joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x54a254]
test eax, eax
je 0x499675
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4995bc
cmp dword [eax + 4], 0
mov esi, eax
jne 0x499670
mov eax, dword [0x54a254]
test eax, eax
je 0x499693
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4996ac
mov esi, eax
test eax, eax
jne 0x499637
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x499601
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4996c5
mov dword [0x5c6108], eax
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4996c5
mov dword [eax], 0x54a254
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54a254]
test eax, eax
je 0x4996b6
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
lea ecx, [ebp - 0x20]
call sym.parking_lot_core::parking_lot::ThreadData::new::hbe14286d19cbe76e
movsd xmm1, qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x20]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [ebp - 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [ebp - 8]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x499670
lock dec dword [0x5c6070]
add esi, 4
jmp 0x4996ae
mov ecx, 0x54a254
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4995b0
jmp 0x4995bc
mov ecx, 0x54a254
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4995d9
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop ebp
ret
mov ecx, 0x54a254
call dbg.init
jmp 0x499630
mov ecx, 4
mov edx, 0x20
call dbg.handle_alloc_error
ud2
Function at 0x4bb970
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x4bb986
dec eax
jmp 0x4bb98d
mov ecx, esi
call dbg.init
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
push edi
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4bb9ac
dec eax
jmp 0x4bb9b3
mov ecx, esi
call dbg.init
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x4dd930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, edx
mov ebx, ecx
mov edx, esi
sub edx, edi
shr edx, 3
sub esi, edi
je 0x4dda85
cmp esi, 0x7ffffff9
jae 0x4ddaaa
mov dword [ebp - 0x10], edx
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x4dd980
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4dda9c
mov dword [0x5c6108], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4dda9c
xor ecx, ecx
cmp esi, 0xa0
mov dword [ebp - 0x14], ebx
jb 0x4dda60
mov ebx, dword [ebp - 0x10]
lea edx, [eax + ebx*8 - 8]
cmp edx, eax
jb 0x4dda60
lea edx, [eax + 4]
mov dword [ebp - 0x18], edx
lea edx, [eax + ebx*8 - 4]
cmp edx, dword [ebp - 0x18]
jb 0x4dda60
lea edx, [ebx - 1]
cmp edx, 0x1fffffff
ja 0x4dda60
and esi, 0xfffffff8
mov ebx, dword [ebp - 0x14]
lea edx, [edi + esi]
cmp eax, edx
mov edx, dword [ebp - 0x10]
jae 0x4dd9ee
mov edx, eax
add edx, esi
cmp edx, edi
mov edx, dword [ebp - 0x10]
ja 0x4dda60
movdqa xmm0, xmmword [0x54bad0]
mov ecx, edx
xor edx, edx
and ecx, 0xfffffffe
nop dword [eax]
movdqu xmm2, xmmword [edi + edx*8]
pshufd xmm1, xmm2, 0xe8
pshufd xmm3, xmm2, 0xed
movdqa xmm4, xmm1
movdqa xmm2, xmm3
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm4
movdqa xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm1
pand xmm1, xmm2
pand xmm2, xmm3
pandn xmm4, xmm3
por xmm1, xmm4
por xmm2, xmm5
punpckldq xmm1, xmm2
movdqu xmmword [eax + edx*8], xmm1
add edx, 2
cmp ecx, edx
jne 0x4dda00
mov edx, dword [ebp - 0x10]
cmp edx, ecx
je 0x4dda8c
nop word [eax + eax]
mov esi, dword [edi + ecx*8 + 4]
mov edx, dword [edi + ecx*8]
cmp edx, esi
mov ebx, esi
cmovb ebx, edx
cmova esi, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + ecx*8], ebx
mov dword [eax + ecx*8 + 4], esi
inc ecx
cmp edx, ecx
jne 0x4dda60
mov ebx, dword [ebp - 0x14]
jmp 0x4dda8c
xor ecx, ecx
mov eax, 4
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, esi
call dbg.handle_alloc_error
ud2
call sym.alloc::raw_vec::capacity_overflow::hd0578b62e5d0dfac
ud2
Function at 0x4f0fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
movzx eax, byte [0x5c6114]
test al, al
je 0x4f1168
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4f1006
cmp eax, 3
jne 0x4f1168
mov edi, dword [0x5c6118]
test edi, edi
je 0x4f1168
mov dword [ebp - 0x10], 0
jmp 0x4f1027
mov edi, dword [edi + 8]
test edi, edi
je 0x4f1056
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4f11a7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4f1020
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x4f1020
test byte [ebp - 0x10], 1
je 0x4f1168
mov edi, dword [0x5c6118]
test edi, edi
je 0x4f1168
