joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dd8d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x5dd924
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x5dd947
test eax, eax
js 0x5dd933
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x5dd93f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0xa0c300
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.005dbbd0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.005dbd20
mov ecx, 7
int 0x29
ud2
Function at 0x5dde50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0xa70880]
test eax, eax
je 0x5ddee8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5dde76
cmp dword [eax + 4], 0
je 0x5dde76
add eax, 8
pop esi
ret
mov eax, dword [0xa70880]
test eax, eax
je 0x5ddef7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5ddee4
mov esi, eax
test eax, eax
jne 0x5ddecd
movzx eax, byte [0xa71040]
mov ecx, 0x10
mov edx, 4
call fcn.004041e0
test eax, eax
je 0x5ddf12
mov dword [eax], 0xa70880
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xa70880]
test eax, eax
je 0x5ddf06
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0xa70880
call fcn.00642bc0
jmp 0x5dde5f
mov ecx, 0xa70880
call fcn.00642bc0
jmp 0x5dde80
mov ecx, 0xa70880
call fcn.00642bc0
jmp 0x5ddec5
mov ecx, 4
mov edx, 0x10
call fcn.0063c970
ud2
Function at 0x5df990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x62c2b0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x5dfa20
jmp 0x5dfa0e
jbe 0x5dfaac
cmp esi, 0x201
jae 0x5dfa20
lea edi, [ebp - 0x44c]
mov dword [ebp - 0x2c], 0x200
mov ebx, esi
jmp 0x5dfa5b
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, ebx
sub eax, ebx
cmp eax, esi
jae 0x5dfa4c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, ebx
push esi
call fcn.00642e70
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x5dfa7b
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x5dfae4
cmp esi, ebx
jne 0x5dfa00
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x5dfb1f
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x5dfa0e
jmp 0x5dfa20
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x5dfb3f
lea ecx, [ebp - 0x4c]
mov edx, edi
push esi
call fcn.005e0460
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x5dfaf7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x5dfb0b
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.00404240
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codecannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225library_std_src_threadlocal.rs
mov edx, 0x28
push 0xa0cb2c
call fcn.0063cd70
add esp, 4
jmp 0x5dfb4e
mov ecx, esi
push 0xa0cb3c
call fcn.0063cd00
add esp, 4
ud2
Function at 0x5e4550
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x5e459d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x5e45ad
mov dword [esi + 4], 0
jmp 0x5e45bf
cmp eax, 0x103
je 0x5e45d7
test eax, eax
js 0x5e45c8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x5e45c2
mov eax, esp
mov dword [esp + 0x1c], 0xa0c300
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.005dbbd0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.005dbd20
mov ecx, 7
int 0x29
ud2
Function at 0x5e4c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x74], 0x62c390
movaps xmm0, xmmword [0x646050]
lea edi, [esi + 0x20]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0xc]
mov eax, dword fs:[0]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x70]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], 0
mov word [esi + 0x40], 0
mov dword [esi + 0x20], 0
movups xmmword [esi + 0x28], xmm0
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 1
push edi
push eax
call fcn.005e3c10
add esp, 8
cmp byte [esi + 0xc], 4
jne 0x5e4d12
mov ebx, dword [esi + 0x10]
jmp 0x5e4d20
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
cmp al, 4
jne 0x5e4dce
lea ecx, [esi + 0x20]
mov edx, ebx
call fcn.005e3e20
mov eax, dword [esi + 0x20]
mov dword [esi + 8], ebx
xor eax, 2
or eax, dword [esi + 0x24]
jne 0x5e4d98
movzx eax, byte [esi + 0x28]
mov ecx, dword [esi + 0x2c]
cmp al, 4
je 0x5e4d9b
cmp al, 3
jne 0x5e4d86
mov eax, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0x78], 2
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], ecx
call dword [ecx]
add esp, 4
mov eax, dword [esi + 0x1c]
cmp dword [eax + 4], 0
je 0x5e4d76
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0x18]
call fcn.00404240
mov ecx, dword [esi + 4]
mov edx, 4
call fcn.00404240
mov ebx, dword [esi + 8]
mov eax, 1
xor ecx, ecx
xor edi, edi
mov dword [esi + 0x78], 1
jmp 0x5e4dfd
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x5e4df1
setns al
js 0x5e4e92
movzx edi, al
movzx eax, byte [0xa71040]
mov dword [esi + 4], ecx
mov edx, edi
call fcn.004041e0
test eax, eax
je 0x5e4ea0
mov ecx, dword [esi + 4]
mov edi, 1
jmp 0x5e4dfd
mov edx, dword [esi + 0x14]
mov ecx, eax
shr ecx, 8
mov byte [edx + 4], al
shr eax, 0x18
mov word [edx + 5], cx
mov byte [edx + 7], al
mov dword [edx + 8], ebx
mov dword [edx], 0
jmp 0x5e4e81
mov edi, 1
xor ecx, ecx
mov eax, 1
mov dword [esi + 0x20], eax
mov eax, ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], 0
mov dword [esi + 0x78], 1
lea ecx, [esi + 0xc]
lea edx, [esi + 0x20]
push eax
push edi
push ebx
call fcn.005e4f30
add esp, 0xc
movzx eax, byte [esi + 0xc]
cmp al, 4
jne 0x5e4e43
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x14]
movsd xmm0, qword [esi + 0x20]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push dword [esi + 8]
jmp 0x5e4e7b
movzx ecx, byte [esi + 0xf]
mov edx, dword [esi + 0x14]
movzx ebx, word [esi + 0xd]
mov edi, dword [esi + 0x10]
cmp dword [esi + 0x24], 0
mov byte [edx + 7], cl
mov word [edx + 5], bx
mov byte [edx + 4], al
mov dword [edx + 8], edi
mov edi, dword [esi + 8]
mov dword [edx], 0
je 0x5e4e7a
mov ecx, dword [esi + 0x20]
mov edx, 1
call fcn.00404240
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x78], 0
call fcn.0043aad0
jmp 0x5e4eb1
mov edx, dword [esi + 4]
mov ecx, edi
mov dword [esi + 0x78], 0
call fcn.0063c970
ud2
Function at 0x5e5e20
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.005de730
add esp, 4
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x5e5e86
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.005e4640
add esp, 4
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x5e5e82
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x5e5e8d
mov byte [esi], 4
test ebx, ebx
jne 0x5e5e9d
jmp 0x5e5ea9
mov eax, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], eax
jmp 0x5e5ea9
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x5e5ea9
mov ecx, edi
mov edx, 2
call fcn.00404240
add esp, 0x18
pop esi
pop edi
pop ebx
ret

Function at 0x5e83d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0xa708d0]
test eax, eax
je 0x5e8488
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5e83fc
cmp dword [eax + 4], 0
mov edi, eax
je 0x5e83fc
add edi, 8
jmp 0x5e8483
mov eax, dword [0xa708d0]
test eax, eax
je 0x5e8497
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5e8481
mov esi, eax
test eax, eax
jne 0x5e8457
movzx eax, byte [0xa71040]
mov ecx, 0xc
mov edx, 4
call fcn.004041e0
test eax, eax
je 0x5e84b2
mov dword [eax], 0xa708d0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xa708d0]
test eax, eax
je 0x5e84a6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x5e8483
test ecx, ecx
je 0x5e8483
lock dec dword [ecx]
jne 0x5e8483
call fcn.005e84d0
jmp 0x5e8483
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xa708d0
call fcn.00642bc0
jmp 0x5e83e0
mov ecx, 0xa708d0
call fcn.00642bc0
jmp 0x5e840a
mov ecx, 0xa708d0
call fcn.00642bc0
jmp 0x5e844f
mov ecx, 4
mov edx, 0xc
call fcn.0063c970
ud2
Function at 0x5e8d40
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0xa70d9c]
mov esi, ecx
cmp eax, 3
jne 0x5e8e25
cmp ebp, 0x17f
ja 0x5e8e36
mov dword [esp + 4], ebx
lea ebx, [esp + 0x34]
push ebp
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esp + ebp + 0x34], 0
inc ebp
lea ecx, [esp + 8]
mov edx, ebx
push ebp
call fcn.004435a0
add esp, 4
cmp dword [esp + 8], 0
je 0x5e8db7
mov eax, dword [0xa0b948]
mov ecx, dword [0xa0b94c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x5e8e1a
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
mov ecx, esp
mov dword [esp], 0
lea edx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x5e8e05
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x5e8e1a
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00643190
cmp ebp, 0x17f
jbe 0x5e8d6f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.006431e0
add esp, 0x1bc
jmp 0x5e8e20
Function at 0x5ef4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.005de730
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x5ef505
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.005ef3b0
mov edi, dword [esp]
test edi, edi
je 0x5ef514
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5ef529
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x5ef521
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.005de900
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x5ef521
mov ecx, edi
mov edx, 2
call fcn.00404240
jmp 0x5ef521
Function at 0x5f0e00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x62c580
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0xa71040]
call fcn.004041e0
test eax, eax
je 0x5f0edc
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x5f11e0
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x5f0e7d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x5f0ecb
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
cmp dword [eax + 4], 0
je 0x5f0eb2
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00404240
mov ecx, dword [ebp - 0x28]
mov edx, 4
call fcn.00404240
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.0063c970
ud2
Function at 0x5f1630
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x103c
call fcn.0063aac0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x62c5d0
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], edx
lea ebx, [ebp - 0x1048]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x5e98a0
push edi
push 0x1000
push ebx
mov dword [ebp - 0x20], esi
push esi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x5f1783
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x34], 0
je 0x5f16ba
cmp dword [ebp - 0x30], 0
jne 0x5f1789
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x5f1789
cmp ecx, 0x1000
mov dword [ebp - 0x24], ecx
ja 0x5f17c8
xor esi, esi
nop dword [eax]
mov eax, ecx
sub eax, esi
jb 0x5f17ad
xorps xmm0, xmm0
lea edx, [ebp - 0x34]
lea ecx, [ebp + esi - 0x1048]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], edx
push 0x5e98a0
push edi
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x5f1783
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x34], 0
je 0x5f1730
cmp dword [ebp - 0x30], 0
jne 0x5f1789
add esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp esi, ecx
jne 0x5f16f0
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x5e98a0
push edi
push 0x1000
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x5f16ba
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x103c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0xa0c56c
call fcn.0063cf70
add esp, 4
jmp 0x5f17e1
mov dword [ebp - 0x10], 0
mov edx, 0x1000
push 0xa0c56c
call fcn.0063cd00
add esp, 4
ud2
Function at 0x5f1840
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x62c5e0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x5f18be
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0xa0c67c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0xa0c6a8
mov dword [esi + 0x2c], fcn.005e2620
mov dword [esi + 0x3c], 1
call fcn.0063cbf0
ud2

Function at 0x5f2d90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0xa708b0]
test eax, eax
je 0x5f2e14
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5f2daf
cmp byte [eax + 4], 0
mov esi, eax
jne 0x5f2e09
mov eax, dword [0xa708b0]
test eax, eax
je 0x5f2e23
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5f2e0e
mov esi, eax
test eax, eax
jne 0x5f2e03
movzx eax, byte [0xa71040]
mov ecx, 8
mov edx, 4
call fcn.004041e0
test eax, eax
je 0x5f2e3b
mov dword [eax], 0xa708b0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0xa708b0]
test eax, eax
je 0x5f2e2f
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x5f2e10
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xa708b0
call fcn.00642bc0
jmp 0x5f2d9b
mov ecx, 0xa708b0
call fcn.00642bc0
jmp 0x5f2db9
mov ecx, 0xa708b0
call fcn.00642bc0
jmp 0x5f2dfb
mov ecx, 4
mov edx, 8
call fcn.0063c970
ud2
Function at 0x5f2f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x62c630
lea eax, [esi + 0x30]
mov edi, dword fs:[0]
mov dword [esi + 0x30], edi
mov dword fs:[0], eax
movq xmm0, qword [0xa70db8]
mov dword [esi + 8], edx
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd ebx, xmm0
mov eax, edi
or eax, ebx
jne 0x5f2fd5
mov edi, ecx
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x5f3088
movq xmm0, qword [esi]
mov edx, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, edi
movq qword [0xa70db8], xmm0
mov eax, edx
mov edi, edx
mov edx, dword [esi + 8]
or eax, ebx
je 0x5f306f
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ecx
push ebx
push edi
push edx
push ecx
call fcn.0063aaf0
mov ebx, edx
mov ecx, edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], edi
mul edi
imul ecx, ebx
mov ebx, dword [esi + 0x10]
mov edi, dword [esi + 0xc]
add ecx, edx
mov edx, ebx
imul edx, edi
add ecx, edx
mov edx, dword [esi + 0x14]
sub edx, eax
mov eax, dword [esi + 8]
sbb eax, ecx
imul ecx, eax, 0x3b9aca00
mov eax, edx
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push ebx
push dword [esi + 0x18]
push edx
push eax
call fcn.0063aaf0
mov ebx, eax
mov ecx, edx
mov eax, edi
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 0x1c], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0063aaf0
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero_rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225librarycore_srccharmethods.rs
mov edx, 0x19
push 0xa0bb88
call fcn.0063cd70
add esp, 4
ud2
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x20]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0xa0cae4
push 0xa0a7b8
push eax
call fcn.0063cff0
add esp, 0xc
ud2