joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d300
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x32], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x36], 0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0xc]
push esi
push eax
call dbg.open
add esp, 8
cmp byte [esp + 0xc], 4
jne 0x46d375
mov esi, dword [esp + 0x10]
jmp 0x46d386
movzx eax, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
cmp al, 4
jne 0x46d431
lea ebx, [esp + 0x18]
mov edx, esi
mov ecx, ebx
call dbg.file_attr
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x46d3e9
cmp byte [esp + 0x20], 3
jne 0x46d426
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], ecx
push ecx
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x46d3d7
push dword [ebx + 8]
push eax
push dword [esp + 0xc]
call sym.___rust_dealloc
add esp, 0xc
push 4
push 0xc
push dword [esp + 0x10]
call sym.___rust_dealloc
add esp, 0xc
jmp 0x46d426
cmp dword [esp + 0x54], 0
jne 0x46d426
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 8], eax
je 0x46d443
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_GetCurrentProcess
push 2
push 0
push 0
push ebx
push eax
push esi
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x46d4ab
mov eax, dword [esp + 0x18]
jmp 0x46d445
mov dword [edi], 0
jmp 0x46d4b6
movzx ecx, al
mov edx, esi
call dbg.drop_in_place<core::result::Result<std::sys::pal::windows::fs::File, std::io::error::Error>>
mov dword [edi], 0
jmp 0x46d4bc
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x18], eax
push eax
call sub.KERNEL32.dll_CreateFileMappingA
test eax, eax
je 0x46d49a
mov ebx, eax
push dword [esp + 8]
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov dword [esp + 0x14], eax
push ebx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46d49a
mov eax, dword [esp + 4]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [esp + 8]
mov dword [edi + 0xc], ecx
mov dword [edi], 1
jmp 0x46d4b6
mov dword [edi], 0
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
jmp 0x46d4b6
call sub.KERNEL32.dll_GetLastError
mov dword [edi], 0
push esi
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46f4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x4b9044]
mov esi, ecx
test eax, eax
je 0x46f509
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46f521
cmp dword [eax + 4], 0
je 0x46f521
add eax, 8
pop esi
pop edi
pop ebp
ret
push 0x4b9044
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46f4fc
mov eax, dword [0x4b9044]
test eax, eax
je 0x46f5b8
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46f5d4
mov edi, eax
test eax, eax
jne 0x46f580
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 0x10
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46f5e9
mov dword [eax], 0x4b9044
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4b9044]
test eax, eax
je 0x46f5da
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x46f5a0
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x46f5a4
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x46f5a4
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
pop ebp
ret
push 0x4b9044
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46f53e
xor eax, eax
pop esi
pop edi
pop ebp
ret
push 0x4b9044
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46f579
push 0x10
push 4
call dbg.handle_alloc_error
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x46f600
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x4b9054]
mov esi, ecx
test eax, eax
je 0x46f6d9
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46f62f
cmp dword [eax + 4], 0
mov edi, eax
jne 0x46f6d4
mov eax, dword [0x4b9054]
test eax, eax
je 0x46f6fa
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46f716
mov edi, eax
test eax, eax
jne 0x46f692
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 0xc
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46f733
mov dword [eax], 0x4b9054
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4b9054]
test eax, eax
je 0x46f721
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x46f6a7
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x46f6a9
mov eax, dword [esi + 4]
jmp 0x46f6a9
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x46f6d4
test ecx, ecx
je 0x46f6d4
lock dec dword [ecx]
jne 0x46f6d4
lea ecx, [ebp - 0xc]
call dbg.drop_slow<std::thread::Inner, alloc::alloc::Global>
add edi, 8
jmp 0x46f718
push 0x4b9054
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46f623
jmp 0x46f62f
push 0x4b9054
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46f64c
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebp
ret
push 0x4b9054
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46f68b
push 0xc
push 4
call dbg.handle_alloc_error
nop dword [eax]
Function at 0x46f740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x4b9064]
mov esi, ecx
test eax, eax
je 0x46f769
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46f781
cmp byte [eax + 4], 0
je 0x46f781
add eax, 5
pop esi
pop edi
pop ebp
ret
push 0x4b9064
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46f75c
mov eax, dword [0x4b9064]
test eax, eax
je 0x46f7f4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46f80c
mov edi, eax
test eax, eax
jne 0x46f7d1
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46f821
mov dword [eax], 0x4b9064
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x4b9064]
test eax, eax
je 0x46f812
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
xor ecx, ecx
test esi, esi
je 0x46f7e6
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
pop ebp
ret
push 0x4b9064
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46f796
xor eax, eax
pop esi