mov dword [ebp - 0x10], 0
jmp 0x4f1087
mov edi, dword [edi + 8]
test edi, edi
je 0x4f10b6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4f11a7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4f1080
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x4f1080
test byte [ebp - 0x10], 1
je 0x4f1168
mov edi, dword [0x5c6118]
test edi, edi
je 0x4f1168
mov dword [ebp - 0x10], 0
jmp 0x4f10e7
mov edi, dword [edi + 8]
test edi, edi
je 0x4f1116
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4f11a7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4f10e0
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x4f10e0
test byte [ebp - 0x10], 1
je 0x4f1168
mov edi, dword [0x5c6118]
test edi, edi
je 0x4f1168
mov dword [ebp - 0x10], 0
jmp 0x4f1137
mov edi, dword [edi + 8]
test edi, edi
je 0x4f1162
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4f11a7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4f1130
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x4f1130
test byte [ebp - 0x10], 1
jne 0x4f1172
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x5c6118]
jmp 0x4f117d
mov edi, dword [edi + 8]
test edi, edi
je 0x4f1168
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4f11a7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4f117a
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x4f117a
mov edx, 0x2b
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_threadmod.rs
push 0x5a1fe0
call dbg.panic
add esp, 4
ud2
Function at 0x4f1e10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4f1e80
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x4f1eba
cmp dword [ebp - 0x14], 0
je 0x4f1ea1
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4f1edc
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5c6118]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x5c6118], esi
jne 0x4f1e60
mov byte [0x5c6114], 1
push 0
push 0
push ebx
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x4f1eb0
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4f1f18
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4f1ea5
mov edi, dword [ebp - 0x10]
jmp 0x4f1eb0
mov edi, dword [esi]
jmp 0x4f1eaf
mov edi, eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x10]
mov edx, 0x5a1f5c
push 0x5a1fbc
push eax
call dbg.assert_failed<i32, i32>
add esp, 8
ud2
push 0
push 4
push ebx
call sub.KERNEL32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x5a1fac
mov dword [ebp - 0x2c], 0x5a1f74
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_threadmod.rs
mov dword [ebp - 0x20], 0
call dbg.panic_fmt
ud2
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x5a1f74
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_threadmod.rs
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dbg.assert_failed<u32, u32>
ud2
Function at 0x4f2140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x54a2a4]
test eax, eax
je 0x4f216a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4f217f
cmp dword [eax + 4], 0
mov edi, eax
je 0x4f217f
add edi, 8
jmp 0x4f2237
mov ecx, 0x54a2a4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4f215a
mov eax, dword [0x54a2a4]
test eax, eax
je 0x4f221c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4f2235
mov esi, eax
test eax, eax
jne 0x4f21f2
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x4f21c4
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4f2249
mov dword [0x5c6108], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4f2249
mov dword [eax], 0x54a2a4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54a2a4]
test eax, eax
je 0x4f223d
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4f2237
test ecx, ecx
je 0x4f2237
lock dec dword [ecx]
jne 0x4f2237
call dbg.drop_slow<std::thread::Inner, alloc::alloc::Global>
jmp 0x4f2237
mov ecx, 0x54a2a4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4f219c
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x54a2a4
call dbg.init
jmp 0x4f21eb
mov ecx, 4
mov edx, 0xc
call dbg.handle_alloc_error
ud2

Function at 0x4f22e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x4f22f6
dec eax
jmp 0x4f22fd
mov ecx, esi
call dbg.init
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
cmp dword [edi + 4], 0
je 0x4f231f
mov eax, dword [edi + 8]
test eax, eax
je 0x4f231f
lock dec dword [eax]
jne 0x4f231f
mov ecx, dword [edi + 8]
call dbg.drop_slow<std::thread::Inner, alloc::alloc::Global>
push edi
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4f2336
dec eax
