00439530
jmp 0x416da9
mov ecx, 0x44905c
call fcn.00439530
jmp 0x416dcb
mov ecx, 0x44905c
call fcn.00439530
jmp 0x416e2b
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersMarkus.cargo_registry_srcindex.crates.io_1cd66030c949c28d_flate2_1.0.25_srczio.rsW
mov edx, 0x2b
push 0x43e5b0
call fcn.00438c30
add esp, 4
ud2
mov dword [ebp - 0x10], 2
lea eax, [ebp - 0x20]
mov ecx, 0x43e2fd
mov edx, 0x10
push 0x43e328
push 0x43db04
push eax
call fcn.00438e40
add esp, 0xc
ud2
mov ecx, 4
mov edx, 8
call fcn.004389b0
ud2
Function at 0x417df0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x3c]
mov esi, ecx
mov ecx, dword [esp + 0x40]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x417e40
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0x103
je 0x417e63
test eax, eax
js 0x417e4f
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov al, 4
jmp 0x417e5b
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x30
pop esi
pop edi
ret
lea esi, [esp + 0x10]
lea eax, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0x43ee9c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], str._rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22librarycore_srciter_range.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x24], 0
lea edx, [esp + 8]
mov ecx, esi
push eax
call fcn.004161b0
add esp, 4
cmp byte [esp + 0x10], 4
je 0x417ebf
push esi
call fcn.00416300
add esp, 4
mov ecx, 7
int 0x29
ud2
Function at 0x418390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x44903c]
test eax, eax
je 0x418414
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4183b2
cmp dword [eax + 4], 0
je 0x4183b2
add eax, 8
pop esi
ret
mov eax, dword [0x44903c]
test eax, eax
je 0x418423
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x418410
mov esi, eax
test eax, eax
jne 0x4183fd
mov ecx, 0xc
call fcn.004261ac
test eax, eax
je 0x41843b
mov dword [eax], 0x44903c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x44903c]
test eax, eax
je 0x41842f
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x44903c
call fcn.00439530
jmp 0x41839b
mov ecx, 0x44903c
call fcn.00439530
jmp 0x4183bc
mov ecx, 0x44903c
call fcn.00439530
jmp 0x4183f5
mov ecx, 4
mov edx, 0xc
call fcn.004389b0
ud2
Function at 0x4192c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42a270
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x419350
jmp 0x41933e
jbe 0x4193dc
cmp esi, 0x201
jae 0x419350
lea edi, [ebp - 0x44c]
mov dword [ebp - 0x2c], 0x200
mov ebx, esi
jmp 0x41938b
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, ebx
sub eax, ebx
cmp eax, esi
jae 0x41937c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, ebx
push esi
call fcn.004397d0
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4193ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x419410
cmp esi, ebx
jne 0x419330
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x419446
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x41933e
jmp 0x419350
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x419466
lea ecx, [ebp - 0x4c]
mov edx, edi
push esi
call fcn.00419ae0
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x419423
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x419432
mov ecx, dword [ebp - 0x24]
call fcn.0042627a
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len__rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22library_alloc_src_string.rs
mov edx, 0x28
push 0x43f3e0
call fcn.00438c30
add esp, 4
jmp 0x419475
mov ecx, esi
push 0x43f3f0
call fcn.00438bc0
add esp, 4
ud2
Function at 0x41df80
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x3c]
mov esi, ecx
mov ecx, dword [esp + 0x40]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x41dfc9
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0xc0000011
jne 0x41dfd9
mov dword [esi + 4], 0
jmp 0x41dfeb
cmp eax, 0x103
je 0x41e003
test eax, eax
js 0x41dff4
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x30
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x41dfee
lea esi, [esp + 0x10]
lea eax, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0x43ee9c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], str._rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22librarycore_srciter_range.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x24], 0
lea edx, [esp + 8]
mov ecx, esi
push eax
call fcn.004161b0
add esp, 4
cmp byte [esp + 0x10], 4
je 0x41e05f
push esi
call fcn.00416300
add esp, 4
mov ecx, 7
int 0x29
ud2

Function at 0x41f1b0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.00418c20
add esp, 4
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x41f211
mov dword [esp], ecx
lea ecx, [esp + 0xc]
mov edx, esp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.0041e070
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x41f20d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41f21d
mov byte [esi], 4
test ebx, ebx
jne 0x41f22d
jmp 0x41f216
mov eax, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], eax
add esp, 0x18
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x41f216
mov ecx, edi
add esp, 0x18
pop esi
pop edi
pop ebx
jmp fcn.0042627a

Function at 0x422cc8
Capabilities:
Create pipe
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x478
mov edi, dword [edx + 0xc]
mov dword [esp + 0xec], edx
mov edx, dword [edx + 8]
xorps xmm0, xmm0
call fcn.00422ce7
Function at 0x428b5a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
push 0x40
push 0x3000
push dword [esp + 0x1c]
push 0
push edx
call sub.KERNEL32.dll_VirtualAllocEx
test eax, eax
je 0x428b7f
mov dword [esi + 4], eax
mov byte [esi], 5
jmp 0x428bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x19
xor edx, edx
mov edi, eax
call fcn.00429029
mov ebx, eax
mov eax, 0x19
mov ebp, edx
push eax
push str.Error_on_child_allocationCould_not_close_handle
push ebx
call fcn.0042b110
add esp, 0xc
mov eax, 0x19
mov dword [esi + 4], edi
mov dword [esi], 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42ac95
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42acd4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42acd4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42acd4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42acd4
cmp dword [ecx + 0x74], 0xe
jbe 0x42acd4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x431e67
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x431f04
push ebx
push esi
call fcn.00431e30
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00431d79
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x431eb1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x431f03
push edi
push eax
call fcn.00432a67
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x431ed1
call fcn.004309a1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x431f02
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00431d79
add esp, 0x20
test eax, eax
jne 0x431ef0
push edi
call fcn.004309a1
jmp 0x431ef8
push ebx
call fcn.004309a1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4331ea
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x442dd0
push 0x442dc8
push str.FlsAlloc
push 0x1e
call fcn.004330ab
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43321e
push dword [ebp + 8]
mov ecx, esi
call dword [0x43a204]
call esi
jmp 0x433224
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x433268
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x442de0
push 0x442dd8
push str.FlsGetValue
push 0x20
call fcn.004330ab
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43329f
push dword [ebp + 8]
mov ecx, esi
call dword [0x43a204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x438720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43874d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43874d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x439530
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x43959a
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4395d5
cmp dword [esp + 4], 0
je 0x4395bc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4395ea
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x4499a8]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4499a8], esi
jne 0x439580
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x4395cc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x43962d
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4395c0
mov edi, dword [esp]
jmp 0x4395cc
mov edi, dword [esi]
jmp 0x4395cb
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00439670
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x43f314
mov dword [esp + 8], 0x43f30c
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22librarycore_srciter_range.rs
mov dword [esp + 0x14], 0
call fcn.00438ab0
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x43f30c
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_f9a6b71580cd53dd4491d9bb6400f7ee841d9c22librarycore_srciter_range.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004396d0
ud2
Function at 0x4059dd
Capabilities:
Get common file path

Disassembly:
invalid
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403803
jge 0x405994
call 0x34cba3c5

Function at 0x4059f3
Capabilities:
Get common file path

Disassembly:
dec ecx
mov esi, dword [ebx + ecx*4]
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
je 0x405a4b
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
je 0x405a4b
cmp dword [esi], eax
jne 0x4059f0

Function at 0x4059f9
Capabilities:
Get common file path

Disassembly:
je 0x405a4b
add byte [ebx - 0x7e0fd409], cl
inc byte [eax]
add al, 0
add byte [edi], cl
invalid
Function at 0x4e1940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00481b98
xor edx, edx
push ebp
push 0x4e19b2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e19bc
pop edi
pop esi
pop ebx
pop ebp
ret