pop edi
pop ebp
ret
push 0x4b9064
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46f7ca
push 8
push 4
call dbg.handle_alloc_error
nop word [eax + eax]
Function at 0x46f830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4b9074]
test eax, eax
je 0x46f855
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46f86d
cmp byte [eax + 4], 0
je 0x46f86d
add eax, 5
pop esi
pop ebp
ret
push 0x4b9074
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46f849
mov eax, dword [0x4b9074]
test eax, eax
je 0x46f8e2
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46f8fa
mov esi, eax
test eax, eax
jne 0x46f8bd
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46f90e
mov dword [eax], 0x4b9074
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4b9074]
test eax, eax
je 0x46f8ff
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
je 0x46f8d5
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [esi + 5]
mov byte [esi + 4], 1
mov byte [esi + 5], cl
pop esi
pop ebp
ret
push 0x4b9074
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46f882
xor eax, eax
pop esi
pop ebp
ret
push 0x4b9074
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46f8b6
push 8
push 4
call dbg.handle_alloc_error
nop word [eax + eax]
Function at 0x46f920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [0x4b9084]
test eax, eax
je 0x46f9f4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46f94c
cmp dword [eax + 4], 0
mov esi, eax
jne 0x46f9ef
mov eax, dword [0x4b9084]
test eax, eax
je 0x46fa1c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46fa38
mov esi, eax
test eax, eax
jne 0x46f9af
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 0xc
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46fa54
mov dword [eax], 0x4b9084
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4b9084]
test eax, eax
je 0x46fa42
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x46fa15
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x46fa15
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x46f9ef
test ecx, ecx
je 0x46f9ef
lock dec dword [ecx]
jne 0x46f9ef
lea ecx, [ebp - 8]
call dbg.drop_slow<std::sync::mpmc::context::Inner, alloc::alloc::Global>
add esi, 8
jmp 0x46fa3a
push 0x4b9084
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46f940
jmp 0x46f94c
call sym.std::sync::mpmc::context::Context::new::h03ba54ad00ede1fc
jmp 0x46f9c4
push 0x4b9084
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46f969
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
push 0x4b9084
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46f9a8
push 0xc
push 4
call dbg.handle_alloc_error
nop dword [eax]
Function at 0x46fa60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x4b9094]
mov esi, ecx
test eax, eax
je 0x46fb39
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46fa8f
cmp dword [eax + 4], 0
mov edi, eax
jne 0x46fb34
mov eax, dword [0x4b9094]
test eax, eax
je 0x46fb5a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46fb76
mov edi, eax
test eax, eax
jne 0x46faf2
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 4
push 0xc
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46fb93
mov dword [eax], 0x4b9094
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4b9094]
test eax, eax
je 0x46fb81
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x46fb07
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x46fb09
mov eax, dword [esi + 4]
jmp 0x46fb09
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x46fb34
test ecx, ecx
je 0x46fb34
lock dec dword [ecx]
jne 0x46fb34
lea ecx, [ebp - 0xc]
call dbg.drop_slow<std::sync::mutex::Mutex<alloc::vec::Vec<u8, alloc::alloc::Global>>, alloc::alloc::Global>
add edi, 8
jmp 0x46fb78
push 0x4b9094
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46fa83
jmp 0x46fa8f
push 0x4b9094
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46faac
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebp
ret
push 0x4b9094
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46faeb
push 0xc
push 4
call dbg.handle_alloc_error
nop dword [eax]
Function at 0x46fba0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4b90a4]
test eax, eax
je 0x46fc9c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x46fbd0
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x46fc97
mov eax, dword [0x4b90a4]
test eax, eax
je 0x46fcbd
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x46fcd9
mov esi, eax
test eax, eax
jne 0x46fc3a
mov eax, dword [0x4d8218]
movzx eax, byte [eax]
push 8
push 0x20
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x46fcf5
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4b90a4
mov esi, eax
mov eax, dword [0x4b90a4]
test eax, eax
je 0x46fce3
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x46fc59
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x46fc86
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x46fc78
movaps xmm0, xmmword [esp]
jmp 0x46fc86
lea ecx, [esp + 0x10]
call dbg.fallback_rng
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x46fcdb
push 0x4b90a4
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x46fbc3
jmp 0x46fbd0
push 0x4b90a4
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x46fbed
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4b90a4
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h0e07b267238be613
add esp, 4
jmp 0x46fc33
push 0x20
push 8
call dbg.handle_alloc_error
nop

Function at 0x472ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x47301e
mov edx, dword [ebp + 8]
xor eax, eax
movzx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov eax, esi
shr eax, 0x18
and eax, 0xfffffff0
xor eax, esi
dec ecx