jmp 0x4f233d
mov ecx, esi
call dbg.init
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x4f2720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x54a2b4]
test eax, eax
je 0x4f27c3
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4f2745
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4f27bb
mov eax, dword [0x54a2b4]
test eax, eax
je 0x4f27e1
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4f27fa
mov esi, eax
test eax, eax
jne 0x4f27b5
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x4f278a
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4f280d
mov dword [0x5c6108], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4f280d
mov dword [eax], 0x54a2b4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x54a2b4]
test eax, eax
je 0x4f2801
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x54a2b4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4f273d
jmp 0x4f2745
mov ecx, 0x54a2b4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4f2762
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x54a2b4
call dbg.init
jmp 0x4f27ae
mov ecx, 4
mov edx, 8
call dbg.handle_alloc_error
ud2
Function at 0x4f3630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x54a294]
test eax, eax
je 0x4f3655
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x4f366a
cmp dword [eax + 4], 0
je 0x4f366a
add eax, 8
pop esi
pop ebp
ret
mov ecx, 0x54a294
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x4f3649
mov eax, dword [0x54a294]
test eax, eax
je 0x4f36e9
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x4f36fe
mov esi, eax
test eax, eax
jne 0x4f36d1
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x4f36a3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4f370f
mov dword [0x5c6108], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4f370f
mov dword [eax], 0x54a294
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54a294]
test eax, eax
je 0x4f3703
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
pop esi
pop ebp
ret
mov ecx, 0x54a294
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4f367f
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x54a294
call dbg.init
jmp 0x4f36ca
mov ecx, 4
mov edx, 0x10
call dbg.handle_alloc_error
ud2

Function at 0x4f3780
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x4f3796
dec eax
jmp 0x4f379d
mov ecx, esi
call dbg.init
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
push edi
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4f37bc
dec eax
jmp 0x4f37c3
mov ecx, esi
call dbg.init
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x4f93a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x3a], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x36], 0
mov byte [ebp - 0x38], 1
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x54]
mov ecx, edi
push esi
push eax
call dbg.open
add esp, 8
cmp byte [ebp - 0x18], 4
jne 0x4f9408
mov ebx, dword [ebp - 0x14]
jmp 0x4f9421
movzx eax, byte [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
cmp eax, 3
je 0x4f94ab
cmp eax, 4
jne 0x4f94e3
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x54], xmm0
push esi
push ebx
call sub.KERNEL32.dll_GetFileInformationByHandle
test eax, eax
je 0x4f94a9
test byte [ebp - 0x53], 4
je 0x4f9469
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 8
push edi
push 9
push ebx
call sub.KERNEL32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x4f94f1
cmp dword [ebp - 0x34], 0
jne 0x4f94f6
mov eax, dword [ebp - 0x30]
test ebx, ebx
mov dword [ebp - 0x20], eax
je 0x4f9501
mov dword [ebp - 0x54], 0
call sub.KERNEL32.dll_GetCurrentProcess
push 2
push 0
push 0
push esi
push eax
push ebx
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x4f9564
mov eax, dword [ebp - 0x54]
jmp 0x4f9503
jmp 0x4f94f1
mov esi, dword [ebx + 4]
mov edi, dword [ebx]
mov eax, dword [esi]
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x4f94d5
cmp dword [esi + 8], 9
jb 0x4f94c7
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
push ebx
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x4f9578
call sub.KERNEL32.dll_GetLastError
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x4f9572
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [ebp - 0x1c], eax
push eax
call sub.KERNEL32.dll_CreateFileMappingA
test eax, eax
je 0x4f9551
mov edi, eax
push dword [ebp - 0x20]
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.KERNEL32.dll_CloseHandle
test esi, esi
je 0x4f9551
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
mov dword [eax], 1
jmp 0x4f9572
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4f9572
call sub.KERNEL32.dll_GetLastError
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x50d570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [edx + 8]
mov dword [esp], ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
cmp dword [ebx], 0
je 0x50d594
mov edi, dword [ebx + 0xc]
mov ebx, dword [ebx + 4]
jmp 0x50d5a3
mov edi, dword [ebx + 4]
cmp edi, 6
jae 0x50d708
add ebx, 8
test edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
je 0x50d67a
nop
dec edi
add ebx, 0x10
cmp edi, 0xffffffff
je 0x50d693
lea eax, [ebx - 0x10]
lea ecx, [esp + 0x20]
lea esi, [esp + 0x38]
lea edx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [eax + 0x20]
call dbg.parse_attribute<gimli::read::endian_slice::EndianSlice<gimli::endianity::LittleEndian>>
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x50d6bf
lea esi, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov esi, dword [esi]
mov dword [esp + 4], esi
lea esi, [esp + 0x32]
movzx esi, word [esi + 4]
mov word [esp + 8], si
movzx esi, word [esp + 0x30]
cmp si, word [ebp + 8]
mov esi, dword [esp + 0x2c]
jne 0x50d5c0
movzx edi, word [esp + 8]
mov ebx, dword [esp]
mov word [ebx + 0x16], di
mov edi, dword [esp + 4]
mov dword [ebx + 0x12], edi
mov dword [ebx + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], esi
mov word [ebx + 0x10], cx
jmp 0x50d700
cmp dword [edx + 0x14], 0
mov eax, dword [esp]
jne 0x50d6b0
mov dword [edx + 0x14], 1
mov dword [edx + 0x18], 0
jmp 0x50d6b0
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x50d6ad
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x50d700
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, 5
push 0x554324
call dbg.slice_end_index_len_fail
add esp, 4
ud2
Function at 0x515aa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x515ae8
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0xc0000011
jne 0x515af8
mov dword [esi + 4], 0
jmp 0x515b09
cmp eax, 0x103
je 0x515b21
test eax, eax
js 0x515b13
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x515b0c
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x5a19a4
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
push ecx
push edx
call dbg.write_fmt<std::sys::windows::stdio::Stderr>
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call dbg.drop_in_place<core::option::Option<std::io::error::Error>>
mov ecx, 7
int 0x29
ud2

Function at 0x5173f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x54a2c4]
test eax, eax
je 0x51741a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x51742f
cmp dword [eax + 4], 0
mov edi, eax
je 0x51742f
add edi, 8
jmp 0x5174e7
mov ecx, 0x54a2c4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x51740a
mov eax, dword [0x54a2c4]
test eax, eax
je 0x5174cc
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5174e5
mov esi, eax
test eax, eax
jne 0x5174a2
movzx eax, byte [0x5c6170]
mov eax, dword [0x5c6108]
test eax, eax
jne 0x517474
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x5174f9
mov dword [0x5c6108], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x5174f9
mov dword [eax], 0x54a2c4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54a2c4]
test eax, eax
je 0x5174ed
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x5174e7
test ecx, ecx
je 0x5174e7
lock dec dword [ecx]
jne 0x5174e7
call dbg.drop_slow<std::sync::mutex::Mutex<alloc::vec::Vec<u8, alloc::alloc::Global>>, alloc::alloc::Global>
jmp 0x5174e7
mov ecx, 0x54a2c4
call dbg.init
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x51744c
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x54a2c4
call dbg.init
jmp 0x51749b
mov ecx, 4
mov edx, 0xc
call dbg.handle_alloc_error
ud2
Function at 0x517550
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x517566
dec eax
jmp 0x51756d
mov ecx, esi
call dbg.init
push 1
push eax
call sub.KERNEL32.dll_TlsSetValue
cmp dword [edi + 4], 0
je 0x51758f
mov eax, dword [edi + 8]
test eax, eax
je 0x51758f
lock dec dword [eax]
jne 0x51758f
mov ecx, dword [edi + 8]
call dbg.drop_slow<std::sync::mutex::Mutex<alloc::vec::Vec<u8, alloc::alloc::Global>>, alloc::alloc::Global>
push edi
push 0
push dword [0x5c6108]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x5175a6
dec eax
jmp 0x5175ad
mov ecx, esi
call dbg.init
push 0
push eax
call sub.KERNEL32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret