joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fb560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x705890
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x91931c]
test eax, eax
je 0x5fb68e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5fb5b3
cmp dword [eax + 4], 0
mov esi, eax
jne 0x5fb689
mov eax, dword [0x91931c]
test eax, eax
je 0x5fb6ad
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5fb6c7
mov esi, eax
test eax, eax
jne 0x5fb650
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x5fb5fa
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x5fb6eb
mov dword [0x919820], eax
push 0x20
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x5fb6eb
mov dword [eax], 0x91931c
mov dword [eax + 4], 0
mov esi, eax
movsd xmm0, qword [ebp - 0x38]
movsd xmm1, qword [ebp - 0x30]
movsd qword [eax + 8], xmm0
movsd qword [eax + 0x10], xmm1
movsd xmm0, qword [ebp - 0x28]
movsd qword [eax + 0x18], xmm0
mov eax, dword [0x91931c]
test eax, eax
je 0x5fb6dc
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.005faee0
movsd xmm1, qword [ebp - 0x30]
movsd xmm0, qword [ebp - 0x38]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [ebp - 0x28]
movsd qword [esi + 0x14], xmm1
mov eax, dword [ebp - 0x20]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x5fb689
lock dec dword [0x919778]
add esi, 4
jmp 0x5fb6c9
mov ecx, 0x91931c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x5fb5a7
jmp 0x5fb5b3
mov ecx, 0x91931c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x5fb5d1
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x91931c
call fcn.00721c80
jmp 0x5fb648
mov ecx, 4
mov edx, 0x20
mov dword [ebp - 0x10], 0
call fcn.00709d20
ud2
Function at 0x61da00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x310
cmp dword [edx + 4], 0
mov edi, ecx
je 0x61da33
mov esi, dword [edx + 4]
mov eax, edx
mov dword [esp + 0x14], edi
cmp esi, 1
jne 0x61da3c
mov eax, dword [eax]
mov byte [esp], 3
movzx ecx, byte [eax]
jmp 0x61db33
mov byte [edi + 8], 2
jmp 0x61dc12
mov ebx, 1
lea ecx, [esp + 0x38]
mov edx, 1
push esi
push dword [eax]
call fcn.00640630
add esp, 8
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x78]
cmp dword [esp + 0x70], 0
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
jne 0x61dabf
test esi, esi
je 0x61daad
js 0x61dc28
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x61da99
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x61dc1a
mov dword [0x919820], eax
push esi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test eax, eax
je 0x61dc1a
push esi
push dword [esp + 8]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 4], ebx
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x68]
movsd xmm1, qword [esp + 0x44]
movsd xmm2, qword [esp + 0x4c]
movsd xmm3, qword [esp + 0x54]
movzx ebx, byte [esp + 0x3a]
movzx ecx, word [esp + 0x38]
movsd xmm0, qword [esp + 0x60]
mov esi, dword [esp + 0x3c]
mov byte [esp], 6
mov dword [esp + 0x30], edx
movzx edx, byte [esp + 0x41]
mov dword [esp + 0xc], eax
movzx eax, byte [esp + 0x3b]
mov ah, byte [esp + 0x40]
movsd qword [esp + 0x1c8], xmm1
movsd qword [esp + 0x28], xmm3
movsd qword [esp + 0x20], xmm2
movsd qword [esp + 0x18], xmm1
mov byte [esp + 1], dl
movzx edx, word [esp + 0x42]
mov byte [esp + 3], al
mov byte [esp + 2], ah
movzx edi, bl
movzx eax, ch
movsd xmm1, qword [esp + 0x18]
movsd xmm2, qword [esp + 0x20]
shl edi, 0x10
shl eax, 8
or eax, edi
movzx edi, cl
lea ecx, [esp + 0x1c8]
or edi, eax
movzx eax, byte [esp + 3]
mov byte [esp + 0x3b], al
movzx eax, byte [esp + 2]
mov dword [esp + 0x3c], esi
mov byte [esp + 0x40], al
movzx eax, byte [esp + 1]
mov byte [esp + 0x41], al
mov eax, dword [esp + 0x30]
mov word [esp + 0x42], dx
movsd qword [esp + 0x44], xmm1
movsd xmm1, qword [esp + 0x28]
movsd qword [esp + 0x4c], xmm2
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xc]
movsd qword [esp + 0x54], xmm1
movlps qword [esp + 0x60], xmm0
mov dword [esp + 0x68], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x70], 1
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x80]
push 0x144
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, word [esp + 9]
movzx edx, byte [esp + 0xb]
movzx ecx, byte [esp]
mov byte [esp + 0x1c7], dl
mov word [esp + 0x1c5], ax
mov byte [esp + 0x3a], bl
mov word [esp + 0x38], di
mov byte [esp + 0x1c4], cl
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x38]
call fcn.0061d260
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 1
mov edx, esi
call fcn.00709d20
ud2
call fcn.00425040
ud2
Function at 0x647eb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x919330]
test eax, eax
je 0x647edc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x647ef2
mov ecx, dword [eax + 4]
add eax, 8
test ecx, ecx
cmove eax, ecx
je 0x647ef2
add esp, 0x18
pop esi
ret
mov ecx, 0x919330
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x647eca
mov eax, dword [0x919330]
test eax, eax
je 0x647f90
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x647faa
mov esi, eax
test eax, eax
jne 0x647f6d
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x647f39
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x647ff2
mov dword [0x919820], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x647ff2
mov dword [eax], 0x919330
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x919330]
test eax, eax
je 0x647fb1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, 1
lock xadd dword [0x91932c], ecx
test ecx, ecx
je 0x647fbd
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
add esp, 0x18
pop esi
ret
mov ecx, 0x919330
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x647f10
xor eax, eax
add esp, 0x18
pop esi
ret
mov ecx, 0x919330
call fcn.00721c80
jmp 0x647f65
mov ecx, esp
mov edx, 0x8bf2b4
mov dword [esp], str.regex:_thread_ID_allocation_space_exhausted
mov dword [esp + 4], 1
mov dword [esp + 0x10], 0
mov dword [esp + 8], str.not_implementedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowsdrop_handler.rs
mov dword [esp + 0xc], 0
call fcn.00709f70
ud2
mov ecx, 4
mov edx, 0xc
call fcn.00709d20
ud2
Function at 0x677c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [edx]
mov esi, edx
mov edi, ecx
test ebx, ebx
je 0x677c5c
cmp dword [edi], 0
jne 0x677e6e
mov ebp, dword [esi + 8]
xor edi, edi
mov dword [esi + 8], 0
test ebp, ebp
je 0x677e6e
mov dword [esp], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
add ebx, 4
jmp 0x677c43
add ebx, 0x10
sub ebp, 1
jb 0x677c99
cmp dword [ebx], 0
je 0x677c40
push dword [ebx - 4]
push 0
push dword [0x919820]
call esi
jmp 0x677c40
mov ebx, dword [edi]
test ebx, ebx
je 0x677e6c
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x677e6c
mov ecx, dword [ebx + 8]
cmp ebp, 1
mov dword [esp], esi
je 0x677dfd
lea edx, [ebp + 0xfffffff]
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jae 0x677ca1
xor edx, edx
jmp 0x677dd8
mov esi, dword [esp]
jmp 0x677e6e
movd xmm0, ecx
and edx, 7
mov esi, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x725630]
sub esi, edx
mov dword [esp + 4], edx
lea edx, [ebx + 0x88]
mov ecx, esi
movdqa xmm2, xmm1
mov dword [esp + 8], esi
nop dword [eax]
movd xmm3, dword [edx - 0x40]
movd xmm5, dword [edx - 0x50]
movd xmm4, dword [edx - 0x70]
movd xmm6, dword [edx - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edx]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edx - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x30]
sub edx, 0xffffff80
add ecx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x677cd0
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esp + 4], 0
mov edx, dword [esp + 8]
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ecx, xmm0
je 0x677dfd
sub eax, edx
shl edx, 4
lea edx, [edx + ebx + 0x18]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov esi, dword [edx]
cmp ecx, esi
cmovae ecx, esi
add edx, 0x10
dec eax
jne 0x677df0
test ecx, ecx
je 0x677e20
add ebx, 0xc
shl ebp, 4
nop word [eax + eax]
mov byte [ebx], 0
add ebx, 0x10
add ebp, 0xfffffff0
jne 0x677e10
mov esi, dword [esp]
jmp 0x677e6c
mov esi, dword [esp]
add ebx, 4
jmp 0x677e33
add ebx, 0x10
sub ebp, 1
jb 0x677e50
cmp dword [ebx], 0
je 0x677e30
push dword [ebx - 4]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x677e30
cmp dword [edi + 4], 0
je 0x677e66
push dword [edi]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi], 0
xor edi, edi
mov eax, edi
mov edx, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x69fba0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x706d60
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x919340]
test eax, eax
je 0x69fbf3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x69fc09
cmp dword [eax + 4], 0
mov edi, eax
je 0x69fc09
add edi, 8
jmp 0x69fcd8
mov ecx, 0x919340
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x69fbe3
mov eax, dword [0x919340]
test eax, eax
je 0x69fcbc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x69fcd6
mov esi, eax
test eax, eax
jne 0x69fc98
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x919340
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x69fc5e
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x69fcf7
mov dword [0x919820], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x69fcf7
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov esi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x919340]
test eax, eax
je 0x69fceb
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x69fcd8
call fcn.0069f970
jmp 0x69fcd8
mov ecx, 0x919340
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x69fc27
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x919340
call fcn.00721c80
jmp 0x69fc90
mov ecx, 4
mov edx, 0x10
mov dword [ebp - 0x10], 0
call fcn.00709d20
ud2
Function at 0x6a0680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x706d70
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x6a06be
test eax, eax
jne 0x6a083a
mov ebx, dword [0x919838]
test ebx, ebx
je 0x6a083a
mov dword [ebp - 0x20], 0
jmp 0x6a06e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6a0718
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x6a088b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6a06e0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x6a06e0
test byte [ebp - 0x20], 1
je 0x6a083a
mov ebx, dword [0x919838]
test ebx, ebx
je 0x6a083a
mov dword [ebp - 0x20], 0
jmp 0x6a0747
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6a0778
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x6a088b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6a0740
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x6a0740
test byte [ebp - 0x20], 1
je 0x6a083a
mov ebx, dword [0x919838]
test ebx, ebx
je 0x6a083a
mov dword [ebp - 0x20], 0
jmp 0x6a07a7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6a07d8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x6a088b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6a07a0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x6a07a0
test byte [ebp - 0x20], 1
je 0x6a083a
mov ebx, dword [0x919838]
test ebx, ebx
je 0x6a083a
mov dword [ebp - 0x20], 0
jmp 0x6a0807
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6a0834
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x6a088b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6a0800
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x6a0800
test byte [ebp - 0x20], 1
jne 0x6a0854
movzx eax, byte [0x8f9200]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x919838]
jmp 0x6a085f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6a083a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x6a088b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x6a085c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x6a085c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_d5c2e9c342b358556da91d61ed4133f6f50fc0c3library_std_src_synconce.rs
mov edx, 0x2b
push 0x8c9f00
call fcn.0070a0f0
add esp, 4
ud2
Function at 0x6a1310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x91937c]
test eax, eax
je 0x6a1338
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6a134e
cmp dword [eax + 4], 0
mov edi, eax
je 0x6a134e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x91937c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6a1328
mov eax, dword [0x91937c]
test eax, eax
je 0x6a1409
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6a1423
mov esi, eax
test eax, eax
jne 0x6a13c9
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6a1395
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6a1436
mov dword [0x919820], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6a1436
mov dword [eax], 0x91937c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x91937c]
test eax, eax
je 0x6a142a
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x6a1333
test ecx, ecx
je 0x6a1333
lock dec dword [ecx]
jne 0x6a1333
call fcn.0068d870
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x91937c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6a136c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x91937c
call fcn.00721c80
jmp 0x6a13c1
mov ecx, 4
mov edx, 0x10
call fcn.00709d20
ud2

Function at 0x6a1c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x91938c]
test eax, eax
je 0x6a1cf4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6a1c73
cmp byte [eax + 4], 0
mov esi, eax
jne 0x6a1ced
mov eax, dword [0x91938c]
test eax, eax
je 0x6a1d13
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6a1d2d
mov esi, eax
test eax, eax
jne 0x6a1ce7
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6a1cba
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6a1d3f
mov dword [0x919820], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6a1d3f
mov dword [eax], 0x91938c
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x91938c]
test eax, eax
je 0x6a1d33
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x91938c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6a1c6b
jmp 0x6a1c73
mov ecx, 0x91938c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6a1c91
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x91938c
call fcn.00721c80
jmp 0x6a1cdf
mov ecx, 4
mov edx, 8
call fcn.00709d20
ud2
Function at 0x6a2b10
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x6a2b64
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x6a2b87
test eax, eax
js 0x6a2b73
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x6a2b7f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x8c97d0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.006a0c20
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.006a0d80
mov ecx, 7
int 0x29
ud2
Function at 0x6a3180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x91936c]
test eax, eax
je 0x6a31a2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x6a31b8
cmp dword [eax + 4], 0
je 0x6a31b8
add eax, 8
pop esi
ret
mov ecx, 0x91936c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x6a3197
mov eax, dword [0x91936c]
test eax, eax
je 0x6a323e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6a3258
mov esi, eax
test eax, eax
jne 0x6a3227
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
test eax, eax
jne 0x6a31f7
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x6a3268
mov dword [0x919820], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6a3268
mov dword [eax], 0x91936c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x91936c]
test eax, eax
je 0x6a325c
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0x91936c
call fcn.00721c80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x6a31d2
xor eax, eax
pop esi
ret
mov ecx, 0x91936c
call fcn.00721c80
jmp 0x6a321f
mov ecx, 4
mov edx, 0x10
call fcn.00709d20
ud2
Function at 0x6a4920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x706f20
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x6a49b0
jmp 0x6a499e
jbe 0x6a4a42
cmp esi, 0x201
jae 0x6a49b0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x6a49eb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x6a49dc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.00718210
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x6a4a0e
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x6a4aa4
cmp esi, edi
jne 0x6a4990
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x6a4abf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x6a499e
jmp 0x6a49b0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x6a4adf
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.006a53e0
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6a4a90
push dword [ebp - 0x24]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x6a4a7f
jmp 0x6a4a90
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codeC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinit_0.28.6_srcplatform_implwindowswindow_state.rs
mov edx, 0x28
push 0x8ca010
call fcn.0070a0f0
add esp, 4
jmp 0x6a4aee
mov ecx, esi
push 0x8ca000
call fcn.0070a080
add esp, 4
ud2