jne 0x473000
and eax, 0xfffffff
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x473030
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x473063
mov edx, dword [ebp + 8]
mov eax, 0x1505
nop word cs:[eax + eax]
nop dword [eax]
mov esi, eax
shl esi, 5
add esi, eax
movzx eax, byte [edx]
inc edx
add eax, esi
dec ecx
jne 0x473050
pop esi
pop ebp
ret
mov eax, 0x1505
pop esi
pop ebp
ret
Function at 0x4a1710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a1768
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x4a1760
cmp ebx, eax
ja 0x4a17d6
cmp eax, dword [ebp + 0x10]
ja 0x4a17e2
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x4a1762
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4a1750
jmp 0x4a17bf
ja 0x4a1768
cmp edx, edi
mov ebx, eax
jne 0x4a1722
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x4a17c3
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x4a17a0
mov esi, edi
sub ecx, ebx
jns 0x4a17b7
jmp 0x4a17c5
cmp edi, edx
je 0x4a17cc
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x4a17c5
xor al, 1
cmp esi, edx
jne 0x4a1780
jmp 0x4a17c5
xor eax, eax
jmp 0x4a17c5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4cd138
call sym.core::option::unwrap_failed::hef9527eb823b8d2a
push 0x4cd148
push eax
push ebx
call dbg.slice_index_order_fail
push 0x4cd148
push dword [ebp + 0x10]
push eax
call dbg.slice_end_index_len_fail

Function at 0x4a1cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xa0]
mov ecx, dword [esi + 0xa0]
cmp edx, ecx
cmova ecx, edx
cmp ecx, 0x28
ja 0x4a1d24
test ecx, ecx
je 0x4a1d0a
xor ebx, ebx
xor edx, edx
nop word [eax + eax]
movzx edi, bl
mov ebx, dword [esi + edx*4]
bt edi, 0
adc dword [eax + edx*4], ebx
lea edx, [edx + 1]
setb bl
cmp ecx, edx
jne 0x4a1ce0
test bl, bl
je 0x4a1d0c
cmp ecx, 0x27
ja 0x4a1d17
mov dword [eax + ecx*4], 1
inc ecx
jmp 0x4a1d0c
xor ecx, ecx
mov dword [eax + 0xa0], ecx
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4cd85c
push 0x28
push ecx
call dbg.panic_bounds_check
push 0x4cd85c
push 0x28
push ecx
call dbg.slice_end_index_len_fail
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x4b34d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4b3530
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4f11b4]
test esi, esi
jle 0x4b3650
mov eax, dword [0x4f11b8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4b3564
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4b35e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4b3550
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4b3677
mov eax, dword [0x4f11b8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4f11b8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4b3657
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4b35e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4b35f0
add dword [0x4f11b4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4f11b8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4b35e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4b356e
mov eax, dword [0x4f11b8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x4b3b90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4f11d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4f11c8]
sub esp, 4
test ebx, ebx
je 0x4b3be5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4b3bde
test esi, esi
je 0x4b3bde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4b3bc0
mov dword [esp], 0x4f11d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4b3f20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4b3f45
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4b3f50
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4b3f45
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4b3f98
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4b3f8e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4b3f9a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4b3f80
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6bf4f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402ad6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402a38
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], edi
mov ecx, dword [eax]
mov ebx, 1
mov dword [ebp - 0x60], ecx
cmp ebx, dword [ebp - 0x60]
jg 0x6bf621
mov edx, edi
and dl, 0
mov dword [ebp - 0x68], edx
fild dword [ebp - 0x68]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
cmp dword [section..data], 0
jne 0x6bf559
fdiv qword [0x401968]
jmp 0x6bf56a
push dword [0x40196c]
push dword [0x401968]
call sub.MSVBVM60.DLL__adj_fdiv_m64
fnstsw ax
test al, 0xd
jne 0x6bf64d
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [0x6c5838]
and eax, 0xff
test ecx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], 3
je 0x6bf5e8
cmp word [ecx], 1
jne 0x6bf5e8
mov esi, ebx
sub esi, 1
jo 0x6bf652
cmp esi, 0x10001
jb 0x6bf5b8
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [0x6c5838]
mov eax, dword [0x6c57d4]
mov edx, dword [ecx + 0x14]
and edi, 0xff
movsx esi, word [eax + esi*2]
mov eax, dword [ecx + 0x10]
xor esi, edi
sub esi, edx
cmp esi, eax
jb 0x6bf5e1
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [0x6c5838]
shl esi, 4
mov eax, esi
jmp 0x6bf5f4
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [0x6c5838]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x50]
push edx
add ecx, eax
lea edx, [ebp - 0x40]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarXor]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
mov edi, eax
mov eax, 1
add eax, ebx
jo 0x6bf652
mov ebx, eax
jmp 0x6bf52e
mov dword [ebp - 0x2c], edi
push 0x6bf637
wait
jmp 0x6bf636
ret
jmp 0x402adc
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop